Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Error occurs on rule execution after adding the suppression alert fields in endpoint security [Duplicate] rule #146494

Closed
ghost opened this issue Nov 29, 2022 · 10 comments
Closed

[Security Solution] Error occurs on rule execution after adding the suppression alert fields in endpoint security [Duplicate] rule #146494

ghost opened this issue Nov 29, 2022 · 10 comments
Assignees
@marshallmain
Labels
bug Fixes for quality problems that affect the customer experience fixed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. QA:Validated Issue has been validated by QA Team:Detection Alerts Security Detection Alerts Area Team Team:Detection Rule Management Security Detection Rule Management Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.6.0

Comments

@ghost
Copy link

ghost commented Nov 29, 2022 •
edited by ghost
Loading

Describe the bug
Error occurs on rule execution after adding the suppression alert fields in endpoint security [Duplicate] rule

Build info

Version: 8.6.0 BC3
BUILD: 58560
COMMIT: d4567dc2eaa4f59503c1822e1f10bf0292b97066

Preconditions

  • Kibana should be running

Steps to Reproduce

  • Navigate to Security > Rules Page
  • Duplicate the endpoint Security rule
  • Add the Suppression alert field
  • Now execute the rule
  • Observe that error occur on rule execution

Actual Result

  • Error occurs on rule execution after adding the suppression alert fields in endpoint security [Duplicate] rule

Expected Result

  • Rule should be execute successfully after added the suppression alert fields in endpoint security [Duplicate] rule

Screen-shot

image

Rule

endpoint Security.zip
@ghost ghost added bug Fixes for quality problems that affect the customer experience triage_needed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.6.0 labels Nov 29, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@ghost
Copy link
Author

ghost commented Nov 29, 2022

@karanbirsingh-qasource Please review!!

@MadameSheema
Copy link
Member

@deepikakeshav-qasource may you please check if the above error persists when:

  1. You modify the additional look-back time with a smaller value i.e. 5 minutes
  2. You modify the Runs every with a bigger value i.e. 5 minutes

Remember to enable and disable the rule after modifying the values to force it to re-execute.

Thanks!

@MadameSheema MadameSheema added Team:Detection Rule Management Security Detection Rule Management Team Team:Detection Alerts Security Detection Alerts Area Team labels Nov 29, 2022
@ghost
Copy link
Author

ghost commented Nov 29, 2022 •
edited by ghost
Loading

Hi @MadameSheema ,

The issue is still persisting when modify the additional look-back and Runs every time.

Screencast:

endpoint.mp4
endpoint2.mp4

Please let us know if anything else is required from our end!!

Thanks!!

@marshallmain marshallmain mentioned this issue Nov 29, 2022
Merged
marshallmain added a commit that referenced this issue Nov 30, 2022
@marshallmain
[Security Solution][Alerts] Don't use maxSignals for topHits agg size (…
d659ee6 
…#146564)

## Summary

Addresses #146494

We only need the first document from the bucket to create the alert, not
`maxSignals` documents. If `maxSignals` was greater than 100, this
caused an error in the search.
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Nov 30, 2022
@marshallmain
[Security Solution][Alerts] Don't use maxSignals for topHits agg size (…
e0413b4 
…elastic#146564)

## Summary

Addresses elastic#146494

We only need the first document from the bucket to create the alert, not
`maxSignals` documents. If `maxSignals` was greater than 100, this
caused an error in the search.

(cherry picked from commit d659ee6)
kibanamachine referenced this issue Nov 30, 2022
@kibanamachine @marshallmain
[8.6] [Security Solution][Alerts] Don't use maxSignals for topHits ag…
7747da8 
…g size (#146564) (#146712)

