Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Detection Rules fail to install/update with basic license #197246

Open
syk-99 opened this issue Oct 22, 2024 · 4 comments
Open
Assignees
Labels
bug Fixes for quality problems that affect the customer experience Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. triage_needed

Comments

@syk-99
Copy link

syk-99 commented Oct 22, 2024

Describe the bug:

Some rules (probably machine learning rules) fail to install/update when basic license is in use.

Kibana/Elasticsearch Stack version:

8.15.3

Server OS version:

Debian and Ubuntu

Original install method (e.g. download page, yum, from source, etc.):

Debian Package from artifacts.elastic.co

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Detection Rules

Steps to reproduce:

  1. Install Elasticsearch, Kibana (Debian Package)
  2. Add Prebuilt Rules
  3. Install all Rules (maybe the error happens here as well - could not test with a new setup)
  4. Wait for new rules to be available (including machine learning rules)
  5. Try to install the new rules

Current behavior:

Some/all ML-rules fail to install - showing a green success-message in the bottom right of the screen "X rules failed to install" without any hint of the cause.
Numbers for installable rules (upgradable rules) increase over time.
Some ML-rules can be enabled even with a basic license in use.

Expected behavior:

All rules should be installable/upgradable regardless of applied license.

Errors in browser console:

Request to
[...]internal/detection_engine/prebuilt_rules/install/_perform
is answered with
"message": "Your license does not support machine learning. Please upgrade your license."
(same behaviour for certain conditions when requesting
[...]internal/detection_engine/prebuilt_rules/update/_perform

Any additional context (logs, chat logs, magical formulas, etc.):

Similar reports of this bug:
#190753
https://discuss.elastic.co/t/detection-rules-update-failure/369051
Screenshot of ML-rules that can be enabled even with a basic license:
Image

@syk-99 syk-99 added bug Fixes for quality problems that affect the customer experience Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. triage_needed labels Oct 22, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@MadameSheema MadameSheema added Team:Detections and Resp Security Detection Response Team Team:Detection Rule Management Security Detection Rule Management Team labels Oct 22, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@syk-99
Copy link
Author

syk-99 commented Oct 29, 2024

Todays Update of "Prebuilt Security Detection Rules" to Version 8.15.8 completed showing this mixed Error/Success-Message (Screenshot):
Image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. triage_needed
Projects
None yet
Development

No branches or pull requests

4 participants