Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Warnings in rule filters on the Rule Details page: "Field does not exist in current view" #178908

Closed
Tracked by #201502
banderror opened this issue Mar 18, 2024 · 9 comments · Fixed by #201776
Closed
Tracked by #201502

[Security Solution] Warnings in rule filters on the Rule Details page: "Field does not exist in current view" #178908

banderror opened this issue Mar 18, 2024 · 9 comments · Fixed by #201776
Assignees
@jkelas
Labels
8.18 candidate bug Fixes for quality problems that affect the customer experience Feature:Rule Details Security Solution Detection Rule Details page impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.16.3 v8.17.1 v8.18.0

Comments

@banderror
Copy link
Contributor

banderror commented Mar 18, 2024 •
edited by nikitaindik
Loading

Related to: #177081
Kibana version: 8.14.0-SNAPSHOT

Summary

If you create a rule with a filter, such as host.name: "some-value" AND host.os.family: "windows", then:

  • On the Rule Creation page, during rule creation, the filter will be displayed correctly.
  • On the Rule Details page, after saving this rule, it will be displayed with warnings, e.g. host.name: Warning AND host.os.family: Warning.
  • On the Rule Editing page, if you edit this rule, it will be displayed correctly again.

Rule Creation:

Screenshot 2024-03-18 at 20 54 57

Rule Details:

Screenshot 2024-03-18 at 20 55 44

Steps to reproduce

  1. Launch a clean Kibana + ES environment.
  2. Create some valid indices with source events. Locally, one easy way to do this would be using the resolver_generator script that generates fake endpoint events (events generated by Endpoint Security aka Elastic Defend): node x-pack/plugins/security_solution/scripts/endpoint/resolver_generator.js --node http://elastic:[email protected]:9200 --kibana http://elastic:[email protected]:5601/kbn --numHosts=5 --numDocs=2.
  3. Create a new custom rule. Keep the default set of index patterns if you used the resolver_generator script. Otherwise, point the rule to the indices you created on the previous step.
  4. Enter * as the rule's query.
  5. Add a rule filter, for example host.name: Host-avy6d0956e AND host.os.family: windows (use any values from your source data).
  6. Notice that the filter is displayed without any warnings, and the field values in the filter are clearly visible.
  7. Save the rule.
  8. On the Rule Details page, notice that instead of the field values Warnings are displayed.

Expected behavior: on the Rule Details page there shouldn't be any warnings in rule filters, when we know that source events with the field values used in the filters exist. Field values should be displayed instead of warnings, just like on the Rule Creation and Editing pages.

Hypothesis

Maybe the bug is caused by the fact that on the Rule Details page we use a data view that includes only the .alerts-security.alerts-<spaceid> index:

Screenshot 2024-03-18 at 20 56 00

The filter's UI component tries to find the filter's fields and their values in this data view, and doesn't find them because there are no alerts created with these fields yet. You can check in Discover that indeed, there are source events with those fields, but there are no alerts:

Source events:

Screenshot 2024-03-18 at 20 58 56

Alerts:

Screenshot 2024-03-18 at 21 02 12

So the fix would be to use on the Rule Details page a data view that would correspond to the list of index patterns or the data view of the rule, instead of the data view pointing to the alerts index of the current Kibana space.

Places the fix needs to be checked:

  • Rule details page (in a few places)
  • Prebuilt rule upgrade flyout - Diff readonly view
  • Prebuilt rule upgrade flyout - Overview tab
  • Event flyout (owned by the Threat Hunting team)
@banderror banderror added bug Fixes for quality problems that affect the customer experience impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Rule Details Security Solution Detection Rule Details page labels Mar 18, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@banderror banderror changed the title [Security Solution] Warnings in rule filters on the Rule Details page [Security Solution] Warnings in rule filters on the Rule Details page: "Field does not exist in current view" Mar 18, 2024
@banderror banderror mentioned this issue Mar 18, 2024
Merged
6 tasks
@shayfeld
Copy link

Hi @banderror :)

How is this issue progressing?
It is not possible for my SOC team to see the value inside the filters in definition screen.

@banderror banderror mentioned this issue Sep 20, 2024
Open
@banderror
Copy link
Contributor Author

Hi @shayfeld, thanks, I'm raising the priority for this one. Although it's not a commitment, there is a chance that we will have some freed up resources to work on that closer to the end of this year.

@nikitaindik
Copy link
Contributor

Hey @shayfeld and @banderror! I've investigated the bug and figured out what causes the issue. The issue affects only the filters that have "AND" or "OR" conditions.

