[Security Solution]Threat intelligence card data stoped showing on upgrading cloud build from pre 8.0

karanbirsingh-qasource commented 2 years ago

Describe the bug Threat intelligence card data stoped showing on upgrading cloud build from pre 8.0

Build Details

Version:8.0.0-GA-BC1
COMMIT 57ca5e139a33dd2eed927ce98d8231a1f217cd15
BUILD 49192

Pre-Conditions

create the 7.17.0 Build
Install the file beat
Enable the threatintel module for file beat
The Threatintel Card get populated with data

Steps

upgrade the current release 8.0.0-GA-BC1
Navigate to Overview page and Scroll down

Observed that threat intelligence card get lost due to the 8.0 new changes that is now we have add manually file beat index under securitySolution:defaultThreatIndex

So can we have one help link on the threat intelligence card after build upgrade to 8.0 as by current experience for users there first experience after build upgrade will be questioning as there previous threat data is not showing anymore and this can improved by having a help link or tool tip or we can document this under security solution guide.

elasticmachine commented 2 years ago

Pinging @elastic/security-solution (Team: SecuritySolution)

MadameSheema commented 2 years ago

@karanbirsingh-qasource if I'm not mistaken, the behaviour described here is expected. Filebeat has a breaking change on the ECS mappings introduced on 8.0, so the card is going to be displayed empty if filebeat-8 or the fleet threat integration is not used.

cc @ecezalp

karanbirsingh-qasource commented 2 years ago

yes Glo this behavior is expected and we have mentioned same in the ticket, however if the user is not aware of this change or general experience enhancement of application we are suggesting for adding some information of threat intel card like Please make the Fillebeat index as the default ThreatIndex to view legacy threat intel data as an enhancement for Cloud Upgrade worklofw.

ecezalp commented 2 years ago

as Glo mentioned this is expected behavior, so I am removing the bug label. Will pass this to @shimonmodi & @paulewing to see if there are any desired product improvements here, but we have extensively discussed this subject before and previously the sentiment was that it's OK to have this breaking change as is.

elasticmachine commented 2 years ago

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elastic / kibana

[Security Solution]Threat intelligence card data stoped showing on upgrading cloud build from pre 8.0 #124940