Skip to content

Commit

Permalink
[Detection Engine] Prevent ML job status warning from being displayed…
Browse files Browse the repository at this point in the history
… for non-ML rule types (#189003)

Followup to #188267. A demo
instance with these changes can be found
[here](https://rylnd-pr-189003-fix-sticky-ml-warning.kbndev.co/app/security/rules/create).

When not all ML jobs are started, we display a message conveying that
the list of suppression fields might not be complete. In the case of a
non-ML rule, this warning isn't helpful and should be hidden. It also
only shows the warning if one more more ML jobs have been selected.
  • Loading branch information
rylnd authored Jul 25, 2024
1 parent 42c5d91 commit 7aec3f7
Showing 1 changed file with 4 additions and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -209,6 +209,9 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
mlSuppressionFields,
} = useMLRuleConfig({ machineLearningJobId });

const isMlSuppressionIncomplete =
isMlRule(ruleType) && machineLearningJobId?.length > 0 && !allJobsStarted;

const esqlQueryRef = useRef<DefineStepRule['queryBar'] | undefined>(undefined);

const isAlertSuppressionLicenseValid = license.isAtLeast(MINIMUM_LICENSE_FOR_SUPPRESSION);
Expand Down Expand Up @@ -1087,7 +1090,7 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
disabledText: suppressionGroupByDisabledText,
}}
/>
{!allJobsStarted && (
{isMlSuppressionIncomplete && (
<EuiText size="xs" color="warning">
{i18n.MACHINE_LEARNING_SUPPRESSION_INCOMPLETE_LABEL}
</EuiText>
Expand Down

0 comments on commit 7aec3f7

Please sign in to comment.