In our app both index patterns and data views are represented as "data view" objects. TS type is either DataViewBase or DataView.

On the Rule Details page we are using an incomplete DataViewBase object that doesn't have a value for id field.

When the filters UI component renders it checks if filter is applicable to a data view (index patterns). It does this by verifying that "data view" id is equal to filter's meta.index value. Normally both data view id and filter's meta.index have a value that is a stringified index pattern, like "logs-*,events-*". But on the Rule Details page we are using a "data view" that doesn't have an id, so the check fails and a warning is shown.

Why it works on Rule Editing page, but not on Rule Details page?

Rule Editing page creates complete DataView objects with id field present.

Rule Details page creates incomplete DataViewBase objects without id.

Possible fix

I noticed this issue while working on one of my previous tasks and made a branch with a fix. In short, the fix is creating DataView objects instead of DataViewBase. The fix has yet to be properly reviewed, tested and merged. The team is currently busy with the Rule Immutability/Customization epic, so I can't really give a good estimate for the release version.

@banderror
Copy link
Contributor Author

Thank you @nikitaindik for documenting your findings here, this will be useful when we get back to finalizing the fix 👍

@banderror banderror assigned jkelas and unassigned nikitaindik Nov 18, 2024
@banderror banderror mentioned this issue Nov 23, 2024
Open
@jkelas jkelas mentioned this issue Nov 26, 2024
Merged
2 tasks
@shayfeld
Copy link

Hi @banderror ,

The bug fixed in 8.16.2?

@banderror
Copy link
Contributor Author

Hi @shayfeld, we're aiming to fix it in 8.16.2.

@banderror banderror mentioned this issue Nov 29, 2024
Closed
This was referenced Dec 10, 2024
Open
Open
@banderror banderror added v8.16.3 and removed v8.16.2 labels Dec 13, 2024
@jkelas jkelas closed this as completed in 2e3a748 Dec 18, 2024
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Dec 18, 2024
@jkelas
[Security Solution] Remove warning for rule filter (elastic#201776)
1d9c23f 
**Resolves: elastic#178908**

## Summary

This PR fixes a warning displayed for the rule when certain filter is
present.
I followed the suggestion from @nikitaindik in the original ticket and
pulled his fix and tested that it works, but it also needed some
modification borrowed from QueryBar component, namely to update the
filters before displaying the FilterItems component.

Note: This PR only covers the Rule Creation / Rules Details page. Two
new tickets have been created to cover issues found in other places:
elastic#203600 and elastic#203615

# BEFORE
<img width="899" alt="image"
src="https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0">

# AFTER
<img width="901" alt="image"
src="https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907">

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: Nikita Indik <[email protected]>
(cherry picked from commit 2e3a748)
kibanamachine added a commit that referenced this issue Dec 18, 2024
@kibanamachine @jkelas
[8.x] [Security Solution] Remove warning for rule filter (#201776) (#…
2ea0205 
…204704)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Security Solution] Remove warning for rule filter
(#201776)](#201776)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Jacek
Kolezynski","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-12-18T09:47:05Z","message":"[Security
Solution] Remove warning for rule filter (#201776)\n\n**Resolves:
#178908**\n\n## Summary\n\nThis PR fixes a warning displayed for the
rule when certain filter is\npresent.\nI followed the suggestion from
@nikitaindik in the original ticket and\npulled his fix and tested that
it works, but it also needed some\nmodification borrowed from QueryBar
component, namely to update the\nfilters before displaying the
FilterItems component.\n\nNote: This PR only covers the Rule Creation /
Rules Details page. Two\nnew tickets have been created to cover issues
found in other places:\n#203600 and #203615\n\n# BEFORE\n<img
width=\"899\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0\">\n\n#
AFTER\n<img width=\"901\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907\">\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Nikita
Indik
<[email protected]>","sha":"2e3a74829d953e3a968c75e0edaed21dce332c03","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Rule Creation","Feature:Rule Details","Feature:Rule
Edit","backport:version","v8.18.0","v8.16.3","v8.17.1"],"title":"[Security
Solution] Remove warning for rule
filter","number":201776,"url":"https://github.com/elastic/kibana/pull/201776","mergeCommit":{"message":"[Security
Solution] Remove warning for rule filter (#201776)\n\n**Resolves:
#178908**\n\n## Summary\n\nThis PR fixes a warning displayed for the
rule when certain filter is\npresent.\nI followed the suggestion from
@nikitaindik in the original ticket and\npulled his fix and tested that
it works, but it also needed some\nmodification borrowed from QueryBar
component, namely to update the\nfilters before displaying the
FilterItems component.\n\nNote: This PR only covers the Rule Creation /
Rules Details page. Two\nnew tickets have been created to cover issues
found in other places:\n#203600 and #203615\n\n# BEFORE\n<img
width=\"899\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0\">\n\n#
AFTER\n<img width=\"901\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907\">\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Nikita
Indik
<[email protected]>","sha":"2e3a74829d953e3a968c75e0edaed21dce332c03"}},"sourceBranch":"main","suggestedTargetBranches":["8.x","8.16","8.17"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/201776","number":201776,"mergeCommit":{"message":"[Security
Solution] Remove warning for rule filter (#201776)\n\n**Resolves:
#178908**\n\n## Summary\n\nThis PR fixes a warning displayed for the
rule when certain filter is\npresent.\nI followed the suggestion from
@nikitaindik in the original ticket and\npulled his fix and tested that
it works, but it also needed some\nmodification borrowed from QueryBar
component, namely to update the\nfilters before displaying the
FilterItems component.\n\nNote: This PR only covers the Rule Creation /
Rules Details page. Two\nnew tickets have been created to cover issues
found in other places:\n#203600 and #203615\n\n# BEFORE\n<img
width=\"899\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0\">\n\n#
AFTER\n<img width=\"901\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907\">\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Nikita
Indik
<[email protected]>","sha":"2e3a74829d953e3a968c75e0edaed21dce332c03"}},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.16","label":"v8.16.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.17","label":"v8.17.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Jacek Kolezynski <[email protected]>
jkelas added a commit to jkelas/kibana that referenced this issue Dec 18, 2024
@jkelas
[Security Solution] Remove warning for rule filter (elastic#201776)
d5a28b1 
**Resolves: elastic#178908**

## Summary

This PR fixes a warning displayed for the rule when certain filter is
present.
I followed the suggestion from @nikitaindik in the original ticket and
pulled his fix and tested that it works, but it also needed some
modification borrowed from QueryBar component, namely to update the
filters before displaying the FilterItems component.

Note: This PR only covers the Rule Creation / Rules Details page. Two
new tickets have been created to cover issues found in other places:
elastic#203600 and elastic#203615

# BEFORE
<img width="899" alt="image"
src="https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0">

# AFTER
<img width="901" alt="image"
src="https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907">

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: Nikita Indik <[email protected]>
(cherry picked from commit 2e3a748)

# Conflicts:
#	x-pack/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/rule_definition_section.tsx
#	x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/three_way_diff/final_edit/fields/hooks/use_data_view.ts
jkelas added a commit that referenced this issue Dec 18, 2024
@jkelas
[8.17] [Security Solution] Remove warning for rule filter (#201776) (#…
6643cc3 
…204718)

# Backport

This will backport the following commits from `main` to `8.17`:
- [[Security Solution] Remove warning for rule filter
(#201776)](#201776)

<!--- Backport version: 9.6.2 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jacek
Kolezynski","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-12-18T09:47:05Z","message":"[Security
Solution] Remove warning for rule filter (#201776)\n\n**Resolves:
#178908**\n\n## Summary\n\nThis PR fixes a warning displayed for the
rule when certain filter is\npresent.\nI followed the suggestion from
@nikitaindik in the original ticket and\npulled his fix and tested that
it works, but it also needed some\nmodification borrowed from QueryBar
component, namely to update the\nfilters before displaying the
FilterItems component.\n\nNote: This PR only covers the Rule Creation /
Rules Details page. Two\nnew tickets have been created to cover issues
found in other places:\n#203600 and #203615\n\n# BEFORE\n<img
width=\"899\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0\">\n\n#
AFTER\n<img width=\"901\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907\">\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Nikita
Indik
<[email protected]>","sha":"2e3a74829d953e3a968c75e0edaed21dce332c03","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Rule Creation","Feature:Rule Details","Feature:Rule
Edit","backport:version","v8.18.0","v8.16.3","v8.17.1"],"title":"[Security
Solution] Remove warning for rule
filter","number":201776,"url":"https://github.com/elastic/kibana/pull/201776","mergeCommit":{"message":"[Security
Solution] Remove warning for rule filter (#201776)\n\n**Resolves:
#178908**\n\n## Summary\n\nThis PR fixes a warning displayed for the
rule when certain filter is\npresent.\nI followed the suggestion from
@nikitaindik in the original ticket and\npulled his fix and tested that
it works, but it also needed some\nmodification borrowed from QueryBar
component, namely to update the\nfilters before displaying the
FilterItems component.\n\nNote: This PR only covers the Rule Creation /
Rules Details page. Two\nnew tickets have been created to cover issues
found in other places:\n#203600 and #203615\n\n# BEFORE\n<img
width=\"899\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0\">\n\n#
AFTER\n<img width=\"901\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907\">\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Nikita
Indik
<[email protected]>","sha":"2e3a74829d953e3a968c75e0edaed21dce332c03"}},"sourceBranch":"main","suggestedTargetBranches":["8.16","8.17"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/201776","number":201776,"mergeCommit":{"message":"[Security
Solution] Remove warning for rule filter (#201776)\n\n**Resolves:
#178908**\n\n## Summary\n\nThis PR fixes a warning displayed for the
rule when certain filter is\npresent.\nI followed the suggestion from
@nikitaindik in the original ticket and\npulled his fix and tested that
it works, but it also needed some\nmodification borrowed from QueryBar
component, namely to update the\nfilters before displaying the
FilterItems component.\n\nNote: This PR only covers the Rule Creation /
Rules Details page. Two\nnew tickets have been created to cover issues
found in other places:\n#203600 and #203615\n\n# BEFORE\n<img
width=\"899\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0\">\n\n#
AFTER\n<img width=\"901\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907\">\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Nikita
Indik
<[email protected]>","sha":"2e3a74829d953e3a968c75e0edaed21dce332c03"}},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/204704","number":204704,"state":"OPEN"},{"branch":"8.16","label":"v8.16.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.17","label":"v8.17.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
jkelas added a commit that referenced this issue Dec 18, 2024
@jkelas
[8.16] [Security Solution] Remove warning for rule filter (#201776) (#…
56a60e8 
…204728)

# Backport

This will backport the following commits from `main` to `8.16`:
- [[Security Solution] Remove warning for rule filter
(#201776)](#201776)

