elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.71k stars 8.12k forks source link

[Security Solution] Rule export fails when there is rule action referencing a removed connector #178221

Open maximpn opened 6 months ago

maximpn commented 6 months ago

Epics: https://github.com/elastic/security-team/issues/1974 (internal), https://github.com/elastic/kibana/issues/174168 Related to: https://github.com/elastic/security-team/issues/8816 (internal)

Summary

Rule export gets blocked whenever there is a rule with configured action (for example send message to Slack) which references a removed connector (for example Slack connector). Rule export fails with an error Error fetching objects to export instead of exporting a rule and display a warning message.

Steps to reproduce

  1. Create a rule, e.g. a custom query rule
  2. Add an action to the rule (it requires to create a connector if non exists for the action type)
  3. Delete the referenced connector
  4. Export the rule with an action referencing deleted connector

Expected result: Rule is exported without an action referencing deleted connector and a warning message is shown.

Actual result: Rule export fails with an error

{
  "name": "Error",
  "body": {
    "message": "Error fetching objects to export",
    "status_code": 500
  },
  "message": "",
  "stack": "{\n  \"message\": \"Error fetching objects to export\",\n  \"status_code\": 500\n}"
}
elasticmachine commented 6 months ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 6 months ago

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine commented 6 months ago

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)