Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Warning flashes when editing rule index patterns #203600

Open
Tracked by #201502
jkelas opened this issue Dec 10, 2024 · 4 comments
Open
Tracked by #201502

[Security Solution] Warning flashes when editing rule index patterns #203600

jkelas opened this issue Dec 10, 2024 · 4 comments
Assignees
@jkelas
Labels
8.18 candidate bug Fixes for quality problems that affect the customer experience Feature:Rule Edit Security Solution Detection Rule Editing workflow impact:low Addressing this issue will have a low level of impact on the quality/strength of our product. Team:Detection Engine Security Solution Detection Engine Area Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.

Comments

@jkelas
Copy link
Contributor

jkelas commented Dec 10, 2024 •
edited by banderror
Loading

Follow-up to: #178908

Summary

When editing a rule which has a filter with AND or OR condition, and modifying the "Index patterns", the filter displayed in "Custom query" field flashes a Warning message for a fraction of a second. Please see the recordings.

Steps to reproduce

  1. Launch a clean Kibana + ES environment.
  2. Create some valid indices with source events. Locally, one easy way to do this would be using the resolver_generator script that generates fake endpoint events (events generated by Endpoint Security aka Elastic Defend): node x-pack/plugins/security_solution/scripts/endpoint/resolver_generator.js --node http://elastic:[email protected]:9200 --kibana http://elastic:[email protected]:5601/kbn --numHosts=5 --numDocs=2.
  3. Create a new custom rule. Enter "logs*" and "abc*" as indices.
  4. Enter * as the rule's query.
  5. Add a rule filter, for example host.name: Host-avy6d0956e AND host.os.family: windows (use any values from your source data).
    Notice that the filter is displayed without any warnings, and the field values in the filter are clearly visible.
  6. Save the rule.
  7. Click "Edit rule settings" button.
  8. In the "Index patterns" field remove the "abc*" pattern or add any other pattern, e.g. "bcd*".
  9. Click anywhere else on the page to change the focus. Notice the flash of a Warning message for a fraction of a second in the "Custom query" field.

Expected behavior:

There should be no Warning flashing in the "Custom query" field.

Recordings

394328583-c6b76b3a-29a3-403d-a549-d994a3d1dc24.mov
394328628-17bb2d96-990c-4d11-b690-e134a261b0ff.mov
@jkelas jkelas added 8.18 candidate bug Fixes for quality problems that affect the customer experience Feature:Rule Details Security Solution Detection Rule Details page impact:low Addressing this issue will have a low level of impact on the quality/strength of our product. Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team triage_needed labels Dec 10, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@jkelas jkelas mentioned this issue Dec 10, 2024
Merged
2 tasks
jkelas added a commit that referenced this issue Dec 18, 2024
@jkelas @nikitaindik
[Security Solution] Remove warning for rule filter (#201776)
2e3a748 
**Resolves: #178908**

## Summary

This PR fixes a warning displayed for the rule when certain filter is
present.
I followed the suggestion from @nikitaindik in the original ticket and
pulled his fix and tested that it works, but it also needed some
modification borrowed from QueryBar component, namely to update the
filters before displaying the FilterItems component.

Note: This PR only covers the Rule Creation / Rules Details page. Two
new tickets have been created to cover issues found in other places:
#203600 and #203615

# BEFORE
<img width="899" alt="image"
src="https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0">

# AFTER
<img width="901" alt="image"
src="https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907">


### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: Nikita Indik <[email protected]>
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Dec 18, 2024
@jkelas
[Security Solution] Remove warning for rule filter (elastic#201776)
1d9c23f 
**Resolves: elastic#178908**

## Summary

This PR fixes a warning displayed for the rule when certain filter is
present.
I followed the suggestion from @nikitaindik in the original ticket and
pulled his fix and tested that it works, but it also needed some
modification borrowed from QueryBar component, namely to update the
filters before displaying the FilterItems component.

