elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.76k stars 8.17k forks source link

[Security Solution][Detections] Change in `set-value` behavior affecting Security ML Detection Rule #113645

Open spong opened 3 years ago

spong commented 3 years ago

In 7.15 the set-value dependency was updated to 4.1.0 (from 3.0.2), which introduced a huge behavioral change when numbers are provided as the 2nd parameter. When a field name is something like 123.788 this will no longer generate an object: { 123: { 788: { ... } } but instead { 123: [ , , , , /* 788 empty elements */, { ... } ] }.

Note: This should be an unlikely error-scenario as there are presumably few occurrences where field.name's are all numbers within this context (citation needed), but in any case this will either result in trying to write malformed data to alerts or the rule failing execution outright.

Usage as follows: https://github.com/elastic/kibana/blob/4681a80317176543535bfdb2188d94aa40d741fc/x-pack/plugins/security_solution/server/lib/detection_engine/signals/bulk_create_ml_signals.ts#L57-L63

elasticmachine commented 3 years ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 2 years ago

Pinging @elastic/security-detections-response (Team:Detections and Resp)