[Defend Workflows]Event filter Search is not working as per the mentioned information in the search bar.

sukhwindersingh-qasource commented 3 months ago

Describe the bug: Event filter Search is not working as per the mentioned information in the search bar.

Build Details:

VERSION: 8.15.0 SNAPSHOT
BUILD: 75426
COMMIT: f672297b140695f1c920c5a1b3bdce6fc812aceb

Preconditions

Kibana should be running.
Agent should be added
6,7 Entries of Event filter should be present i.e process.name is "cmd.exe" like this for different processes.

Steps to Reproduce

Navigate to Events filter tab
Now search with some numeric value i.e 7 or 2 etc
Observe this will show the Event filters results but Information mentioned is search on the basis of name, description, comments, value and there no match with all these mentioned attributes

Actual result

Event filter Search is not working as per the mentioned information in the search bar.

Expected Result

Event filter Search should be working as per the mentioned information in the search bar.

Screen-cast of the issue

Login credentials To be added

Logs N/A

Dev notes:

There is some regexp logic in place, maybe we are skipping numbers there. Let's check it.

[ ] Search criteria matches with search results
[ ] Ensure this is not happening with other artifacts (Trusted apps, event filters, etc.) If it is also happening, try to fix it globally.

elasticmachine commented 3 months ago

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

elasticmachine commented 3 months ago

Pinging @elastic/security-solution (Team: SecuritySolution)

sukhwindersingh-qasource commented 3 months ago

@muskangulati-qasource Kindly review this

Thanks!

muskangulati-qasource commented 3 months ago

Reviewed and assigned to @ferullo

dasansol92 commented 3 months ago

hi @sukhwindersingh-qasource can we confirm the same behaviour is happening in 8.14? Thanks!

sukhwindersingh-qasource commented 3 months ago

Hi @dasansol92, Yes the same behavior is present on 8.14.0 also Thanks!