[EDR Workflows] The default filter (event.category is process) added for the 'process Descendants' is not shown after saving the value

[muskangulati-qasource]

Description:
The default filter (event.category is process) added for the 'process Descendants' is not shown after saving the value

Build Details:

VERSION: 8.15.0
BUILD: 75426
COMMIT: f672297b140695f1c920c5a1b3bdce6fc812aceb

Preconditions:

1. Kibana user should be logged in

Steps to Reproduce:

1. Navigate to the Events tabs under Manage section for Security
2. From the drop down of field values, select process.pid
3. In the values, add -ve values for the process IDs and observe when the user adds - (hyphen), the error warning comes up but as soon as we add numerical value, the warning goes away.

Actual Result:
The default filter (event.category is process) added for the 'process Descendants' is not shown after saving the value

Expected Result:
The default filter (event.category is process) added for the 'process Descendants' should be visible to the user after saving the value

Screenshots

Login credentials
Link here

Logs
N/A

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

[muskangulati-qasource]

@manishgupta-qasource please review!

[manishgupta-qasource]

Reviewed & assigned to @dasansol92

CC: @ferullo

[ferullo]

@gergoabraham FYI

[gergoabraham]

@muskangulati-qasource, I'm not sure if I understand correctly - is this about not indicating the default filter on the Event Filters list page on the Event Filter cards? if yes, that's not implemented yet, here is the issue for it: https://github.com/elastic/security-team/issues/9711

[muskangulati-qasource]

Hi @gergoabraham,

Thank you for sharing the details. We have tested this ticket on the latest 8.15.0 BC4 build and found the issue is fixed. 🟢

Please find below the testing details.

Build details

VERSION: 8.15.0
BUILD: 76261
COMMIT: 9d62937675e62265342e86d8f0db601dc75498b8

Credentials for the instance
https://p.elstc.co/paste/c5Eo8wQO#1DDVKqsYg329BxAoQ1I8+FC7wjzj6dcLpy1LV+la3Z+

Observation and Screenshot

• The message is now visible for the descendant type used:
  

Hence, we are closing this issue and marking it as 'QA Validated'.

Thank you!

[muskangulati-qasource]

Bug Conversion

• Test-Case updated:
  • https://elastic.testmo.net/repositories/1?group_id=4487&case_id=31522

Thanks!