Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution]Failed to Fetch Rules and Timeline in Preview Flyout #146858

Closed
ghost opened this issue Dec 2, 2022 · 8 comments
Closed

[Security Solution]Failed to Fetch Rules and Timeline in Preview Flyout #146858

ghost opened this issue Dec 2, 2022 · 8 comments
Assignees
@e40pud
Labels
bug Fixes for quality problems that affect the customer experience fixed QA:Validated Issue has been validated by QA Team:Detection Alerts Security Detection Alerts Area Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.6.0

Comments

@ghost
Copy link

ghost commented Dec 2, 2022

Describe the bug
Failed to Fetch Rules and Timeline in Preview Flyout

Build Details:

Version: 8.6.0 BC4
Commit: 218162f282314db5b3833c84752dd24395949b3f
Build: 58612

Steps

  • Create the Rule
  • Fill in the required details
  • click on preview button
  • set the according time filter and hit enter
  • preview result will show in preview table
  • Open alert fly-out of any event and keep it open ( you have wait for some sec to see the error prompt so don't close the prompt )
  • Observed that Error "Failed to fetch Rules and Timelines 404" is Thrown

Screen-Shoot

image

image

image

Create.new.rule.-.Kibana.Mozilla.Firefox.2022-12-02.15-11-33.mp4

Error Prompt

{
  "name": "Error",
  "body": {
    "message": "id: \"b7d1c404-f9d2-4234-a9e0-d7b3be015ccd\" not found",
    "status_code": 404
  },
  "message": "Not Found",
  "stack": "o@https://025425e7122840899df633adc63d5e3b.europe-west1.gcp.cloud.es.io:9243/58612/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:366:17476\nt@https://025425e7122840899df633adc63d5e3b.europe-west1.gcp.cloud.es.io:9243/58612/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:366:16707\n__kbnSharedDeps_npm__</e.exports/<@https://025425e7122840899df633adc63d5e3b.europe-west1.gcp.cloud.es.io:9243/58612/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:366:13138\nn@https://025425e7122840899df633adc63d5e3b.europe-west1.gcp.cloud.es.io:9243/58612/bundles/core/core.entry.js:1:285049\ne/<@https://025425e7122840899df633adc63d5e3b.europe-west1.gcp.cloud.es.io:9243/58612/bundles/core/core.entry.js:1:291848\np@https://025425e7122840899df633adc63d5e3b.europe-west1.gcp.cloud.es.io:9243/58612/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:366:18451\nw/<@https://025425e7122840899df633adc63d5e3b.europe-west1.gcp.cloud.es.io:9243/58612/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:366:19807\nO/</<@https://025425e7122840899df633adc63d5e3b.europe-west1.gcp.cloud.es.io:9243/58612/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:366:18814\nn@https://025425e7122840899df633adc63d5e3b.europe-west1.gcp.cloud.es.io:9243/58612/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:334:590718\ns@https://025425e7122840899df633adc63d5e3b.europe-west1.gcp.cloud.es.io:9243/58612/bundles/kbn-ui-shared-deps-npm/kbn-ui-shared-deps-npm.dll.js:334:590930\n"
}
@ghost ghost added bug Fixes for quality problems that affect the customer experience triage_needed Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. labels Dec 2, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@ghost ghost assigned MadameSheema Dec 2, 2022
@MadameSheema MadameSheema added Team:Detections and Resp Security Detection Response Team Team:Detection Alerts Security Detection Alerts Area Team labels Dec 2, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@e40pud e40pud assigned e40pud and unassigned marshallmain Dec 2, 2022
e40pud added a commit to e40pud/kibana that referenced this issue Dec 2, 2022
@e40pud
[Security Solution] Failed to Fetch Rules and Timeline in Preview Fly…
0b9b6e7 
…out (elastic#146858)
@e40pud e40pud mentioned this issue Dec 2, 2022
Merged
e40pud added a commit that referenced this issue Dec 2, 2022
@e40pud
[Security Solution] Failed to Fetch Rules and Timeline in Preview Fly…
1b4c661 
…out (#146904)

## Summary

These changes fixes the issue with the unexpected "Failed to Fetch Rule"
error toast that appears when user opens the alert details from the Rule
Preview page.

The issue was introduced by [recent
refactoring](#142950) where we
switched from the optional toast to showing error toast always when it
is not possible to fetch the rule (see `useRuleWithFallback` hook). In
case of Rule Preview the rule does not exist and thus server returns 404
(not found) error. In case of Rule Preview we would like to ignore this
error and build the rule from the alert.

Bug Ticket: #146858
@spong
Copy link
Member

spong commented Dec 2, 2022

Note, this unnecessary error toast issue also exists when viewing the Rule Details page of a deleted Rule (e.g. clicking through to a deleted Rule from a historical alert). I've verified the fix provided as part of #146904 also resolves this issue as well 🎉

kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Dec 2, 2022
@e40pud
[Security Solution] Failed to Fetch Rules and Timeline in Preview Fly…
4e197cc 
…out (elastic#146904)

## Summary

These changes fixes the issue with the unexpected "Failed to Fetch Rule"
error toast that appears when user opens the alert details from the Rule
Preview page.

The issue was introduced by [recent
refactoring](elastic#142950) where we
switched from the optional toast to showing error toast always when it
is not possible to fetch the rule (see `useRuleWithFallback` hook). In
case of Rule Preview the rule does not exist and thus server returns 404
(not found) error. In case of Rule Preview we would like to ignore this
error and build the rule from the alert.

