[Security Solution] [Bug] [Serverless] Empty drop down shown for the alerts when all the alerts are marked as 'Closed' when grouped by rule name

muskangulati-qasource commented 4 months ago

Describe the bug: Empty drop down shown for the alerts when all the alerts are marked as 'Closed' when grouped by rule name

Kibana/Elasticsearch Stack version

VERSION: 8.15 serverless
BUILD: 74129
COMMIT: f7be3ba82cd93c7ece35189105aa279be589b68b

precondition

Steps to reproduce

A few alerts should exist
Group the alerts with rule name
Expand the drop down for the rule name
Select all the alerts for the rule name and mark them as closed
Observe the drop down for the rule name is empty but the header bar shows data for the same

Current Result

Empty drop down shown for the alerts when all the alerts are marked as 'Closed' when grouped by rule name

Expected Result

The entry for the rule name should be removed from the alerts table
It should work similar to the batch action taken from the 'Take action' button in front of the rule name

Screen Recording

elasticmachine commented 4 months ago

Pinging @elastic/security-solution (Team: SecuritySolution)

muskangulati-qasource commented 4 months ago

@karanbirsingh-qasource please review!!

MadameSheema commented 4 months ago

@muskangulati-qasource can you please check if the same behaviour is present in ESS for the current BC? Thanks!

muskangulati-qasource commented 4 months ago

Hi @MadameSheema,

The same is reproducible on the 8.14.0 BC4 build as well.

Build Details:

VERSION: 8.14.0
BUILD: 73836
COMMIT: 23ed1207772b3ae958cb05bc4cdbe39b83507707

Thank you!

elasticmachine commented 4 months ago

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

elasticmachine commented 4 months ago

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

christineweng commented 3 months ago

@muskangulati-qasource @karanbirsingh-qasource this bug should be fixed in 8.14.1, could you please verify?

muskangulati-qasource commented 3 months ago

Hi @christineweng,

We have this ticket on the 8.14.1 BC1 and found the issue is still reproducible there. Please find below the testing details:

Build details:

VERSION: 8.14.1
BUILD: 74015
COMMIT: afbd904e868f2a48a2bbeb8ff20baee8d4aeb468

Observations and Screen Recording: The empty rule name is still showing as a drop down.

Please let us know if we are missing something.

Thank you!

elastic / kibana