[Security Solution] Detection Rules fail to install/update with basic license #197246
Labels
bug
Fixes for quality problems that affect the customer experience
Team:Detection Rule Management
Security Detection Rule Management Team
Team:Detections and Resp
Security Detection Response Team
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
triage_needed
Describe the bug:
Some rules (probably machine learning rules) fail to install/update when basic license is in use.
Kibana/Elasticsearch Stack version:
8.15.3
Server OS version:
Debian and Ubuntu
Original install method (e.g. download page, yum, from source, etc.):
Debian Package from artifacts.elastic.co
Functional Area (e.g. Endpoint management, timelines, resolver, etc.):
Detection Rules
Steps to reproduce:
Current behavior:
Some/all ML-rules fail to install - showing a green success-message in the bottom right of the screen "X rules failed to install" without any hint of the cause.
Numbers for installable rules (upgradable rules) increase over time.
Some ML-rules can be enabled even with a basic license in use.
Expected behavior:
All rules should be installable/upgradable regardless of applied license.
Errors in browser console:
Request to
[...]internal/detection_engine/prebuilt_rules/install/_perform
is answered with
"message": "Your license does not support machine learning. Please upgrade your license."
(same behaviour for certain conditions when requesting
[...]internal/detection_engine/prebuilt_rules/update/_perform
Any additional context (logs, chat logs, magical formulas, etc.):
Similar reports of this bug:
#190753
https://discuss.elastic.co/t/detection-rules-update-failure/369051
Screenshot of ML-rules that can be enabled even with a basic license:
The text was updated successfully, but these errors were encountered: