Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution]Incorrect detection alert list apear on searching event in search bar under individual Rule page #98283

Closed
ghost opened this issue Apr 26, 2021 · 7 comments
Closed

[Security Solution]Incorrect detection alert list apear on searching event in search bar under individual Rule page #98283

ghost opened this issue Apr 26, 2021 · 7 comments
Assignees
@dplumlee
Labels
bug Fixes for quality problems that affect the customer experience fixed impact:critical This issue should be addressed immediately due to a critical level of impact on the product. QA:Validated Issue has been validated by QA Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v7.14.0

Comments

@ghost
Copy link

ghost commented Apr 26, 2021 •
edited by ghost
Loading

Describe the bug
Incorrect detection alert list appear on searching event in search bar under individual Rule page

Build Details:

Version: 7.13.0 BC2
Commit: a2f386b628764ea82af0893b8e25a16290dd6f44
Build : 40598

Browser Details
All

Preconditions

  1. Elastic Cloud environment 7.13.0 BC2 should be there.
  2. 2 or more detection rule with alerts generated should be there.

Steps to Reproduce

  1. Login to kibana
  2. Navigate to Security App > Detection Tab.
  3. Click on Manage detection rule button
  4. Click on any individual detection rule.
  5. Go to search bar and search something like "not file.path : C:\elk\mimikatz.exe"
  6. Observed that incorrect other detection alert signal apart from opened individual detection alert are appearing in the filtered detection alert list.

Actual Result
Incorrect detection alert list appear on searching event in search bar under individual Rule page

Expected Result
Only opened individual detection alert signal should appear even if user search for some event in search bar

Whats Working

  • N/A

Whats Working

  • N/A

Screenshots
image
@ghost ghost added bug Fixes for quality problems that affect the customer experience Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. labels Apr 26, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@ghost ghost assigned MadameSheema Apr 26, 2021
@MadameSheema MadameSheema removed their assignment Apr 26, 2021
@MadameSheema MadameSheema added the Team:Detections and Resp Security Detection Response Team label Apr 26, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@MadameSheema MadameSheema added triage_needed v7.13.0 impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. impact:critical This issue should be addressed immediately due to a critical level of impact on the product. and removed triage_needed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. labels Apr 26, 2021
@dplumlee dplumlee mentioned this issue May 6, 2021
Merged
3 tasks
@dplumlee
Copy link
Contributor

dplumlee commented May 6, 2021

Updating this along with the recent PR fix we put up (#99442), this is a bug happening throughout the Security app, not just the detections page, and occurs when invalid KQL is submitted through the search bar. Just in case other errors come through due to the same issue on other pages (Hosts, Host details, etc.)

andrew-goldstein pushed a commit that referenced this issue Jun 30, 2021
@dplumlee
[Security Solution] Invalid KQL Query Bug (#99442)
36b21b4 
## Summary

Addresses #98283

Currently, our method of converting KQL to Elasticsearch queries silently suppresses errors bubbled up by ES and returns an empty query string. This makes it so the entire query, including filters, etc. gets wiped out and potentially incorrect data is displayed. 

This PR addresses that by bubbling up the errors and putting them in a toast component as well as cancelling any request that was made with the invalid query so that incorrect data is never fetched.

![Screen Shot 2021-05-11 at 5 05 24 PM](https://user-images.githubusercontent.com/56367316/117895214-e8bf9500-b28b-11eb-83a6-522deebecbe2.png)


### Checklist

Delete any items that are not applicable to this PR.

- [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
andrew-goldstein pushed a commit to andrew-goldstein/kibana that referenced this issue Jun 30, 2021
@dplumlee @andrew-goldstein
[Security Solution] Invalid KQL Query Bug (elastic#99442)
26d9255 
## Summary

Addresses elastic#98283

Currently, our method of converting KQL to Elasticsearch queries silently suppresses errors bubbled up by ES and returns an empty query string. This makes it so the entire query, including filters, etc. gets wiped out and potentially incorrect data is displayed. 

This PR addresses that by bubbling up the errors and putting them in a toast component as well as cancelling any request that was made with the invalid query so that incorrect data is never fetched.

