Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Not able to create an EQL rule due to validation error #125059

Closed
MadameSheema opened this issue Feb 9, 2022 · 2 comments
Closed

[Security Solution] Not able to create an EQL rule due to validation error #125059

MadameSheema opened this issue Feb 9, 2022 · 2 comments
Assignees
@banderror
Labels
bug Fixes for quality problems that affect the customer experience fixed impact:critical This issue should be addressed immediately due to a critical level of impact on the product. Team:Detection Rule Management Security Detection Rule Management Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v7.17.1

Comments

@MadameSheema
Copy link
Member

Describe the bug:

  • Not able to create an EQL rule due to validation error

Kibana/Elasticsearch Stack version:

  • 7.17 latest branch (45be560)
  • 7.17.1 latest snapshot

Steps to reproduce:

  1. Navigate to the rules page
  2. Click on create new rule
  3. Select Event Correlation type
  4. Enter a valid EQL query

Current behavior:

  • A validation error is returned
  • You cannot proceed with the rule creation
  • The rule cannot be created

Screenshot 2022-02-09 at 12 19 39

Screenshot 2022-02-09 at 12 19 55

Expected behavior:

  • No validation error is displayed
  • The rule can be correctly created

Additional information:

  • The displayed error:
{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"request [/apm-*-transaction*,traces-apm*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*/_eql/search] contains unrecognized parameter: [enable_fields_emulation]"}],"type":"illegal_argument_exception","reason":"request [/apm-*-transaction*,traces-apm*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*/_eql/search] contains unrecognized parameter: [enable_fields_emulation]"},"status":400}

{
  "name": "Error",
  "message": "{\"error\":{\"root_cause\":[{\"type\":\"illegal_argument_exception\",\"reason\":\"request [/apm-*-transaction*,traces-apm*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*/_eql/search] contains unrecognized parameter: [enable_fields_emulation]\"}],\"type\":\"illegal_argument_exception\",\"reason\":\"request [/apm-*-transaction*,traces-apm*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*/_eql/search] contains unrecognized parameter: [enable_fields_emulation]\"},\"status\":400}",
  "stack": "Error: {\"error\":{\"root_cause\":[{\"type\":\"illegal_argument_exception\",\"reason\":\"request [/apm-*-transaction*,traces-apm*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*/_eql/search] contains unrecognized parameter: [enable_fields_emulation]\"}],\"type\":\"illegal_argument_exception\",\"reason\":\"request [/apm-*-transaction*,traces-apm*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*/_eql/search] contains unrecognized parameter: [enable_fields_emulation]\"},\"status\":400}\n    at u (https://upgrades.kb.us-central1.gcp.qa.cld.elstc.co:9243/46574/bundles/plugin/securitySolution/8.0.0/securitySolution.chunk.12.js:3:16800)\n    at async f (https://upgrades.kb.us-central1.gcp.qa.cld.elstc.co:9243/46574/bundles/plugin/securitySolution/8.0.0/securitySolution.chunk.12.js:3:17361)"
}

  • After the upgrade of a 7.17 EQL rule to 7.17.1 version, the rule still works and generate alerts

  • After the upgrade of a 7.17 EQL rule to 7.17.1 version, the same error validation error is displayed when trying to edit the rule. So the rule cannot be edited.
@MadameSheema MadameSheema added bug Fixes for quality problems that affect the customer experience triage_needed impact:critical This issue should be addressed immediately due to a critical level of impact on the product. Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team labels Feb 9, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@banderror banderror self-assigned this Feb 9, 2022
@banderror banderror mentioned this issue Feb 9, 2022
Merged
@MadameSheema MadameSheema mentioned this issue Feb 10, 2022
Merged
banderror added a commit that referenced this issue Feb 10, 2022
@banderror
Fix EQL search strategy: omit enable_fields_emulation (#125076)
cba1466 
**Fixes:** #125059

## Summary

Fixes a bug in the EQL search strategy presumably introduced in #123267.

## Screenshots

**Before** (request to EQL search strategy is failing, and the rule creation form can't perform validation)

![](https://puu.sh/II2fT/0ffde0f0d6.png)

**After** (request to EQL search strategy is returning results, and the rule creation form can properly validate the query)

![](https://puu.sh/II2gJ/060ff92e77.png)

![](https://puu.sh/II2ex/d7fbb31517.png)

![](https://puu.sh/II2f2/09cc4483a3.png)

## Notes on testing

Create a test index and write a few documents to it:

```
PUT /test-eql
{
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "process": {
        "type": "object",
        "properties": {
          "name": {
            "type": "keyword"
          }
        }
      }
    }
  }  
}

POST /test-eql/_doc
{
  "@timestamp": "2022-02-05T10:00:08Z",
  "process": {
    "name": "mdworker"
  }
}
```
@MadameSheema
Copy link
Member Author

This is working fine now on 7.17 latest branch (0ba6347). Thanks @banderror!!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@banderror banderror

Labels
bug Fixes for quality problems that affect the customer experience fixed impact:critical This issue should be addressed immediately due to a critical level of impact on the product. Team:Detection Rule Management Security Detection Rule Management Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v7.17.1
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@banderror @elasticmachine @MadameSheema