Bug Ticket: elastic#146858

(cherry picked from commit 1b4c661)
kibanamachine added a commit that referenced this issue Dec 2, 2022
@kibanamachine @e40pud
[8.6] [Security Solution] Failed to Fetch Rules and Timeline in Previ…
a3b8bc3 
…ew Flyout (#146904) (#146921)

# Backport

This will backport the following commits from `main` to `8.6`:
- [[Security Solution] Failed to Fetch Rules and Timeline in Preview
Flyout (#146904)](#146904)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Ievgen
Sorokopud","email":"[email protected]"},"sourceCommit":{"committedDate":"2022-12-02T20:17:54Z","message":"[Security
Solution] Failed to Fetch Rules and Timeline in Preview Flyout
(#146904)\n\n## Summary\r\n\r\nThese changes fixes the issue with the
unexpected \"Failed to Fetch Rule\"\r\nerror toast that appears when
user opens the alert details from the Rule\r\nPreview page.\r\n\r\nThe
issue was introduced by
[recent\r\nrefactoring](#142950)
where we\r\nswitched from the optional toast to showing error toast
always when it\r\nis not possible to fetch the rule (see
`useRuleWithFallback` hook). In\r\ncase of Rule Preview the rule does
not exist and thus server returns 404\r\n(not found) error. In case of
Rule Preview we would like to ignore this\r\nerror and build the rule
from the alert.\r\n\r\nBug Ticket:
#146858","sha":"1b4c66101b02dd4c01582a0e7b684eb5b499101a","branchLabelMapping":{"^v8.7.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:
SecuritySolution","Team:Detection Rules","Team:Detection
Alerts","backport:prev-minor","ci:cloud-deploy","v8.7.0"],"number":146904,"url":"https://github.com/elastic/kibana/pull/146904","mergeCommit":{"message":"[Security
Solution] Failed to Fetch Rules and Timeline in Preview Flyout
(#146904)\n\n## Summary\r\n\r\nThese changes fixes the issue with the
unexpected \"Failed to Fetch Rule\"\r\nerror toast that appears when
user opens the alert details from the Rule\r\nPreview page.\r\n\r\nThe
issue was introduced by
[recent\r\nrefactoring](#142950)
where we\r\nswitched from the optional toast to showing error toast
always when it\r\nis not possible to fetch the rule (see
`useRuleWithFallback` hook). In\r\ncase of Rule Preview the rule does
not exist and thus server returns 404\r\n(not found) error. In case of
Rule Preview we would like to ignore this\r\nerror and build the rule
from the alert.\r\n\r\nBug Ticket:
#146858","sha":"1b4c66101b02dd4c01582a0e7b684eb5b499101a"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v8.7.0","labelRegex":"^v8.7.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/146904","number":146904,"mergeCommit":{"message":"[Security
Solution] Failed to Fetch Rules and Timeline in Preview Flyout
(#146904)\n\n## Summary\r\n\r\nThese changes fixes the issue with the
unexpected \"Failed to Fetch Rule\"\r\nerror toast that appears when
user opens the alert details from the Rule\r\nPreview page.\r\n\r\nThe
issue was introduced by
[recent\r\nrefactoring](#142950)
where we\r\nswitched from the optional toast to showing error toast
always when it\r\nis not possible to fetch the rule (see
`useRuleWithFallback` hook). In\r\ncase of Rule Preview the rule does
not exist and thus server returns 404\r\n(not found) error. In case of
Rule Preview we would like to ignore this\r\nerror and build the rule
from the alert.\r\n\r\nBug Ticket:
#146858","sha":"1b4c66101b02dd4c01582a0e7b684eb5b499101a"}}]}]
BACKPORT-->

Co-authored-by: Ievgen Sorokopud <[email protected]>
@e40pud
Copy link
Contributor

e40pud commented Dec 3, 2022 •
edited
Loading

@MadameSheema @karanbirsingh-qasource This bug was fixed and changes were merged in both main and 8.6 branches.

@xcrzx
Copy link
Contributor

xcrzx commented Dec 5, 2022

Related issue: #145832

@xcrzx xcrzx mentioned this issue Dec 5, 2022
Closed
@ghost
Copy link
Author

ghost commented Dec 8, 2022

Hi @xcrzx and @e40pud

we have validated this issue on 8.6 BC 6 and below are the observations:

  • now we are not getting below error prompt on application on opening alert fly out from preview result table ✔️

image

  • However in network logs we are still getting GET 404 with id not found in response ❌

Build Details:

Version: 8.6.0 BC6
Commit:f329a77595950244361736dff7208a810299fd69
Build:58740

Screen-Cast:

Create.new.rule.-.Kibana.Mozilla.Firefox.2022-12-08.11-19-38.mp4

so can you please checkout the above screen capturing.

thanks !!

@xcrzx
Copy link
Contributor

xcrzx commented Dec 8, 2022

  • However in network logs we are still getting GET 404 with id not found in response ❌

Hi @karanbirsingh-qasource 👋 Thank you for validating the fix. 404 in the network tab is expected, as we don't have an easy way to prevent requests from being sent on the front-end side. We know about this limitation and will try to work out a better solution, but for now, the fix just prevented the error toast from appearing.

@ghost
Copy link
Author

ghost commented Dec 8, 2022

thanks @xcrzx for looking into and confirming the behavior . hence we are now good to close this issue.

@ghost ghost closed this as completed Dec 8, 2022
@ghost ghost added the QA:Validated Issue has been validated by QA label Dec 8, 2022
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@e40pud e40pud

Labels
bug Fixes for quality problems that affect the customer experience fixed QA:Validated Issue has been validated by QA Team:Detection Alerts Security Detection Alerts Area Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.6.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@xcrzx @e40pud @spong @elasticmachine @MadameSheema @marshallmain