search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.47k stars 8.04k forks source link

[EDR Workflows] The details for the SentinelOne integration are not showing on the dashboard #172038

Open muskangulati-qasource opened 7 months ago

muskangulati-qasource commented 7 months ago

Description: The details for the SentinelOne integration are not showing on the dashboard

Build Details:

VERSION: 8.12.0
BUILD: 69191
COMMIT: 37bf74b0d8f03b2c2ec2c036926c3b0ba3f78fed

Preconditions:

  1. Kibana user should be logged in

Steps to Reproduce:

  1. Login to a fresh Kibana environment
  2. Navigate to the 'Integrations' tab under the Management section
  3. Search for SentinelOne integration and install the same
  4. Navigate to 'Assets' tab under the 'SentinelOne' integration
  5. Click on the '[Logs SentinelOne] Threats'
  6. Observe the errors being shown for the dashboard

Actual Result: The details for the SentinelOne integration are not showing on the dashboard

Expected Result: The details for the SentinelOne integration should show up on the dashboard or a more defined error should be shown

Screenshots:

https://github.com/elastic/kibana/assets/60252716/64818af5-ea6d-4c33-b805-c3dc1f2b350d

Logs N/A

elasticmachine commented 7 months ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 7 months ago

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

manishgupta-qasource commented 7 months ago

Reviewed & assigned to @kevinlog

kevinlog commented 6 months ago

@muskangulati-qasource @manishgupta-qasource

I am not sure what the issue is on this one, however we are not making changes to the SentinelOne integration itself at this point. We can leave this open for further investigation for now, but it is lower priority in context with our current effort with bi-directional connectors.

sukhwindersingh-qasource commented 6 months ago

Hi @kevinlog Thanks for sharing the inputs and we will keeping the issue open for now however below are current observation of this bug.

Observations

Currently no error is showing under the '[Logs SentinelOne] Threats' dashboard but at same place data is also not showing that is zero count is being shown under all the visualization of dashboard.

Untitled

So could you also please help in order to get non zero data under this dashboard, we will be sharing the mail containing the steps we have followed on ubuntu vm on kibana instance with feature flag on in case there is some missing thing in setup due to which zero counts are showing in dashboard. thanks !!