[Security Solution] Rule fails to generate alerts if investigation guide contains a base64-encoded image

[banderror]

Kibana versions: main branch, 8.11.3

Summary

A rule fails during its execution when trying to index generated alerts, if its investigation guide contains a base64-encoded image instead of a link to an image by URL. Error message:

failed to parse field [kibana.alert.rule.note] of type [keyword] in document with id 'bfc...'

As you can see from the screenshot, the guide itself renders on the Rule Details page - we support base64-encoded images in our markdown components.

Example of an investigation guide that causes this issue:

# Investigation guide

Image as base64 embedding:

![](data:image/png;base64,iVBORw0KGgoAA<other characters...>K5CYII=)

Image URLs, however, don't break the rule execution:

# Investigation guide

Image as url:

![logo](https://upload.wikimedia.org/wikipedia/commons/a/a2/Wikimedia_browser_share_pie_chart.png)

How to reproduce

Import two rules using the following ndjson file:

``` {"id":"a7a4afb8-5857-430a-9b80-52d4fe470699","updated_at":"2024-10-13T15:40:48.559Z","updated_by":"elastic","created_at":"2024-10-13T12:53:12.966Z","created_by":"elastic","name":"Investigation guide with URL image","tags":[],"interval":"5m","enabled":false,"revision":3,"description":"-","risk_score":21,"severity":"low","note":"# Investigation guide\n\nImage as url:\n\n\n","license":"","output_index":"","meta":{"from":"1m","kibana_siem_app_url":"http://localhost:5601/kbn/app/security"},"author":[],"false_positives":[],"from":"now-360s","rule_id":"64cf8deb-b3fa-4af5-8f76-b5e27e274f12","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"rule_source":{"type":"internal"},"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["apm-*-transaction*","auditbeat-*","endgame-*","filebeat-*","logs-*","packetbeat-*","traces-apm*","winlogbeat-*","-*elastic-cloud-logs-*"],"query":"host.name: *","filters":[],"actions":[]} {"id":"eb811873-db2b-43ac-b0cb-fd04f96b8856","updated_at":"2024-10-13T15:40:22.569Z","updated_by":"elastic","created_at":"2024-10-13T13:11:46.369Z","created_by":"elastic","name":"Investigation guide with Base64 image","tags":[],"interval":"5m","enabled":false,"revision":2,"description":"-","risk_score":21,"severity":"low","note":"# Investigation guide\n\nImage as base64 embedding:\n\n\n","license":"","output_index":"","meta":{"from":"1m","kibana_siem_app_url":"http://localhost:5601/kbn/app/security"},"author":[],"false_positives":[],"from":"now-360s","rule_id":"16936b20-1729-434f-8ff8-cdc9265a2d39","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"rule_source":{"type":"internal"},"related_integrations":[],"required_fields":[],"setup":"","type":"query","language":"kuery","index":["apm-*-transaction*","auditbeat-*","endgame-*","filebeat-*","logs-*","packetbeat-*","traces-apm*","winlogbeat-*","-*elastic-cloud-logs-*"],"query":"host.name: *","filters":[],"actions":[]} {"exported_count":2,"exported_rules_count":2,"missing_rules":[],"missing_rules_count":0,"exported_exception_list_count":0,"exported_exception_list_item_count":0,"missing_exception_list_item_count":0,"missing_exception_list_items":[],"missing_exception_lists":[],"missing_exception_lists_count":0,"exported_action_connector_count":0,"missing_action_connection_count":0,"missing_action_connections":[],"excluded_action_connection_count":0,"excluded_action_connections":[]} ```

Index some source documents with a host.name field to a logs-* index. Enable the rules and see that one of them fails and the other one succeeds.

Alternatively, use https://www.base64encode.net/base64-image-encoder to get your own base64-encoded image.

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-engine (Team:Detection Engine)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[yctercero]

Note from sync: we should add validation to disallow and encourage users in docs to correctly format image links.