[Security Solution][Detection Engine] Rule Preview is enabled for invalid rule configuration

elastic / kibana

Your window into the Elastic Stack

https://www.elastic.co/products/kibana

Other

19.77k stars 8.17k forks source link

[Security Solution][Detection Engine] Rule Preview is enabled for invalid rule configuration #182307

Open rylnd opened 5 months ago

rylnd commented 5 months ago

Describe the bug: This looks to be a longstanding bug, as rule preview has always had its own internal logic for being enabled/disabled that is distinct from a rule's validity.

Steps to reproduce:

Create an invalid rule
- E.g. create an EQL Sequence rule with suppression
Observe that rule preview is enabled, but one is unable to continue creating the rule.

Expected behavior: Rule preview should be disabled if the rule is invalid.

Screenshots (if relevant):

elasticmachine commented 5 months ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 5 months ago

Pinging @elastic/security-detection-engine (Team:Detection Engine)

vitaliidm commented 5 months ago

Expected behavior: Rule preview should be disabled if the rule is invalid.

Small note from me: absent rule name or description also make rule form invalid on about step. But this should not disable preview. Only configuration related to rule execution should