Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Threshold Rules' Timeline Templates are not respected during investigation #136449

Closed
rylnd opened this issue Jul 14, 2022 · 4 comments · Fixed by #137233
Closed
Assignees
Labels
bug Fixes for quality problems that affect the customer experience Feature:Threshold Rule Security Solution Threshold rule type Feature:Timeline Security Solution Timeline feature fixed QA:Validated Issue has been validated by QA Team:Detection Alerts Security Detection Alerts Area Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.4.0

Comments

@rylnd
Copy link
Contributor

rylnd commented Jul 14, 2022

Describe the bug:
If a user applies a timeline template to a Threshold rule, its settings will not be applied when those rule's alerts are investigated in Timeline.

Kibana/Elasticsearch Stack version:
8.3.0; likely earlier

Steps to reproduce:

  1. Create a custom timeline template with custom columns
  2. Apply the timeline template to a threshold rule
  3. Click "Investigate in timeline" on a generated threshold alert

Current behavior:
The columns and other timeline template configuration are not applied to the threshold alert timeline

Expected behavior:
Timeline templates are supported (as much as possible) along with the special threshold timeline rendering

@rylnd rylnd added bug Fixes for quality problems that affect the customer experience triage_needed Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Feature:Timeline Security Solution Timeline feature Feature:Threshold Rule Security Solution Threshold rule type Team:Detection Alerts Security Detection Alerts Area Team labels Jul 14, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@rylnd
Copy link
Contributor Author

rylnd commented Jul 14, 2022

@madirey are there any Timeline behaviors specific to Threshold alerts that would conflict with timeline template configuration? I think that's the only potential wrinkle here.

@rylnd
Copy link
Contributor Author

rylnd commented Jul 21, 2022

Related: #129966

@ghost
Copy link

ghost commented Jul 29, 2022

Hi Team,

We have validated this issue on 8.4.0 BC1 build and observed that issue is Fixed 🟢

  • Custom columns are displaying when click on "Investigate in timeline" on a generated threshold alert

Please find the below testing Details:

Build info

VERSION : 8.4.0 BC1
Build: 54999
COMMIT: 58f7eaf0f8dc3c43cbfcd393e587f155e97b3d0d

Screenshot/Screencast

threshold.mp4

Hence, We are marking as QA Validated!!

cc: @MadameSheema

Thanks!!

@ghost ghost added the QA:Validated Issue has been validated by QA label Jul 29, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Feature:Threshold Rule Security Solution Threshold rule type Feature:Timeline Security Solution Timeline feature fixed QA:Validated Issue has been validated by QA Team:Detection Alerts Security Detection Alerts Area Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.4.0
Projects
None yet
4 participants