-
Notifications
You must be signed in to change notification settings - Fork 8.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Security Solution] Error is displayed after importing rules with Elastic-cloud-SMTP connector #157253
Comments
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
Pinging @elastic/security-solution (Team: SecuritySolution) |
The error message is displayed only when checking the 3 options when importing, it does not happen when user just checks, the first one or the first and the second REC-20230510132024.mp4 |
…nectors (#176284) **Fixes:** #157253 ## Summary This PR fixes rules import with `overwrite_action_connectors` set to true when ndjson contains rules with actions referencing preconfigured action connectors. ## Details A user can preconfigure action connectors as described [here](https://www.elastic.co/guide/en/kibana/current/pre-configured-connectors.html). At the same time Elastic Could instances have Elastic-cloud-SMTP connector preconfigured. In particular import doesn't work as expected in Elastic Cloud for rules having actions referencing the preconfigured Elastic-cloud-SMTP connector. This is fixed by filtering out preconfigured connector ids so importing logic only handles custom action connectors. On top of this functional tests have been added to make sure the problem won't come back. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] [Ran](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5139) in Flaky test runner for ESS and Serverless and no flakiness has been revealed
…nectors (elastic#176284) **Fixes:** elastic#157253 ## Summary This PR fixes rules import with `overwrite_action_connectors` set to true when ndjson contains rules with actions referencing preconfigured action connectors. ## Details A user can preconfigure action connectors as described [here](https://www.elastic.co/guide/en/kibana/current/pre-configured-connectors.html). At the same time Elastic Could instances have Elastic-cloud-SMTP connector preconfigured. In particular import doesn't work as expected in Elastic Cloud for rules having actions referencing the preconfigured Elastic-cloud-SMTP connector. This is fixed by filtering out preconfigured connector ids so importing logic only handles custom action connectors. On top of this functional tests have been added to make sure the problem won't come back. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] [Ran](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5139) in Flaky test runner for ESS and Serverless and no flakiness has been revealed (cherry picked from commit 934a06c) # Conflicts: # x-pack/test/detection_engine_api_integration/security_and_spaces/group10/import_connectors.ts # x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/alerts/migrations/index.ts
…red connectors (#176284) (#176887) # Backport This will backport the following commits from `main` to `8.12`: - [[Security Solution] Fix importing rules referencing preconfigured connectors (#176284)](#176284) <!--- Backport version: 8.9.8 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Maxim Palenov","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-02-13T15:30:25Z","message":"[Security Solution] Fix importing rules referencing preconfigured connectors (#176284)\n\n**Fixes:** https://github.com/elastic/kibana/issues/157253\r\n\r\n## Summary\r\n\r\nThis PR fixes rules import with `overwrite_action_connectors` set to true when ndjson contains rules with actions referencing preconfigured action connectors.\r\n\r\n## Details\r\n\r\nA user can preconfigure action connectors as described [here](https://www.elastic.co/guide/en/kibana/current/pre-configured-connectors.html). At the same time Elastic Could instances have Elastic-cloud-SMTP connector preconfigured. In particular import doesn't work as expected in Elastic Cloud for rules having actions referencing the preconfigured Elastic-cloud-SMTP connector.\r\n\r\nThis is fixed by filtering out preconfigured connector ids so importing logic only handles custom action connectors.\r\n\r\nOn top of this functional tests have been added to make sure the problem won't come back.\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios\r\n- [x] [Ran](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5139) in Flaky test runner for ESS and Serverless and no flakiness has been revealed","sha":"934a06ccf7c599685e04469ff0801e461ee9c2d5","branchLabelMapping":{"^v8.13.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","impact:medium","Team:Detections and Resp","Team: SecuritySolution","Feature:Rule Actions","Team:Detection Rule Management","Feature:Rule Import/Export","v8.13.0","v8.12.2"],"number":176284,"url":"https://github.com/elastic/kibana/pull/176284","mergeCommit":{"message":"[Security Solution] Fix importing rules referencing preconfigured connectors (#176284)\n\n**Fixes:** https://github.com/elastic/kibana/issues/157253\r\n\r\n## Summary\r\n\r\nThis PR fixes rules import with `overwrite_action_connectors` set to true when ndjson contains rules with actions referencing preconfigured action connectors.