elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.63k stars 8.22k forks source link

[Security Solution] Duplicate Saved Search Name when saving timeline causes error #168940

Open logeekal opened 1 year ago

logeekal commented 1 year ago

Describe the bug: Saving Timeline creates a saved search saved object which contains the ES|QL query. User can attempt to create a duplicate timeline with same name which will result in saved search having the same name as previously saved Saved search. This results in error.

Kibana/Elasticsearch Stack version: 8.11

Server OS version:

Browser and Browser OS versions:

Elastic Endpoint version:

Original install method (e.g. download page, yum, from source, etc.):

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Steps to reproduce:

  1. Save a timeline with name First Timeline
  2. Delete First Timeline
  3. Create a new timeline called First Timeline. It will cause an error because of duplicate Saved search name

Current behavior: Duplicate Saved search name causes error.

Expected behavior: When Timeline is deleted, associated Saved search, should also be deleted so that there will not be a situation where there will be 2 Saved search with same name.

Screenshots (if relevant):

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context (logs, chat logs, magical formulas, etc.):

elasticmachine commented 1 year ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 1 year ago

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

michaelolo24 commented 1 year ago

@logeekal Is there anyway to surface an error telling the user a unique name is required? I wonder if we should force unique names for timeline, but that might break upgrades... 🤔