search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.81k stars 8.19k forks source link

[Security Solution][Detection Engine] rule preview works for form's invalid state #173930

Open vitaliidm opened 10 months ago

vitaliidm commented 10 months ago

Describe the bug: Rule preview works for form's invalid state

Kibana/Elasticsearch Stack version: Reported 8.11, likely was working like this since implementation

Steps to reproduce:

  1. Go to create rule form
  2. Select threshold rule
  3. Select group by field
  4. Set threshold value to 0. Observe form validation error
  5. Press rule preview button
  6. Observe rule execution failure

Current behavior:

Rule preview button is enabled, upon execution preview, it fails

Expected behavior:

Rule preview button should be disabled

Screenshots (if relevant):

https://github.com/elastic/kibana/assets/92328789/1ff7a04e-9093-424f-bfc5-41ca6c9c3a5a

This behaviour might also be applicable to the other rule types. Solution could be, to do additional check whether to enable preview button. If define step form is invalid, we might consider to disable preview button.

elasticmachine commented 10 months ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 10 months ago

Pinging @elastic/security-detections-response (Team:Detections and Resp)