[BUG] Group by resources unable to show resources / findings

[tinnytintin10]

Describe the bug
When switching from the group by none view to the group by resource view, Kibana displays There are no findings

Preconditions
I am running the main branch of Kibana locally with findings data coming from the cloud beat kind-mono cluster.

To Reproduce
Write the exact actions one should perform in order to reproduce the bug.
Steps to reproduce the behavior:

1. View Findings grouped by none
2. Group findings by resource

Expected behavior

We should see a resource per row and their associated findings when you click on them.

Screenshots

Screen.Recording.2022-05-19.at.10.58.36.AM.mov

Additional context

[tinnytintin10]

@tehilashn @kfirpeled I have added this to our last-mile epic with a priority 0

[ari-aviran]

This is happening due to the recent changes that were merged roughly at the same:

1. [Cloud Posture] add pagination to findings by resource kibana#130968
2. [Cloud Posture] Update latest findings index mapping kibana#131504

The queries for the findings-grouped-by-resource table rely on resource.id.keyword but in the mapping resource.id is only defined as text. The correct solution for this issue is to probably update the mapping of resource.id to include a .keyword field, both in the raw findings index mapping (comes from the integration) and in the latest findings index mapping (defined in Kibana code)

fyi @uri-weisman @eyalkraft

[kfirpeled]

Checkout https://github.com/elastic/security-team/issues/3737 for more information of planned work on the findings mapping

[kfirpeled]

fixed

• [Cloud Posture] Findings - Group by resource - Fixed bug not showing results kibana#132529

[tinnytintin10]

@kfirpeled Since elastic/kibana#132529 (comment) is merged we can either close this issue out or keep it open till we add back cluster id to the table. I will leave that down to you - lmk if you want another issue to track adding back cluster-id to the table.

[kfirpeled]

@tinnytintin10 I've updated this ticket to address the cluster id