Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] First exception is not displayed on the rule details page #146962

Closed
MadameSheema opened this issue Dec 5, 2022 · 3 comments
Closed

[Security Solution] First exception is not displayed on the rule details page #146962

MadameSheema opened this issue Dec 5, 2022 · 3 comments
Assignees
@peluja1012 @dhurley14 @nkhristinin
Labels
bug Fixes for quality problems that affect the customer experience Feature:Rule Exceptions Security Solution Detection Rule Exceptions area fixed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. QA:Validated Issue has been validated by QA Team:Detections and Resp Security Detection Response Team Team:Security Solution Platform Security Solution Platform Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.

Comments

@MadameSheema
Copy link
Member

Describe the bug:

  • When a rule does not have an exception, does not matter how you create the exception for the rule, the first exception is not displayed on the rule details page.

Kibana/Elasticsearch Stack version:

Initial setup:

  • To have a rule created without any exception

Steps to reproduce:

  1. Add an exception to the rule
  2. Navigate to the rule details
  3. Click on Rule exceptions tab

Current behavior:

  • The exception is not displayed

Expected behavior:

  • The exception should be displayed

Additional information:

  • This behaviour is present when you add the exception from the rule details page, from the alerts and from the exception list
  • Looks like when you perform a hard-refresh on the browser, the exception is displayed on the rule details page
@MadameSheema MadameSheema added bug Fixes for quality problems that affect the customer experience triage_needed Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Security Solution Platform Security Solution Platform Team labels Dec 5, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@nkhristinin nkhristinin mentioned this issue Dec 5, 2022
Merged
@peluja1012 peluja1012 added impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Feature:Rule Exceptions Security Solution Detection Rule Exceptions area and removed triage_needed labels Dec 5, 2022
nkhristinin added a commit that referenced this issue Dec 6, 2022
@nkhristinin @kibanamachine
Invalidate cache for rules, after add shared exception (#146979)
ab89936 
## Invalidate cache for rules, after adding shared exception

Related:
#146962

Co-authored-by: Kibana Machine <[email protected]>
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Dec 6, 2022
@nkhristinin
Invalidate cache for rules, after add shared exception (elastic#146979)
7a4a5c3 
## Invalidate cache for rules, after adding shared exception

Related:
elastic#146962

Co-authored-by: Kibana Machine <[email protected]>
(cherry picked from commit ab89936)
kibanamachine added a commit that referenced this issue Dec 6, 2022
@kibanamachine @nkhristinin
[8.6] Invalidate cache for rules, after add shared exception (#146979) (
33c8b50 
#147074)

# Backport

This will backport the following commits from `main` to `8.6`:
- [Invalidate cache for rules, after add shared exception
(#146979)](#146979)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Khristinin
Nikita","email":"[email protected]"},"sourceCommit":{"committedDate":"2022-12-06T09:37:46Z","message":"Invalidate
cache for rules, after add shared exception (#146979)\n\n## Invalidate
cache for rules, after adding shared
exception\r\n\r\nRelated:\r\nhttps://github.com//issues/146962\r\n\r\nCo-authored-by:
Kibana Machine
<[email protected]>","sha":"ab8993679fbd199dfaf80c2ea96d480ba306a82a","branchLabelMapping":{"^v8.7.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport:prev-minor","ci:cloud-deploy","v8.7.0"],"number":146979,"url":"https://github.com/elastic/kibana/pull/146979","mergeCommit":{"message":"Invalidate
cache for rules, after add shared exception (#146979)\n\n## Invalidate
cache for rules, after adding shared
exception\r\n\r\nRelated:\r\nhttps://github.com//issues/146962\r\n\r\nCo-authored-by:
Kibana Machine
<[email protected]>","sha":"ab8993679fbd199dfaf80c2ea96d480ba306a82a"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v8.7.0","labelRegex":"^v8.7.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/146979","number":146979,"mergeCommit":{"message":"Invalidate
cache for rules, after add shared exception (#146979)\n\n## Invalidate
cache for rules, after adding shared
exception\r\n\r\nRelated:\r\nhttps://github.com//issues/146962\r\n\r\nCo-authored-by:
Kibana Machine
<[email protected]>","sha":"ab8993679fbd199dfaf80c2ea96d480ba306a82a"}}]}]
BACKPORT-->

Co-authored-by: Khristinin Nikita <[email protected]>
@sukhwindersingh-qasource
Copy link

Hi @MadameSheema

We have validated this issue on 8.6.0 BC6 build and observed that issue is Fixed. ✔️

Please find the below Testing Details:

Build info

VERSION: 8.6.0
BUILD: 58740
COMMIT: f329a77595950244361736dff7208a810299fd69

Screen recoding

Rules.-.Kibana.Mozilla.Firefox.2022-12-08.13-54-54.mp4

Hence, We are marking this issue as QA Validated!!

Thanks!!

@sukhwindersingh-qasource sukhwindersingh-qasource added the QA:Validated Issue has been validated by QA label Dec 8, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@peluja1012 peluja1012

@dhurley14 dhurley14

@nkhristinin nkhristinin

Labels
bug Fixes for quality problems that affect the customer experience Feature:Rule Exceptions Security Solution Detection Rule Exceptions area fixed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. QA:Validated Issue has been validated by QA Team:Detections and Resp Security Detection Response Team Team:Security Solution Platform Security Solution Platform Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@peluja1012 @dhurley14 @nkhristinin @elasticmachine @MadameSheema @sukhwindersingh-qasource