<!--- Backport version: 9.6.2 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jacek
Kolezynski","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-12-18T09:47:05Z","message":"[Security
Solution] Remove warning for rule filter (#201776)\n\n**Resolves:
#178908**\n\n## Summary\n\nThis PR fixes a warning displayed for the
rule when certain filter is\npresent.\nI followed the suggestion from
@nikitaindik in the original ticket and\npulled his fix and tested that
it works, but it also needed some\nmodification borrowed from QueryBar
component, namely to update the\nfilters before displaying the
FilterItems component.\n\nNote: This PR only covers the Rule Creation /
Rules Details page. Two\nnew tickets have been created to cover issues
found in other places:\n#203600 and #203615\n\n# BEFORE\n<img
width=\"899\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0\">\n\n#
AFTER\n<img width=\"901\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907\">\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Nikita
Indik
<[email protected]>","sha":"2e3a74829d953e3a968c75e0edaed21dce332c03","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","v9.0.0","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","Feature:Rule Creation","Feature:Rule Details","Feature:Rule
Edit","backport:version","v8.18.0","v8.16.3","v8.17.1"],"title":"[Security
Solution] Remove warning for rule
filter","number":201776,"url":"https://github.com/elastic/kibana/pull/201776","mergeCommit":{"message":"[Security
Solution] Remove warning for rule filter (#201776)\n\n**Resolves:
#178908**\n\n## Summary\n\nThis PR fixes a warning displayed for the
rule when certain filter is\npresent.\nI followed the suggestion from
@nikitaindik in the original ticket and\npulled his fix and tested that
it works, but it also needed some\nmodification borrowed from QueryBar
component, namely to update the\nfilters before displaying the
FilterItems component.\n\nNote: This PR only covers the Rule Creation /
Rules Details page. Two\nnew tickets have been created to cover issues
found in other places:\n#203600 and #203615\n\n# BEFORE\n<img
width=\"899\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0\">\n\n#
AFTER\n<img width=\"901\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907\">\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Nikita
Indik
<[email protected]>","sha":"2e3a74829d953e3a968c75e0edaed21dce332c03"}},"sourceBranch":"main","suggestedTargetBranches":["8.16"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/201776","number":201776,"mergeCommit":{"message":"[Security
Solution] Remove warning for rule filter (#201776)\n\n**Resolves:
#178908**\n\n## Summary\n\nThis PR fixes a warning displayed for the
rule when certain filter is\npresent.\nI followed the suggestion from
@nikitaindik in the original ticket and\npulled his fix and tested that
it works, but it also needed some\nmodification borrowed from QueryBar
component, namely to update the\nfilters before displaying the
FilterItems component.\n\nNote: This PR only covers the Rule Creation /
Rules Details page. Two\nnew tickets have been created to cover issues
found in other places:\n#203600 and #203615\n\n# BEFORE\n<img
width=\"899\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0\">\n\n#
AFTER\n<img width=\"901\"
alt=\"image\"\nsrc=\"https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907\">\n\n\n###
Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers
should verify this PR satisfies this list as well.\n\n- [ ] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n\n---------\n\nCo-authored-by: Nikita
Indik
<[email protected]>","sha":"2e3a74829d953e3a968c75e0edaed21dce332c03"}},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/204704","number":204704,"state":"MERGED","mergeCommit":{"sha":"2ea020542b5c30066b3728d8b718670c5732ca1e","message":"[8.x]
[Security Solution] Remove warning for rule filter (#201776)
(#204704)\n\n# Backport\n\nThis will backport the following commits from
`main` to `8.x`:\n- [[Security Solution] Remove warning for rule
filter\n(#201776)](https://github.com/elastic/kibana/pull/201776)\n\n<!---
Backport version: 9.4.3 -->\n\n### Questions ?\nPlease refer to the
[Backport
tool\ndocumentation](https://github.com/sqren/backport)\n\n<!--BACKPORT
[{\"author\":{\"name\":\"Jacek\nKolezynski\",\"email\":\"[email protected]\"},\"sourceCommit\":{\"committedDate\":\"2024-12-18T09:47:05Z\",\"message\":\"[Security\nSolution]
Remove warning for rule filter
(#201776)\\n\\n**Resolves:\n#178908**\\n\\n## Summary\\n\\nThis PR fixes
a warning displayed for the\nrule when certain filter is\\npresent.\\nI
followed the suggestion from\n@nikitaindik in the original ticket
and\\npulled his fix and tested that\nit works, but it also needed
some\\nmodification borrowed from QueryBar\ncomponent, namely to update
the\\nfilters before displaying the\nFilterItems component.\\n\\nNote:
This PR only covers the Rule Creation /\nRules Details page. Two\\nnew
tickets have been created to cover issues\nfound in other
places:\\n#203600 and #203615\\n\\n#
BEFORE\\n<img\nwidth=\\\"899\\\"\nalt=\\\"image\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0\\\">\\n\\n#\nAFTER\\n<img
width=\\\"901\\\"\nalt=\\\"image\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907\\\">\\n\\n\\n###\nChecklist\\n\\nCheck
the PR satisfies following conditions. \\n\\nReviewers\nshould verify
