Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Application does not fail gracefully when navigating to a non existing rule from a case #124355

Closed
MadameSheema opened this issue Feb 2, 2022 · 8 comments · Fixed by #133867 or #133942
Closed

[Security Solution] Application does not fail gracefully when navigating to a non existing rule from a case #124355

MadameSheema opened this issue Feb 2, 2022 · 8 comments · Fixed by #133867 or #133942
Assignees
@vitaliidm
Labels
8.3 candidate bug Fixes for quality problems that affect the customer experience Feature:Detection Rules Anything related to Security Solution's Detection Rules fixed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. QA:Validated Issue has been validated by QA Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.3.0

Comments

@MadameSheema
Copy link
Member

Describe the bug:

  • Application does not fail gracefully when navigating to a non existing rule from a case

Kibana/Elasticsearch Stack version:
8.0-rc2 BC4

Steps to reproduce:

  1. Export a case with an attached alert
  2. Import the case into an instance or space where the alert and the rule does not exist
  3. Open the imported case
  4. Click on the rule name of the attached alert

Current behavior:

Screenshot 2022-02-02 at 16 17 19

Expected behavior:

  • The application fails gracefully warning the user the rule does not eixst

Additional information:

  • If you manually update the URL modifying the id by another value, the application fails gracefully
@MadameSheema MadameSheema added bug Fixes for quality problems that affect the customer experience triage_needed Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. labels Feb 2, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@jonathan-buttner
Copy link
Contributor

jonathan-buttner commented Feb 2, 2022 •
edited
Loading

I've been looking into this. I don't believe this is a cases issue. I can reproduce this without interacting with cases by doing the following:

  1. Create a detection rule and have it create some alerts in the default space
  2. Copy the URL for the rule page
  3. Create a new space
  4. Modify the URL copied in step 2 to use the new space and navigate to it in the browser

The rule page will begin to load and then crash the UI.

I think this has something to do with attempting to access a rule that does exist but is in a different space.

@MadameSheema MadameSheema added Team:Detection Rule Management Security Detection Rule Management Team impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. v8.0.1 v8.1.0 and removed triage_needed labels Feb 2, 2022
@banderror banderror removed their assignment Feb 7, 2022
@banderror banderror added the Team:Detections and Resp Security Detection Response Team label Feb 7, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@spong
Copy link
Member

spong commented Feb 8, 2022

Also found in testing #124194 (comment), additional details from there include:

Came across an app crash in initial testing when visiting a Rule Details page for an id that has never existed.

And non-minified stacktrace -- looks like we're not short circuiting soon enough and trying to fill in the severityMappings with an empty mapping. Must be an underlying type issue lingering in there?

@banderror banderror self-assigned this Feb 9, 2022
@MadameSheema MadameSheema mentioned this issue Feb 11, 2022
Closed
@banderror banderror added v8.2.0 8.2 candidate considered, but not committed, for 8.2 release and removed v8.1.0 v8.0.1 labels Feb 14, 2022
@peluja1012 peluja1012 added the Feature:Detection Rules Anything related to Security Solution's Detection Rules label Apr 4, 2022
@banderror banderror added 8.3 candidate and removed v8.2.0 8.2 candidate considered, but not committed, for 8.2 release labels Apr 11, 2022
@banderror banderror removed their assignment Apr 27, 2022
@vitaliidm vitaliidm self-assigned this Jun 7, 2022
@vitaliidm vitaliidm mentioned this issue Jun 8, 2022
Merged
1 task
vitaliidm added a commit that referenced this issue Jun 8, 2022
@vitaliidm
[Security Solution][Detection rules] fixes ungraceful failure when ru…
1fd9a76 
…le details page opened on non-existent rule #133867

## Summary
fixes #124355

In this PR, when results of fallback alerts search are empty, we return `undefined` for rule, instead of `{}` in helper method `transformRuleFromAlertHit`.
Returning `{}` caused break in typings, allowed return types for that method are only `Rule` | `undefined`

### Before
<img width="1623" alt="Screenshot 2022-06-08 at 11 49 31" src="https://user-images.githubusercontent.com/92328789/172598751-a8e85d66-d439-40a7-8b65-652c87373c07.png">

### After
<img width="1613" alt="Screenshot 2022-06-08 at 11 48 59" src="https://user-images.githubusercontent.com/92328789/172598768-d25b53c6-9deb-47d7-aff6-83bd66335fb3.png">