# Backport

This will backport the following commits from `main` to `8.6`:
- [[Security Solution][Alerts] Don't use maxSignals for topHits agg size
(#146564)](#146564)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Marshall
Main","email":"[email protected]"},"sourceCommit":{"committedDate":"2022-11-30T15:50:16Z","message":"[Security
Solution][Alerts] Don't use maxSignals for topHits agg size
(#146564)\n\n## Summary\r\n\r\nAddresses
https://github.com/elastic/kibana/issues/146494\r\n\r\nWe only need the
first document from the bucket to create the alert, not\r\n`maxSignals`
documents. If `maxSignals` was greater than 100, this\r\ncaused an error
in the
search.","sha":"d659ee6f2eb04e81b240db137996aa2a4c4378b1","branchLabelMapping":{"^v8.7.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:
SecuritySolution","Team:Detection
Alerts","v8.6.0","v8.7.0"],"number":146564,"url":"https://github.com/elastic/kibana/pull/146564","mergeCommit":{"message":"[Security
Solution][Alerts] Don't use maxSignals for topHits agg size
(#146564)\n\n## Summary\r\n\r\nAddresses
https://github.com/elastic/kibana/issues/146494\r\n\r\nWe only need the
first document from the bucket to create the alert, not\r\n`maxSignals`
documents. If `maxSignals` was greater than 100, this\r\ncaused an error
in the
search.","sha":"d659ee6f2eb04e81b240db137996aa2a4c4378b1"}},"sourceBranch":"main","suggestedTargetBranches":["8.6"],"targetPullRequestStates":[{"branch":"8.6","label":"v8.6.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.7.0","labelRegex":"^v8.7.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/146564","number":146564,"mergeCommit":{"message":"[Security
Solution][Alerts] Don't use maxSignals for topHits agg size
(#146564)\n\n## Summary\r\n\r\nAddresses
https://github.com/elastic/kibana/issues/146494\r\n\r\nWe only need the
first document from the bucket to create the alert, not\r\n`maxSignals`
documents. If `maxSignals` was greater than 100, this\r\ncaused an error
in the search.","sha":"d659ee6f2eb04e81b240db137996aa2a4c4378b1"}}]}]
BACKPORT-->

Co-authored-by: Marshall Main <[email protected]>
@marshallmain
Copy link
Contributor

This should be fixed by #146564 on the latest 8.6 branch, can you re-test there?

@MadameSheema
Copy link
Member

@deepikakeshav-qasource can you please validate this on latest 8.6.0 branch? Thanks :)

Please keep the ticket open until is validated on next BC.

@ghost
Copy link

ghost commented Dec 2, 2022

Hi @MadameSheema

we have validated this issue on latest 8.6.0 branch and below are the observations , duplicate endpoint security rule is failing however rule failure reason is different also alerts are generating by this rule in failure rule state.

Failure Reason: Reason: decrypt Message: Unable to decrypt attribute "apikey"

KaranV_Linux.Master.VM2.-.VMware.Remote.Console.2022-12-02.17-38-45.mp4
KaranV_Linux.Master.VM2.-.VMware.Remote.Console.2022-12-02.17-40-08.mp4

@MadameSheema
Copy link
Member

@marshallmain may you please take a look at the above? Thanks!

@marshallmain
Copy link
Contributor

I'm not seeing this new error when I test locally, the endpoint security [Duplicate] rule is able to generate suppressed alerts. Usually the Unable to decrypt attribute "apiKey" error happens due to problems in the alerting framework rather than the security solution. Can you verify if this error happens consistently and, if it does, what other steps are needed to cause this error?

@ghost
Copy link
Author

ghost commented Dec 5, 2022

Hi @marshallmain ,

We have validated this issue on 8.6.0 BC5 build and Observe that issue is Fixed. We did not got any error on 8.6.0 BC5 build

Please find the below details:

Version: 8.6.0 BC5
BUILD: 58693
COMMIT: ed40c16ce9999cc47ad55c11bb097d2e443b31a6

Screencast:

Suppression.Alerts.mp4

Hence, We are closing this issue and marking as QA Validated!!

Thanks!!

@ghost ghost added the QA:Validated Issue has been validated by QA label Dec 5, 2022
@ghost ghost closed this as completed Dec 5, 2022
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@marshallmain marshallmain

Labels
bug Fixes for quality problems that affect the customer experience fixed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. QA:Validated Issue has been validated by QA Team:Detection Alerts Security Detection Alerts Area Team Team:Detection Rule Management Security Detection Rule Management Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.6.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@elasticmachine @MadameSheema @marshallmain