Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] ML jobs are missing on rule details/editing/update pages #202700

Open
Tracked by #201502
xcrzx opened this issue Dec 3, 2024 · 5 comments · May be fixed by #205483
Open
Tracked by #201502

[Security Solution] ML jobs are missing on rule details/editing/update pages #202700

xcrzx opened this issue Dec 3, 2024 · 5 comments · May be fixed by #205483
Assignees
Labels
8.18 candidate bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.18.0

Comments

@xcrzx
Copy link
Contributor

xcrzx commented Dec 3, 2024

PR: #205483

Summary

Some machine learning (ML) jobs are not displayed when viewing, editing, or updating rules.

Steps to Reproduce

  1. Open a rule, such as High Mean of RDP Session Duration, or another ML rule. From my observation, around 30-40% of ML rules appear to be affected by this issue.

Issue Details

In all affected cases:

  • The machine_learning_job_id is present in the rule configuration.
  • However, it is not displayed by the view or edit components.

Affected Components

Rule Details Page

Image

Rule Editing Page

Image

Rule Update Flyout (View Mode)

Image

Rule Update Flyout (Edit Mode)

Image

Note

From the component logic, it appears that we fetch a list of all security ML jobs. Next, we check if the rule's jobs are in that list. We then display only the jobs from the list.

@xcrzx xcrzx added bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team triage_needed labels Dec 3, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@approksiu
Copy link

This issue would occur for all the rules that reference uninstalled Advanced Analytics (ML) packages and use ML jobs from those.

@banderror
Copy link
Contributor

@xcrzx @approksiu The ML jobs UI component shouldn't reset its state to empty if it can't find a job in the list. This should only be done by the user explicitly. I think we should try to fix this within Milestone 3, but the priority is lower than fixing issues that are not field-specific.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
8.18 candidate bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.18.0
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants