Closed karanbirsingh-qasource closed 9 months ago
Pinging @elastic/security-solution (Team: SecuritySolution)
@karanbirsingh-qasource may you please quickly check if the same behaviour is present on 8.10.x release? Also can you let us know if the rule that generated the alert had any custom hightlighted fields? Thanks!! :)
Pinging @elastic/security-threat-hunting (Team:Threat Hunting)
@MadameSheema glo issue is not occuring on 8.10.3 and screen cast is present in Additional Observation section of bug
Thanks @karanbirsingh-qasource!! :)
and no there was no additional custom highlighted field added in rule just default set of field which show at own
@karanbirsingh-qasource, do the highlighted fields appear in the old flyout if you toggle the advanced setting to the old flyout?
@michaelolo24 on changing the fly out to old style the highlighted field get present.
Great, thanks so much @karanbirsingh-qasource !
@karanbirsingh-qasource one last question...in the new flyout does the loading state that you see eventually timeout?
Looks like the issue is here: https://github.com/elastic/kibana/blob/11b1bc77a6260d5f59b977607eae4a1f4ab63a0a/x-pack/plugins/security_solution/public/flyout/document_details/right/components/highlighted_fields.tsx#L98-L103
@yctercero I'm not sure if there's a timeout for this, but from @karanbirsingh-qasource 's test, I'm not sure what happens from a fallback persepctive if a rule only ever generated one alert before being deleted?
@michaelolo24 the highlighted field do shows for some seconds and after it timeout and does not load ever.
I am sharing the instance credentials with you over gmail in case you need to check other things
@michaelolo24 Hey! Is the useRuleWithFallback
call not resolving? If a rule generated 1+ alerts before being deleted, it should resolve as expected.
@michaelolo24 @yctercero I believe it is coming from:
Here we show an empty table in case of an error. When a rule is deleted, I'm seeing errors in console despite some items are being returned. Should we ignore the error
even though there are errors?
Error: Not Found
at Fetch.fetchResponse (fetch.ts:151:1)
at async interceptResponse (intercept.ts:44:1)
at async fetch.ts:48:1
The error checking is part of a state clean up during 8.11. I will open a PR to revert back to ignoring error
so that we are not disrupting any user workflows.
@karanbirsingh-qasource the fix is merged and back ported, this should be fixed in BC4
great!! Thanks @christineweng :)
@karanbirsingh-qasource - can we verify this fix? Thank you!
Hi @michaelolo24
we have validated this issue on 8.11 Release and found the issue to be fixed ✔️ . Highlighted field information is present on the alert after deleting the rule.
Build Details:
Version: 8.11.0
Commit: f2ea0c43ec0d854259d63d926b97e5c556b5f6b2
Build: 68160
Screen-Cast:
https://github.com/elastic/kibana/assets/59917825/f99a9936-af3c-44b9-92cf-160b16a1cc90
Hence we are closing this issue and adding "QA:Validated" tag to it.
thanks !!
Describe the bug: Highlighted field information not available after deleting rule
Kibana/Elasticsearch Stack version Version: 8.11.0 BC3 Commit: 714189fa2b0f0a4d9f3865a8fce08261211570c8 Build: 67923
Browser and Browser OS Version: Firefox for windows OS Version: 118.0.1
Elastic Endpoint Version: 8.11
Original install method: None
Functional Area: Alert Flyout
Initial Setup:
Steps to reproduce
Additional Observation
https://github.com/elastic/kibana/assets/59917825/ce8fd7ae-f052-4469-89df-82a2e03ee78a
Current behavior
Expected behavior:
Screen-Shot:
https://github.com/elastic/kibana/assets/59917825/f023d7dd-fc85-46ac-b95e-d1f66ba0c665
details of field( that are not showing under highlighted fields )are unavailable under the table tag![image](https://github.com/elastic/kibana/assets/59917825/ac149032-7b70-4989-8f61-a448c76105a8)