elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.99k stars 8.24k forks source link

[Cloud Security][Bug] Accounts Evaluated link between the Dashboard and Findings page are inconsistent when there's AWS Organization data #178772

Closed opauloh closed 8 months ago

opauloh commented 8 months ago

Describe the bug After installing an AWS Organization CSPM integration on Kibana 8.13.0, we can see the Evaluated accounts on the Dashboard, but clicking on the link provided on the Dashboard leads to a Grouped Findings page that doesn't match the data.

https://long-run-qa-813-bc4-tww-8-13-0.kb.us-west2.gcp.elastic-cloud.com:9243/app/security/cloud_security_posture/dashboard/cspm

Preconditions Install CSPM Integration -> Select Organization -> Install with CloudFormation

To Reproduce Steps to reproduce the behavior:

  1. After installing the integration, wait for the findings to be generated
  2. Navigate to the Cloud Security Posture dashboard
  3. On the Accounts Evaluated counter, check the respective number for aws, click the link and confirm that the number of Groups in the Findings page doesn't match the dashboard.

Expected behavior Numbers of AWS Accounts between the Dashboard and Findings page should match/

**Recording

https://github.com/elastic/kibana/assets/19270322/45d28c86-8f1e-488f-8436-8c424e0557d3

Desktop (please complete the following information):

Additional context

image

https://github.com/elastic/kibana/assets/19270322/49d9ac56-f1d3-42a6-89e7-949df7e80773

That means a fix can be patched on Kibana side by using the filter rule.benchmark.id: cis_aws instead of cloud.provider : aws

elasticmachine commented 8 months ago

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

seanrathier commented 7 months ago

Tested and verified this is working Kibana 8.14.0