### Checklist

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
kibanamachine pushed a commit that referenced this issue Jun 8, 2022
@vitaliidm
[Security Solution][Detection rules] fixes ungraceful failure when ru…
5aafb1e 
…le details page opened on non-existent rule #133867

## Summary
fixes #124355

In this PR, when results of fallback alerts search are empty, we return `undefined` for rule, instead of `{}` in helper method `transformRuleFromAlertHit`.
Returning `{}` caused break in typings, allowed return types for that method are only `Rule` | `undefined`

### Before
<img width="1623" alt="Screenshot 2022-06-08 at 11 49 31" src="https://user-images.githubusercontent.com/92328789/172598751-a8e85d66-d439-40a7-8b65-652c87373c07.png">

### After
<img width="1613" alt="Screenshot 2022-06-08 at 11 48 59" src="https://user-images.githubusercontent.com/92328789/172598768-d25b53c6-9deb-47d7-aff6-83bd66335fb3.png">

### Checklist

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

(cherry picked from commit 1fd9a76)
@banderror banderror reopened this Jun 8, 2022
@banderror banderror linked a pull request Jun 8, 2022 that will close this issue
[8.3] [Security Solution][Detection rules] fixes ungraceful failure when rule details page opened on non-existent rule #133867 #133942
Merged
@banderror banderror added the fixed label Jun 8, 2022
@banderror
Copy link
Contributor

@deepikakeshav-qasource @karanbirsingh-qasource @manishgupta-qasource could you please validate that this bug has been fixed? The fix should be available in the next 8.3.0 BC.

kibanamachine added a commit that referenced this issue Jun 8, 2022
@kibanamachine @vitaliidm
[Security Solution][Detection rules] fixes ungraceful failure when ru…
b8a1413 
…le details page opened on non-existent rule #133867 (#133942)

## Summary
fixes #124355

In this PR, when results of fallback alerts search are empty, we return `undefined` for rule, instead of `{}` in helper method `transformRuleFromAlertHit`.
Returning `{}` caused break in typings, allowed return types for that method are only `Rule` | `undefined`

### Before
<img width="1623" alt="Screenshot 2022-06-08 at 11 49 31" src="https://user-images.githubusercontent.com/92328789/172598751-a8e85d66-d439-40a7-8b65-652c87373c07.png">

### After
<img width="1613" alt="Screenshot 2022-06-08 at 11 48 59" src="https://user-images.githubusercontent.com/92328789/172598768-d25b53c6-9deb-47d7-aff6-83bd66335fb3.png">

### Checklist

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

(cherry picked from commit 1fd9a76)

Co-authored-by: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com>
@ghost
Copy link

ghost commented Jun 13, 2022

Hi @banderror

we have validated this issue on 8.3.0 BC3 and found the issue to be not fixed ❌ . please find the observations below:

Build details:

Version:8.3.0-BC3
Commit:7a0df2bca36ced2a898420cbb193a9dba0782a7a
Build:53272

Steps:

  • Create Build 1
  • Generated Alert from Rule
  • Attached Alert to case
  • Exported above case from SO
  • Create new build where the alert and the rule does not exist
  • Import the case and checked the navigation , it breaks and red banner got shown to user

Screen-Cast:

Elastic.Mozilla.Firefox.2022-06-13.13-06-06.mp4

@banderror
Copy link
Contributor

@karanbirsingh-qasource It should be available in BC4. It's scheduled for tomorrow June 14th (https://github.com/elastic/dev/issues/2022). Thanks!

@ghost
Copy link

ghost commented Jun 15, 2022

Hi @banderror

We have validated above issue on 8.3.0 BC4 and observed that issue is Fixed. 🟢

Please find the below testing details

Build info:

Version : 8.3.0 BC4
Build : 53413
Commit : 875ea184462f73a04410981ac9eaf799db28b4f0

Screenshots/Screencast:

case.import.mp4

Hence, We are closing this issue and marking this as QA Validated.

Thanks!

@ghost ghost added the QA:Validated Issue has been validated by QA label Jun 15, 2022
@ghost ghost closed this as completed Jun 15, 2022
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@vitaliidm vitaliidm

Labels
8.3 candidate bug Fixes for quality problems that affect the customer experience Feature:Detection Rules Anything related to Security Solution's Detection Rules fixed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. QA:Validated Issue has been validated by QA Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.3.0
Projects
None yet
Milestone
No milestone
7 participants
@peluja1012 @spong @banderror @elasticmachine @MadameSheema @jonathan-buttner @vitaliidm