Observed in 8.2, if you delete a Timeline Template and then go back to one of the alerts that were created when that Template existed, and then use the Investigate in Timeline action, you'll be presented with a blank Timeline. In the event that the Template has been deleted, we should fall back to the default Investigate in Timeline action behavior which just adds the _id of the alert itself as a data provider.
Steps to recreate
Create Timeline Template
Create Rule and assign above Template
Generate Alerts and disable Rule
Verify Investigate in Timeline action uses the Timeline Template as expected
Delete Timeline Template
Verify Investigate in Timeline action shows an empty Template
Note: This exists as a referential integrity issue with Timeline Templates, and any Rule still referencing deleted Templates will continue to create Alerts referencing that Template. Should probably explore updating any affected Rules as we did with the Lists/Exceptions referential integrity issues (https://github.com/elastic/kibana/pull/85925). Will have to keep in mind not to update the Rule API key as part of this update.
cc @paulewing @andrew-goldstein @kqualters-elastic
Summary
Observed in
8.2
, if you delete a Timeline Template and then go back to one of the alerts that were created when that Template existed, and then use theInvestigate in Timeline
action, you'll be presented with a blank Timeline. In the event that the Template has been deleted, we should fall back to the defaultInvestigate in Timeline
action behavior which just adds the_id
of the alert itself as a data provider.Steps to recreate
Investigate in Timeline
action uses the Timeline Template as expectedInvestigate in Timeline
action shows an empty TemplateNote: This exists as a referential integrity issue with Timeline Templates, and any Rule still referencing deleted Templates will continue to create Alerts referencing that Template. Should probably explore updating any affected Rules as we did with the Lists/Exceptions referential integrity issues (https://github.com/elastic/kibana/pull/85925). Will have to keep in mind not to update the Rule API key as part of this update.
cc @paulewing @andrew-goldstein @kqualters-elastic