search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.82k stars 8.21k forks source link

[Security Solution][Timeline Templates] Fallback to default Timeline if Timeline Template has been deleted #129955

Open spong opened 2 years ago

spong commented 2 years ago

Summary

Observed in 8.2, if you delete a Timeline Template and then go back to one of the alerts that were created when that Template existed, and then use the Investigate in Timeline action, you'll be presented with a blank Timeline. In the event that the Template has been deleted, we should fall back to the default Investigate in Timeline action behavior which just adds the _id of the alert itself as a data provider.

Steps to recreate

  1. Create Timeline Template
  2. Create Rule and assign above Template
  3. Generate Alerts and disable Rule
  4. Verify Investigate in Timeline action uses the Timeline Template as expected
  5. Delete Timeline Template
  6. Verify Investigate in Timeline action shows an empty Template

Note: This exists as a referential integrity issue with Timeline Templates, and any Rule still referencing deleted Templates will continue to create Alerts referencing that Template. Should probably explore updating any affected Rules as we did with the Lists/Exceptions referential integrity issues (https://github.com/elastic/kibana/pull/85925). Will have to keep in mind not to update the Rule API key as part of this update.

cc @paulewing @andrew-goldstein @kqualters-elastic

elasticmachine commented 2 years ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 2 years ago

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)