Note: This PR only covers the Rule Creation / Rules Details page. Two
new tickets have been created to cover issues found in other places:
elastic#203600 and elastic#203615

# BEFORE
<img width="899" alt="image"
src="https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0">

# AFTER
<img width="901" alt="image"
src="https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907">

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: Nikita Indik <[email protected]>
(cherry picked from commit 2e3a748)
jkelas added a commit to jkelas/kibana that referenced this issue Dec 18, 2024
@jkelas
[Security Solution] Remove warning for rule filter (elastic#201776)
d5a28b1 
**Resolves: elastic#178908**

## Summary

This PR fixes a warning displayed for the rule when certain filter is
present.
I followed the suggestion from @nikitaindik in the original ticket and
pulled his fix and tested that it works, but it also needed some
modification borrowed from QueryBar component, namely to update the
filters before displaying the FilterItems component.

Note: This PR only covers the Rule Creation / Rules Details page. Two
new tickets have been created to cover issues found in other places:
elastic#203600 and elastic#203615

# BEFORE
<img width="899" alt="image"
src="https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0">

# AFTER
<img width="901" alt="image"
src="https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907">

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: Nikita Indik <[email protected]>
(cherry picked from commit 2e3a748)

# Conflicts:
#	x-pack/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/rule_definition_section.tsx
#	x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/three_way_diff/final_edit/fields/hooks/use_data_view.ts
JoseLuisGJ pushed a commit to JoseLuisGJ/kibana that referenced this issue Dec 19, 2024
@jkelas @nikitaindik @JoseLuisGJ
[Security Solution] Remove warning for rule filter (elastic#201776)
0f77bfe 
**Resolves: elastic#178908**

## Summary

This PR fixes a warning displayed for the rule when certain filter is
present.
I followed the suggestion from @nikitaindik in the original ticket and
pulled his fix and tested that it works, but it also needed some
modification borrowed from QueryBar component, namely to update the
filters before displaying the FilterItems component.

Note: This PR only covers the Rule Creation / Rules Details page. Two
new tickets have been created to cover issues found in other places:
elastic#203600 and elastic#203615

# BEFORE
<img width="899" alt="image"
src="https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0">

# AFTER
<img width="901" alt="image"
src="https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907">


### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: Nikita Indik <[email protected]>
@banderror banderror added Feature:Rule Edit Security Solution Detection Rule Editing workflow Team:Detection Engine Security Solution Detection Engine Area and removed triage_needed Feature:Rule Details Security Solution Detection Rule Details page labels Dec 20, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-engine (Team:Detection Engine)

@banderror banderror removed their assignment Dec 20, 2024
@banderror banderror mentioned this issue Dec 20, 2024
Open
benakansara pushed a commit to benakansara/kibana that referenced this issue Jan 2, 2025
@jkelas @nikitaindik @benakansara
[Security Solution] Remove warning for rule filter (elastic#201776)
8b32252 
**Resolves: elastic#178908**

## Summary

This PR fixes a warning displayed for the rule when certain filter is
present.
I followed the suggestion from @nikitaindik in the original ticket and
pulled his fix and tested that it works, but it also needed some
modification borrowed from QueryBar component, namely to update the
filters before displaying the FilterItems component.

Note: This PR only covers the Rule Creation / Rules Details page. Two
new tickets have been created to cover issues found in other places:
elastic#203600 and elastic#203615

# BEFORE
<img width="899" alt="image"
src="https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0">

# AFTER
<img width="901" alt="image"
src="https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907">


### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: Nikita Indik <[email protected]>
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this issue Jan 13, 2025
@jkelas @nikitaindik @CAWilson94
[Security Solution] Remove warning for rule filter (elastic#201776)
f307dc0 
**Resolves: elastic#178908**

## Summary

This PR fixes a warning displayed for the rule when certain filter is
present.
I followed the suggestion from @nikitaindik in the original ticket and
pulled his fix and tested that it works, but it also needed some
modification borrowed from QueryBar component, namely to update the
filters before displaying the FilterItems component.

Note: This PR only covers the Rule Creation / Rules Details page. Two
new tickets have been created to cover issues found in other places:
elastic#203600 and elastic#203615

# BEFORE
<img width="899" alt="image"
src="https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0">

# AFTER
<img width="901" alt="image"
src="https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907">


### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: Nikita Indik <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jkelas jkelas

Labels
8.18 candidate bug Fixes for quality problems that affect the customer experience Feature:Rule Edit Security Solution Detection Rule Editing workflow impact:low Addressing this issue will have a low level of impact on the quality/strength of our product. Team:Detection Engine Security Solution Detection Engine Area Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@banderror @elasticmachine @jkelas