![Screen Shot 2021-05-11 at 5 05 24 PM](https://user-images.githubusercontent.com/56367316/117895214-e8bf9500-b28b-11eb-83a6-522deebecbe2.png)


### Checklist

Delete any items that are not applicable to this PR.

- [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
andrew-goldstein pushed a commit to andrew-goldstein/kibana that referenced this issue Jun 30, 2021
@dplumlee @andrew-goldstein
[Security Solution] Invalid KQL Query Bug (elastic#99442)
1d02498 
## Summary

Addresses elastic#98283

Currently, our method of converting KQL to Elasticsearch queries silently suppresses errors bubbled up by ES and returns an empty query string. This makes it so the entire query, including filters, etc. gets wiped out and potentially incorrect data is displayed. 

This PR addresses that by bubbling up the errors and putting them in a toast component as well as cancelling any request that was made with the invalid query so that incorrect data is never fetched.

![Screen Shot 2021-05-11 at 5 05 24 PM](https://user-images.githubusercontent.com/56367316/117895214-e8bf9500-b28b-11eb-83a6-522deebecbe2.png)


### Checklist

Delete any items that are not applicable to this PR.

- [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
andrew-goldstein added a commit that referenced this issue Jun 30, 2021
@andrew-goldstein @dplumlee
[Security Solution] Invalid KQL Query Bug (#99442) (#104004)
0a9da04 
## Summary

Addresses #98283

Currently, our method of converting KQL to Elasticsearch queries silently suppresses errors bubbled up by ES and returns an empty query string. This makes it so the entire query, including filters, etc. gets wiped out and potentially incorrect data is displayed. 

This PR addresses that by bubbling up the errors and putting them in a toast component as well as cancelling any request that was made with the invalid query so that incorrect data is never fetched.

![Screen Shot 2021-05-11 at 5 05 24 PM](https://user-images.githubusercontent.com/56367316/117895214-e8bf9500-b28b-11eb-83a6-522deebecbe2.png)


### Checklist

Delete any items that are not applicable to this PR.

- [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

Co-authored-by: Davis Plumlee <[email protected]>
andrew-goldstein added a commit that referenced this issue Jun 30, 2021
@andrew-goldstein @dplumlee
[Security Solution] Invalid KQL Query Bug (#99442) (#104005)
2d6a9bc 
## Summary

Addresses #98283

Currently, our method of converting KQL to Elasticsearch queries silently suppresses errors bubbled up by ES and returns an empty query string. This makes it so the entire query, including filters, etc. gets wiped out and potentially incorrect data is displayed. 

This PR addresses that by bubbling up the errors and putting them in a toast component as well as cancelling any request that was made with the invalid query so that incorrect data is never fetched.

![Screen Shot 2021-05-11 at 5 05 24 PM](https://user-images.githubusercontent.com/56367316/117895214-e8bf9500-b28b-11eb-83a6-522deebecbe2.png)


### Checklist

Delete any items that are not applicable to this PR.

- [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

Co-authored-by: Davis Plumlee <[email protected]>
@peluja1012
Copy link
Contributor

@karanbirsingh-qasource please retest. Fix was merged #99442.

@MadameSheema
Copy link
Member

@karanbirsingh-qasource please check the fix of the issue on BC3. Thanks

@ghost
Copy link
Author

ghost commented Jul 16, 2021

Hi @MadameSheema

we have validated this issue on 7.14.0 BC3 and found it fixed . The correct only individual alert result is returned on searching data on the individual alert page.

Build Details:

Version: 7.14.0 BC3
Commit:c314921a9893e0b46d9a3958f5520e3d6b1ce7d5
Build:42545

Snap-Shoot:
image
image

Hence we are closing this issue and adding "QA: Vaidatd" to it.

thanks !!

@ghost ghost closed this as completed Jul 16, 2021
@ghost ghost added the QA:Validated Issue has been validated by QA label Jul 16, 2021
@ghost
Copy link
Author

ghost commented Aug 19, 2021

Bug Conversion:

  • Created 01 test-cases for this issue.

This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@dplumlee dplumlee

Labels
bug Fixes for quality problems that affect the customer experience fixed impact:critical This issue should be addressed immediately due to a critical level of impact on the product. QA:Validated Issue has been validated by QA Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v7.14.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@peluja1012 @elasticmachine @MadameSheema @dplumlee