Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[EDR] [BUG] The user is able to add OS Query in the rule actions even when OS Query integration is not added. #166040

Closed
muskangulati-qasource opened this issue Sep 8, 2023 · 13 comments
Closed

[EDR] [BUG] The user is able to add OS Query in the rule actions even when OS Query integration is not added. #166040

muskangulati-qasource opened this issue Sep 8, 2023 · 13 comments
Assignees
@szwarckonrad
Labels
bug Fixes for quality problems that affect the customer experience impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. OLM Sprint Osquery QA:Validated Issue has been validated by QA Team:Defend Workflows “EDR Workflows” sub-team of Security Solution Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.10.0 v8.10.1

Comments

@muskangulati-qasource
Copy link

muskangulati-qasource commented Sep 8, 2023 •
edited
Loading

Description:
The user is able to add OS Query in the rule actions even when OS Query integration is not added

Build Details:

VERSION: 8.10.0
BUILD: 66350
COMMIT: 824bcbfd9972c61e79ca9def6d43b550c5ff2999

Browser Details:
All

Preconditions:

  1. Kibana user should be logged in

Steps to Reproduce:

  1. Login to a fresh Kibana environment
  2. Navigate to the Rules tab under the Security section
  3. Go to 'Detection rules (SIEM)'
  4. Duplicate the original 'Endpoint Security' rule or create your own custom rule
  5. Go to actions section
  6. Under response action, add OS Query
  7. Observe the message is shown for no OS Query added

Actual Result:
The user is able to add OS Query and the alerts has an empty section for the response section under alert details flyout

Expected Result:
The expected result can be as follow:

  • Either the user should not be able to add the OS Query to the rule when it is not added to the policy
  • Or the flyout should show the message for empty response actions details

Screen Recordings:

EditRule.mp4
Alert.mp4

Logs
N/A
@muskangulati-qasource muskangulati-qasource added bug Fixes for quality problems that affect the customer experience triage_needed Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. labels Sep 8, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@muskangulati-qasource muskangulati-qasource added Team:Defend Workflows “EDR Workflows” sub-team of Security Solution Osquery v8.10.0 and removed triage_needed labels Sep 8, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

@muskangulati-qasource muskangulati-qasource added the impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. label Sep 8, 2023
@muskangulati-qasource
Copy link
Author

@karanbirsingh-qasource please review!!

@ghost ghost assigned kevinlog and unassigned ghost Sep 8, 2023
@kevinlog
Copy link
Contributor

kevinlog commented Sep 8, 2023 •
edited
Loading

It's strange that you can still add Osquery, but I think we show an informative message in the beginning. Ideally we don't allow the user to follow through and add it.

@muskangulati-qasource - when you see the empty responses tab, does this only happen when we add Osquery without the integration added? Or does it also happen on alerts which do not originate from Agents with Osquery?

We can take a closer look in 8.10.1

@tomsonpl
Copy link
Contributor

tomsonpl commented Sep 8, 2023

Hey, it's been like this since the beginning. However we used to hide the Response's Tab if there are no results before - we do not do that in the new Flyout if I am correct. I think we might add this check.

I think that having Osquery action (that is not triggered) is not a problem. What do you think?

@kevinlog
Copy link
Contributor

@tomsonpl

I think that having Osquery action (that is not triggered) is not a problem. What do you think?

I agree with this. I don't think we need to look too deeply into this as it doesn't pose a problem and we tell the user initially in the rule creation flow that they need to add Osquery integration
.

However we used to hide the Response's Tab if there are no results before - we do not do that in the new Flyout if I am correct. I think we might add this check.

Either remove the tab or add a message saying that there are no responses for this Alert. @paulewing - do you have any preference for this case?

@kevinlog kevinlog removed the grooming label Sep 14, 2023
@kevinlog kevinlog assigned szwarckonrad and unassigned kevinlog Sep 14, 2023
@szwarckonrad
Copy link
Contributor

As I'm ready to begin working on this issue, do you have any preferences regarding it, @paulewing? 😊
#166040 (comment)

@szwarckonrad szwarckonrad mentioned this issue Sep 21, 2023
Merged
@szwarckonrad
Copy link
Contributor

@kevinlog Here is a proposal for a quick win ;)
#166916

@kevinlog
Copy link
Contributor

thanks @szwarckonrad

I would say let's go with the solution in your PR to give a message in the tab as opposed to removing.

The Response tab is always there, here's what it looks like even if you have no response actions configured:

image

Given the above, it makes sense to always have the tab regardless of if we have results or not.

cc @paulewing

szwarckonrad added a commit that referenced this issue Sep 29, 2023
@szwarckonrad
[Osquery][Defend Workflows] No responses for alert on flyout (#166916)
c7bb851 
#166040

Inform user that there are no responses associated with and alert
instead of returning `null`.