\r\n\r\n## Details\r\n\r\nA user can preconfigure action connectors as described [here](https://www.elastic.co/guide/en/kibana/current/pre-configured-connectors.html). At the same time Elastic Could instances have Elastic-cloud-SMTP connector preconfigured. In particular import doesn't work as expected in Elastic Cloud for rules having actions referencing the preconfigured Elastic-cloud-SMTP connector.\r\n\r\nThis is fixed by filtering out preconfigured connector ids so importing logic only handles custom action connectors.\r\n\r\nOn top of this functional tests have been added to make sure the problem won't come back.\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios\r\n- [x] [Ran](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5139) in Flaky test runner for ESS and Serverless and no flakiness has been revealed","sha":"934a06ccf7c599685e04469ff0801e461ee9c2d5"}},"sourceBranch":"main","suggestedTargetBranches":["8.12"],"targetPullRequestStates":[{"branch":"main","label":"v8.13.0","labelRegex":"^v8.13.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/176284","number":176284,"mergeCommit":{"message":"[Security Solution] Fix importing rules referencing preconfigured connectors (#176284)\n\n**Fixes:** https://github.com/elastic/kibana/issues/157253\r\n\r\n## Summary\r\n\r\nThis PR fixes rules import with `overwrite_action_connectors` set to true when ndjson contains rules with actions referencing preconfigured action connectors.\r\n\r\n## Details\r\n\r\nA user can preconfigure action connectors as described [here](https://www.elastic.co/guide/en/kibana/current/pre-configured-connectors.html). At the same time Elastic Could instances have Elastic-cloud-SMTP connector preconfigured. In particular import doesn't work as expected in Elastic Cloud for rules having actions referencing the preconfigured Elastic-cloud-SMTP connector.\r\n\r\nThis is fixed by filtering out preconfigured connector ids so importing logic only handles custom action connectors.\r\n\r\nOn top of this functional tests have been added to make sure the problem won't come back.\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios\r\n- [x] [Ran](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5139) in Flaky test runner for ESS and Serverless and no flakiness has been revealed","sha":"934a06ccf7c599685e04469ff0801e461ee9c2d5"}},{"branch":"8.12","label":"v8.12.2","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT-->
@vgomez-el Could you please validate the #176284? It has been backported to 8.12 and will be released in 8.12.2. |
…nectors (elastic#176284) **Fixes:** elastic#157253 ## Summary This PR fixes rules import with `overwrite_action_connectors` set to true when ndjson contains rules with actions referencing preconfigured action connectors. ## Details A user can preconfigure action connectors as described [here](https://www.elastic.co/guide/en/kibana/current/pre-configured-connectors.html). At the same time Elastic Could instances have Elastic-cloud-SMTP connector preconfigured. In particular import doesn't work as expected in Elastic Cloud for rules having actions referencing the preconfigured Elastic-cloud-SMTP connector. This is fixed by filtering out preconfigured connector ids so importing logic only handles custom action connectors. On top of this functional tests have been added to make sure the problem won't come back. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] [Ran](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5139) in Flaky test runner for ESS and Serverless and no flakiness has been revealed
Bug is fixed and validated for 8.13 BC1: REC-20240221112717.mp4thanks @maximpn and @banderror for your fix! |
…nectors (elastic#176284) **Fixes:** elastic#157253 ## Summary This PR fixes rules import with `overwrite_action_connectors` set to true when ndjson contains rules with actions referencing preconfigured action connectors. ## Details A user can preconfigure action connectors as described [here](https://www.elastic.co/guide/en/kibana/current/pre-configured-connectors.html). At the same time Elastic Could instances have Elastic-cloud-SMTP connector preconfigured. In particular import doesn't work as expected in Elastic Cloud for rules having actions referencing the preconfigured Elastic-cloud-SMTP connector. This is fixed by filtering out preconfigured connector ids so importing logic only handles custom action connectors. On top of this functional tests have been added to make sure the problem won't come back. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] [Ran](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5139) in Flaky test runner for ESS and Serverless and no flakiness has been revealed
Describe the bug:
Kibana/Elasticsearch Stack version:
Original install method (e.g. download page, yum, from source, etc.):
Functional Area (e.g. Endpoint management, timelines, resolver, etc.):
Detection Rules
Initial setup
Steps to reproduce:
Steps to reproduce locally (dev environment):
kibana.dev.yml
/kibana.yml
as described here.Current behavior:
Expected behavior:
-File should be imported successfully and connectors should be overwritten if necessary
Screen recording
REC-20230510131242.mp4
Errors in browser console (if relevant):
Provide logs and/or server output (if relevant):
Any additional context (logs, chat logs, magical formulas, etc.):
Error message displayed:
The text was updated successfully, but these errors were encountered: