elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.65k stars 8.23k forks source link

[Security Solution][Detection Engine] rule name override doesn't work properly on rule edit page #161955

Open vitaliidm opened 1 year ago

vitaliidm commented 1 year ago

Describe the bug: rule name override doesn't work properly on rule edit page

Kibana/Elasticsearch Stack version: 8.9. Probably for the most of previous versions

Steps to reproduce:

  1. Create custom query rule
  2. Add rule name override field
  3. Save rule
  4. Edit rule, change index/data view, so rule name override field not anymore available. DO NOT go to about step
  5. Save rule. On details page, rule name override field still displayed
  6. Edit rule again. Got to about step, observe rule name override is empty
  7. Save rule. On details page, rule name override field still displayed, despite being empty on save

Expected behavior: Should form be invalidated? Invalid field should be show on about step or if rule edit, should be removed from rule

Screenshots (if relevant):

https://github.com/elastic/kibana/assets/92328789/2c38bd0c-9534-4b0c-ba59-83019b3f9691

elasticmachine commented 1 year ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 1 year ago

Pinging @elastic/security-detections-response (Team:Detections and Resp)

vitaliidm commented 1 year ago

As discussed on advanced correlation WG, we decided that preferred solution would would be to invalidate the whole form and show error message that field is invalid and let user decide to remove field or adjust Data source.

cc: @paulewing

yctercero commented 1 year ago

I added the consider-next tag as an issue that could be prioritized/pulled in next cycle, but not looking to target 8.10. Please let me know if anyone feels otherwise!

pborgonovi commented 3 months ago

Validated latest 8.15 BC and behavior persists:

https://github.com/user-attachments/assets/99a99310-fe2e-45d1-bd95-541dd0df4978