this PR satisfies this list as well.\\n\\n- [ ] [Unit
or\nfunctional\\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\\nwere\nupdated
or added to match the most common scenarios\\n- [ ]
[Flaky\nTest\\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)\nwas\\nused
on any tests changed\\n\\n---------\\n\\nCo-authored-by:
Nikita\nIndik\n<[email protected]>\",\"sha\":\"2e3a74829d953e3a968c75e0edaed21dce332c03\",\"branchLabelMapping\":{\"^v9.0.0$\":\"main\",\"^v8.18.0$\":\"8.x\",\"^v(\\\\d+).(\\\\d+).\\\\d+$\":\"$1.$2\"}},\"sourcePullRequest\":{\"labels\":[\"bug\",\"release_note:fix\",\"v9.0.0\",\"Team:Detections\nand
Resp\",\"Team: SecuritySolution\",\"Team:Detection
Rule\nManagement\",\"Feature:Rule Creation\",\"Feature:Rule
Details\",\"Feature:Rule\nEdit\",\"backport:version\",\"v8.18.0\",\"v8.16.3\",\"v8.17.1\"],\"title\":\"[Security\nSolution]
Remove warning for
rule\nfilter\",\"number\":201776,\"url\":\"https://github.com/elastic/kibana/pull/201776\",\"mergeCommit\":{\"message\":\"[Security\nSolution]
Remove warning for rule filter
(#201776)\\n\\n**Resolves:\n#178908**\\n\\n## Summary\\n\\nThis PR fixes
a warning displayed for the\nrule when certain filter is\\npresent.\\nI
followed the suggestion from\n@nikitaindik in the original ticket
and\\npulled his fix and tested that\nit works, but it also needed
some\\nmodification borrowed from QueryBar\ncomponent, namely to update
the\\nfilters before displaying the\nFilterItems component.\\n\\nNote:
This PR only covers the Rule Creation /\nRules Details page. Two\\nnew
tickets have been created to cover issues\nfound in other
places:\\n#203600 and #203615\\n\\n#
BEFORE\\n<img\nwidth=\\\"899\\\"\nalt=\\\"image\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0\\\">\\n\\n#\nAFTER\\n<img
width=\\\"901\\\"\nalt=\\\"image\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907\\\">\\n\\n\\n###\nChecklist\\n\\nCheck
the PR satisfies following conditions. \\n\\nReviewers\nshould verify
this PR satisfies this list as well.\\n\\n- [ ] [Unit
or\nfunctional\\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\\nwere\nupdated
or added to match the most common scenarios\\n- [ ]
[Flaky\nTest\\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)\nwas\\nused
on any tests changed\\n\\n---------\\n\\nCo-authored-by:
Nikita\nIndik\n<[email protected]>\",\"sha\":\"2e3a74829d953e3a968c75e0edaed21dce332c03\"}},\"sourceBranch\":\"main\",\"suggestedTargetBranches\":[\"8.x\",\"8.16\",\"8.17\"],\"targetPullRequestStates\":[{\"branch\":\"main\",\"label\":\"v9.0.0\",\"branchLabelMappingKey\":\"^v9.0.0$\",\"isSourceBranch\":true,\"state\":\"MERGED\",\"url\":\"https://github.com/elastic/kibana/pull/201776\",\"number\":201776,\"mergeCommit\":{\"message\":\"[Security\nSolution]
Remove warning for rule filter
(#201776)\\n\\n**Resolves:\n#178908**\\n\\n## Summary\\n\\nThis PR fixes
a warning displayed for the\nrule when certain filter is\\npresent.\\nI
followed the suggestion from\n@nikitaindik in the original ticket
and\\npulled his fix and tested that\nit works, but it also needed
some\\nmodification borrowed from QueryBar\ncomponent, namely to update
the\\nfilters before displaying the\nFilterItems component.\\n\\nNote:
This PR only covers the Rule Creation /\nRules Details page. Two\\nnew
tickets have been created to cover issues\nfound in other
places:\\n#203600 and #203615\\n\\n#
BEFORE\\n<img\nwidth=\\\"899\\\"\nalt=\\\"image\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/62b300b4-bc70-481f-8042-dc9d7c4b3ff0\\\">\\n\\n#\nAFTER\\n<img
width=\\\"901\\\"\nalt=\\\"image\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/6c2915f8-e2e1-477d-bf6c-4ededf1a6907\\\">\\n\\n\\n###\nChecklist\\n\\nCheck
the PR satisfies following conditions. \\n\\nReviewers\nshould verify
this PR satisfies this list as well.\\n\\n- [ ] [Unit
or\nfunctional\\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\\nwere\nupdated
or added to match the most common scenarios\\n- [ ]
[Flaky\nTest\\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)\nwas\\nused
on any tests changed\\n\\n---------\\n\\nCo-authored-by:
Nikita\nIndik\n<[email protected]>\",\"sha\":\"2e3a74829d953e3a968c75e0edaed21dce332c03\"}},{\"branch\":\"8.x\",\"label\":\"v8.18.0\",\"branchLabelMappingKey\":\"^v8.18.0$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"},{\"branch\":\"8.16\",\"label\":\"v8.16.3\",\"branchLabelMappingKey\":\"^v(\\\\d+).(\\\\d+).\\\\d+$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"},{\"branch\":\"8.17\",\"label\":\"v8.17.1\",\"branchLabelMappingKey\":\"^v(\\\\d+).(\\\\d+).\\\\d+$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"}]}]\nBACKPORT-->\n\nCo-authored-by:
Jacek Kolezynski
<[email protected]>"}},{"branch":"8.16","label":"v8.16.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.17","label":"v8.17.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/204718","number":204718,"state":"OPEN"}]}]
BACKPORT-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jkelas jkelas

Labels
8.18 candidate bug Fixes for quality problems that affect the customer experience Feature:Rule Details Security Solution Detection Rule Details page impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.16.3 v8.17.1 v8.18.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Security Solution] Remove warning for rule filter jkelas/kibana
5 participants
@banderror @elasticmachine @nikitaindik @shayfeld @jkelas