Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Field aliases intended for .siem-signals are applied to RAC indices as well #112600

Closed
marshallmain opened this issue Sep 20, 2021 · 2 comments · Fixed by #115290
Closed

[Security Solution] Field aliases intended for .siem-signals are applied to RAC indices as well #112600

marshallmain opened this issue Sep 20, 2021 · 2 comments · Fixed by #115290
Assignees
@marshallmain
Labels
Team:Detection Alerts Security Detection Alerts Area Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v7.16.0

Comments

@marshallmain
Copy link
Contributor

#106049 added logic to createIndexRoute that adds field aliases to .siem-signals indices when a user visits the Detections page. However, it uses the .siem-signals alias to find existing indices. Since we add .siem-signals-<space id> as an alias to the new RAC indices for backwards compatibility reasons, the new RAC indices are found by createIndexRoute when we query for existing indices by the index alias. The field aliases intended for legacy .siem-signals indices are incompatible with the new RAC indices so we need to update the logic in createIndexRoute so the field aliases are only applied to the correct indices.
@marshallmain marshallmain added Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v7.16.0 Team:Detection Alerts Security Detection Alerts Area Team labels Sep 20, 2021
@marshallmain marshallmain self-assigned this Sep 20, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@marshallmain marshallmain mentioned this issue Oct 18, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@marshallmain marshallmain

Labels
Team:Detection Alerts Security Detection Alerts Area Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v7.16.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Security Solution] Only apply field aliases to legacy .siem-signals indices marshallmain/kibana
2 participants
@elasticmachine @marshallmain