![Screenshot 2023-09-21 at 11 55
08](https://github.com/elastic/kibana/assets/29123534/7758f354-45f5-4ac1-9ea4-b650aca0c082)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Sep 29, 2023
@szwarckonrad
[Osquery][Defend Workflows] No responses for alert on flyout (elastic…
db590d8 
…#166916)

elastic#166040

Inform user that there are no responses associated with and alert
instead of returning `null`.

![Screenshot 2023-09-21 at 11 55
08](https://github.com/elastic/kibana/assets/29123534/7758f354-45f5-4ac1-9ea4-b650aca0c082)

(cherry picked from commit c7bb851)
kibanamachine added a commit that referenced this issue Sep 29, 2023
@kibanamachine @szwarckonrad
[8.10] [Osquery][Defend Workflows] No responses for alert on flyout (#…
a0dc167 
…166916) (#167602)

# Backport

This will backport the following commits from `main` to `8.10`:
- [[Osquery][Defend Workflows] No responses for alert on flyout
(#166916)](#166916)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Konrad
Szwarc","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-09-29T08:17:30Z","message":"[Osquery][Defend
Workflows] No responses for alert on flyout
(#166916)\n\nhttps://github.com//issues/166040\r\n\r\nInform
user that there are no responses associated with and alert\r\ninstead of
returning `null`.\r\n\r\n![Screenshot 2023-09-21 at 11
55\r\n08](https://github.com/elastic/kibana/assets/29123534/7758f354-45f5-4ac1-9ea4-b650aca0c082)","sha":"c7bb851ded898f0a64f3ad9d0618c954e20a78de","branchLabelMapping":{"^v8.11.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Defend
Workflows","Osquery","v8.11.0","v8.10.3"],"number":166916,"url":"https://github.com/elastic/kibana/pull/166916","mergeCommit":{"message":"[Osquery][Defend
Workflows] No responses for alert on flyout
(#166916)\n\nhttps://github.com//issues/166040\r\n\r\nInform
user that there are no responses associated with and alert\r\ninstead of
returning `null`.\r\n\r\n![Screenshot 2023-09-21 at 11
55\r\n08](https://github.com/elastic/kibana/assets/29123534/7758f354-45f5-4ac1-9ea4-b650aca0c082)","sha":"c7bb851ded898f0a64f3ad9d0618c954e20a78de"}},"sourceBranch":"main","suggestedTargetBranches":["8.10"],"targetPullRequestStates":[{"branch":"main","label":"v8.11.0","labelRegex":"^v8.11.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/166916","number":166916,"mergeCommit":{"message":"[Osquery][Defend
Workflows] No responses for alert on flyout
(#166916)\n\nhttps://github.com//issues/166040\r\n\r\nInform
user that there are no responses associated with and alert\r\ninstead of
returning `null`.\r\n\r\n![Screenshot 2023-09-21 at 11
55\r\n08](https://github.com/elastic/kibana/assets/29123534/7758f354-45f5-4ac1-9ea4-b650aca0c082)","sha":"c7bb851ded898f0a64f3ad9d0618c954e20a78de"}},{"branch":"8.10","label":"v8.10.3","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Konrad Szwarc <[email protected]>
@szwarckonrad
Copy link
Contributor

Merged and backported to 8.10, will be available in 8.10.3

@szwarckonrad szwarckonrad added the QA:Ready for Testing Code is merged and ready for QA to validate label Sep 29, 2023
@muskangulati-qasource
Copy link
Author

Hi @szwarckonrad,

We have validated this issue on the 8.10.3 BC1 and found the issue is not fixed there.

Please find below the testing details:

Build Details

VERSION: 8.10.3
BUILD: 66480
COMMIT: 5aee3c4fba328838fcf0be6a3ff2248a4c0120dd

Screenshots
image

image

Thanks!

@szwarckonrad
Copy link
Contributor

szwarckonrad commented Oct 9, 2023 •
edited
Loading

Approach agreed upon was to inform user on Responses tab that there are no responses associated with given alert, as portrayed here. I believe this is behaving as expected. CC @kevinlog

@muskangulati-qasource
Copy link
Author

Hi @dasansol92,

We have validated the issue on the latest 8.13.0-SNAPSHOT build. Please find below the testing details:

Build Details

VERSION: 8.13.0
BUILD: 71308
COMMIT: 3ef1e76667a9473c1bf31b2cc7176c4f8311ea54

Observation & Screenshot

  • The response section comes out empty 🟢
    1
    2

Hence, we are closing this issue and marking this issue as 'QA Validated'.

Thanks!

@muskangulati-qasource muskangulati-qasource added QA:Validated Issue has been validated by QA and removed QA:Ready for Testing Code is merged and ready for QA to validate labels Feb 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@szwarckonrad szwarckonrad

Labels
bug Fixes for quality problems that affect the customer experience impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. OLM Sprint Osquery QA:Validated Issue has been validated by QA Team:Defend Workflows “EDR Workflows” sub-team of Security Solution Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.10.0 v8.10.1
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@elasticmachine @tomsonpl @szwarckonrad @kevinlog @muskangulati-qasource