[Bug] [Osquery] Policy search in Osquery Live Queries is restricted to top 10 Policies #166268
Assignees
Labels
bug
Fixes for quality problems that affect the customer experience
OLM Sprint
QA:Validated
Issue has been validated by QA
Team:Defend Workflows
“EDR Workflows” sub-team of Security Solution
Comments
kevinlog
added
bug
|
Pinging @elastic/security-defend-workflows (Team:Defend Workflows) |
szwarckonrad
added a commit
that referenced
this issue
Sep 21, 2023
#166268 closes elastic/security-team#7676 Aggregations that return policy list that is being used for looking up search term defaults to 10 results when no `size` param passed. At this point size is set to `2000`. Before https://github.com/elastic/kibana/assets/29123534/7571378e-e1e9-4aa9-a179-e17fe50c502e After https://github.com/elastic/kibana/assets/29123534/56a395e1-f9a9-4cf9-90f8-07d4758b8136 Added callout informing user that no agents are available, copy provided here - elastic/security-team#7676 
|
Merged with |
gergoabraham
pushed a commit
to gergoabraham/kibana
that referenced
this issue
Sep 21, 2023
) elastic#166268 closes elastic/security-team#7676 Aggregations that return policy list that is being used for looking up search term defaults to 10 results when no `size` param passed. At this point size is set to `2000`. Before https://github.com/elastic/kibana/assets/29123534/7571378e-e1e9-4aa9-a179-e17fe50c502e After https://github.com/elastic/kibana/assets/29123534/56a395e1-f9a9-4cf9-90f8-07d4758b8136 Added callout informing user that no agents are available, copy provided here - elastic/security-team#7676 
|
8.10 Backport creation failed, awaiting #167024 to unblock CI |
szwarckonrad
added a commit
that referenced
this issue
Sep 27, 2023
) (#166926) # Backport This will backport the following commits from `main` to `8.10`: - [[Defend Workflows][Osquery] New live query policy lookup (#166615)](#166615) <!--- Backport version: 8.9.8 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Konrad Szwarc","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-09-21T10:47:14Z","message":"[Defend Workflows][Osquery] New live query policy lookup (#166615)\n\nhttps://github.com//issues/166268\r\n\r\ncloses https://github.com/elastic/security-team/issues/7676\r\n\r\nAggregations that return policy list that is being used for looking up\r\nsearch term defaults to 10 results when no `size` param passed. At this\r\npoint size is set to `2000`.\r\n\r\nBefore\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/29123534/7571378e-e1e9-4aa9-a179-e17fe50c502e\r\n\r\nAfter \r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/29123534/56a395e1-f9a9-4cf9-90f8-07d4758b8136\r\n\r\n\r\nAdded callout informing user that no agents are available, copy provided\r\nhere - https://github.com/elastic/security-team/issues/7676\r\n\r\n","sha":"f50edde37e4fd4603c5b118dd9f395b8675cd7bc","branchLabelMapping":{"^v8.11.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","Team:Defend Workflows","Osquery","v8.11.0","v8.10.3"],"number":166615,"url":"https://github.com/elastic/kibana/pull/166615","mergeCommit":{"message":"[Defend Workflows][Osquery] New live query policy lookup (#166615)\n\nhttps://github.com//issues/166268\r\n\r\ncloses https://github.com/elastic/security-team/issues/7676\r\n\r\nAggregations that return policy list that is being used for looking up\r\nsearch term defaults to 10 results when no `size` param passed. At this\r\npoint size is set to `2000`.\r\n\r\nBefore\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/29123534/7571378e-e1e9-4aa9-a179-e17fe50c502e\r\n\r\nAfter \r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/29123534/56a395e1-f9a9-4cf9-90f8-07d4758b8136\r\n\r\n\r\nAdded callout informing user that no agents are available, copy provided\r\nhere - https://github.com/elastic/security-team/issues/7676\r\n\r\n","sha":"f50edde37e4fd4603c5b118dd9f395b8675cd7bc"}},"sourceBranch":"main","suggestedTargetBranches":["8.10"],"targetPullRequestStates":[{"branch":"main","label":"v8.11.0","labelRegex":"^v8.11.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/166615","number":166615,"mergeCommit":{"message":"[Defend Workflows][Osquery] New live query policy lookup (#166615)\n\nhttps://github.com//issues/166268\r\n\r\ncloses https://github.com/elastic/security-team/issues/7676\r\n\r\nAggregations that return policy list that is being used for looking up\r\nsearch term defaults to 10 results when no `size` param passed. At this\r\npoint size is set to `2000`.\r\n\r\nBefore\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/29123534/7571378e-e1e9-4aa9-a179-e17fe50c502e\r\n\r\nAfter \r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/29123534/56a395e1-f9a9-4cf9-90f8-07d4758b8136\r\n\r\n\r\nAdded callout informing user that no agents are available, copy provided\r\nhere - https://github.com/elastic/security-team/issues/7676\r\n\r\n","sha":"f50edde37e4fd4603c5b118dd9f395b8675cd7bc"}},{"branch":"8.10","label":"v8.10.3","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Kibana Machine <[email protected]>
|
Backported, ready to be verified. |
szwarckonrad
added
the
QA:Ready for Testing
|
Thanks for the update. We have tested this issue on latest Kibana v8.13.0 and found that issue is now fixed. Please find the below observationsBuild DetailsObservations
New.-.Live.queries.-.Osquery.-.Elastic.-.Google.Chrome.2024-02-28.13-18-24.mp4Hence, we are closing this ticket as QA Approved. Thanks. |
arvindersingh-qasource
added
QA:Validated
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Kibana version:
8.10 and below, presumably
Describe the bug:
In Osquery Live queries, in the Agent selection dropdown, we are unable to search beyond the top 10 Agent Policies by Agent count. The dropdown will initially show 10 Policies. If we try to search for an 11th Agent Policy by typing a part of the name in the dropdown, we will be unable to find it.
Steps to reproduce:
Expected behavior:
Using the string search in the Live Query component, we should be able to find any Policy with the Osquery Management integration and Agents assigned to it.
Screenshots (if relevant):
Any additional context:
It seems we addressed this issue partially with this PR: #151315
But we need to revisit.
The text was updated successfully, but these errors were encountered: