[Security Solution] No arguments displayed for Memory Alert under rendered view

[muskangulati-qasource]

Description:
No arguments displayed for Memory Alert under rendered view

Build Details:

VERSION: 7.15.0 BC1
BUILD: 43636
COMMIT: d791226d9385122f33f4a5ca38fa5369012fbec3
ARTIFACT: https://staging.elastic.co/7.15.0-d9929120/summary-7.15.0.html

Browser Details:
All

Preconditions:

1. Kibana user should be logged in.
2. Memory Alerts should be triggered

Steps to Reproduce:

1. Navigate to the Alerts tab.
2. Select the rendered view option
3. Observe the arguments that do not show up for the Memory Alert

Impacted Test case:
N/A

Actual Result:
No arguments displayed for Memory Alert under rendered view

Expected Result:
Expected arguments should be displayed for Memory Alert under rendered view

What's working:
N/A

What's not working:
N/A

Screenshot

Logs:
N/A

[elasticmachine]

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[muskangulati-qasource]

@manishgupta-qasource please review!!

[manishgupta-qasource]

Reviewed & assigned to @paul-tavares

CC: @kevinlog

[paul-tavares]

Probably should be assigned to someone on the Detections and Response team 😃

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[andrew-goldstein]

@muskangulati-qasource would you be willing to attach the JSON from some sample events?

[muskangulati-qasource]

Hi @andrew-goldstein,

Please find below the JSON files for the memory alerts:

• Memory Threat Detection Alert
  Memory Threat Detection Alert.txt

• Malicious Behavior Detection Alert
  Malicious Behavior Detection Alert.txt

Please let us know if anything else is required from our end.

Thanks!!

[andrew-goldstein]

Thanks for providing the sample alerts @muskangulati-qasource!

@paulewing , @michaelolo24 I'm going to re-tag this issue as an enhancement, because the sample alerts have field values that don't match the existing criteria for displaying Endpoint row renderers, as documented in the two PRs below:

• [Security Solution] [Timeline] Endpoint row renderers (1st batch) #89810
• [Security Solution] [Timeline] Endpoint row renderers (2nd batch) #91446

Next steps

• @paulewing these new detections look like they would work with the exiting process row-renderers as-is. Would you be willing to confirm that based on the sample data in this issue? For example, the Malware Process Execution Detected alert below might be a good candidate for re-use:

Malware Process Execution Detected alert

Malware Process Execution Detected alerts with the following event.dataset, event.type, event.category, and event.action will be rendered in Timeline via row renderers:

event.dataset: endpoint.alerts and event.type: allowed and event.category: process and event.action: execution

Sample Malware Process Execution Detected alert

DESKTOP-1 was detected executing a malicious process mimikatz_write.exe (8668) c:\temp\mimikatz_write.exe via parent process python.exe (4400) with result success

263f09eeee80e03aa27a2d19530e2451978e18bf733c5f1c64ff2389c5dc17b0

Fields in a Sample Malware Process Execution Detected alert

host.name was detected executing a malicious process process.name (process.pid) process.args via parent process process.parent.name (process.parent.pid) with result event.outcome

process.hash.sha256

• If @paulewing confirms (for example) the above renderer can be re-used, it's a simple update to the code such that these new alerts are displayed when the event.dataset, event.type, event.category, and / or event.action criteria matches.

[muskangulati-qasource]

Hi @andrew-goldstein,

We have validated this issue on 8.14.0-BC1 and found that the issue is now fixed 🟢

Please find below the testing details:

Build details:

VERSION: 8.14.0
BUILD: 73520
COMMIT: c1513cd7e5a00eab209ba02d30cafd6945d75470

Screenshot:

Hence, closing this issue and marking it as "Validated".

Thanks!