elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.62k stars 8.22k forks source link

[Security Solution] When rule type changed from ML to other the values from Anomaly indexes are present in the selection dropdown of rule name override #190075

Open pborgonovi opened 3 months ago

pborgonovi commented 3 months ago

Describe the bug: When rule type changed from ML to other the values from Anomaly indexes are present in the selection dropdown of rule name override

Kibana/Elasticsearch Stack version: 8.15

Server OS version:

Browser and Browser OS versions:

Elastic Endpoint version:

Original install method (e.g. download page, yum, from source, etc.):

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Steps to reproduce:

  1. Create rule: select a custom query rule,
  2. Check rule name override field drop down - fields from the default security indexes are present
  3. Change type to ML, select ML job,
  4. Check rule name override field - fields from the ML index are present
  5. Change the rule type back to custom query
  6. Reset rule index patterns to the default ones
  7. Check rule name override field - fields from the ML index are present, no fields from default security index patterns

Current behavior: Fields from the ML index are present, no fields from default security index patterns

Expected behavior: Fields from default security index patterns should be present for selection

Screenshots (if relevant):

https://github.com/user-attachments/assets/f3cb91a8-2843-4bf8-8f18-97aa4eb814ca

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context (logs, chat logs, magical formulas, etc.):

elasticmachine commented 3 months ago

Pinging @elastic/security-detection-engine (Team:Detection Engine)

elasticmachine commented 3 months ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 3 months ago

Pinging @elastic/security-detections-response (Team:Detections and Resp)