[Security Solution] Able to create a rule by adding only a filter without adding any query

[ghost]

Describe the bug
Able to create a rule by adding only a filter without adding any query

Build info

VERSION : 8.4.0 BC5
BUILD: 55374
COMMIT: f12954223a8ad66bbbf77becc4f0557ffd1c92c3

Preconditions

1. Kibana should be running

Steps to Reproduce

1. Navigate to security > Rules page
2. Click on create a new rule
3. Add any filter, but does not add any query
4. Observe that preview result buttin is disable
5. Now create the rule and observe that rule is created without any query

Actual Result
Able to create a rule by adding only a filter without adding any query

Expected Result
User should not be able to create the rule without adding any query
Or
Preview button should be enable if user is able to create a rule by adding only a filter without adding any query

Screen-cast

rule.with.filter.mp4

rule.zip

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[banderror]

@deepikakeshav-qasource I think this behavior is expected and correct. If the user specifies at least one filter, it will be used to build the final rule's query when the rule runs, so that query in the UI can be left empty. Query in the UI must be specified only if the user doesn't add any filters.

@peluja1012 please correct me if I'm wrong.

[ghost]

Hi @banderror,

Thank you for sharing details!!

If this is expected, Then we can enable the preview results button as well if user is able to create a rule by adding only a filter without adding any query!!

Thank you!!

[banderror]

Then we can enable the preview results button as well if user is able to create a rule by adding only a filter without adding any query!!

++ That makes sense to me @deepikakeshav-qasource 👍 May I ask you to please open a separate bug for that?

[ghost]

Hi @banderror ,

We have opened a separate bug for preview Results.

We are good to close this ticket as it is working as expected.

Please let us know if any other action is required on this ticket.

Thanks you!!

[banderror]

I'm going to double-check with @peluja1012 later today if we can close this one. Thank you!

[banderror]

Alright, we can close it.