Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Rule is created when the conditional logic "If alert matches a query" is left blank #159690

Merged

Conversation

e40pud
Copy link
Contributor

@e40pud e40pud commented Jun 14, 2023

Summary

Original ticket: #156706

These changes prevent user from creating/updating the rule when alert filter is selected and query left blank on the rule's action page. We gonna show an error saying "A custom query is required." in this case.

Screenshot 2023-06-14 at 14 36 35

@e40pud e40pud added release_note:fix Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team ci:cloud-deploy Create or update a Cloud deployment Team:Detection Engine Security Solution Detection Engine Area labels Jun 14, 2023
@e40pud e40pud requested a review from a team as a code owner June 14, 2023 12:40
@e40pud e40pud self-assigned this Jun 14, 2023
@e40pud e40pud requested a review from a team as a code owner June 14, 2023 12:40
@e40pud e40pud requested a review from dplumlee June 14, 2023 12:40
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

return setFieldErrors(null);
}
if (isSubmitted && !isSubmitting && isValid === false && field.errors.length) {
if (isValid === false) {
Copy link
Contributor Author

@e40pud e40pud Jun 14, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After recent changes we do not call form.submit() on rule creation, thus we cannot rely on isSubmitting and isSubmitted anymore here. Those two parameters will not be changed at all and we will not show error callout. Updated to only check whether isValid field of the form has been updated, which happens when user clicks create button.

cc @marshallmain

Copy link
Contributor

@banderror banderror left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rule Management changes LGTM 👍
I didn't test the PR though - would be nice if someone from the Detection Engine team could do it.

@banderror banderror removed the request for review from dplumlee June 19, 2023 09:39
@e40pud
Copy link
Contributor Author

e40pud commented Jun 21, 2023

@elasticmachine merge upstream

@e40pud
Copy link
Contributor Author

e40pud commented Jun 22, 2023

@elasticmachine merge upstream

@e40pud e40pud added the v8.9.0 label Jun 23, 2023
Copy link
Contributor

@Zacqary Zacqary left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Response Ops changes LGTM

@kibana-ci
Copy link
Collaborator

kibana-ci commented Jul 10, 2023

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id before after diff
triggersActionsUi 522 524 +2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 11.1MB 11.1MB +1.0B
triggersActionsUi 1.4MB 1.4MB -1.3KB
total -1.3KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
triggersActionsUi 86.8KB 88.0KB +1.1KB
Unknown metric groups

API count

id before after diff
triggersActionsUi 548 550 +2

ESLint disabled line counts

id before after diff
enterpriseSearch 14 16 +2
securitySolution 408 412 +4
total +6

Total ESLint disabled count

id before after diff
enterpriseSearch 15 17 +2
securitySolution 487 491 +4
total +6

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @e40pud

@e40pud e40pud added v8.9.1 and removed v8.9.0 labels Jul 11, 2023
@e40pud e40pud merged commit 9b6ad72 into elastic:main Jul 11, 2023
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jul 11, 2023
…ert matches a query" is left blank (elastic#159690)

## Summary

Original ticket: elastic#156706

These changes prevent user from creating/updating the rule when alert
filter is selected and query left blank on the rule's action page. We
gonna show an error saying "A custom query is required." in this case.

<img width="1739" alt="Screenshot 2023-06-14 at 14 36 35"
src="https://github.com/elastic/kibana/assets/2700761/0456f211-603c-44d9-9271-9cfdf59f12b6">

Co-authored-by: Kibana Machine <[email protected]>
(cherry picked from commit 9b6ad72)
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.9

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Jul 11, 2023
…"If alert matches a query" is left blank (#159690) (#161665)

# Backport

This will backport the following commits from `main` to `8.9`:
- [[Security Solution] Rule is created when the conditional logic "If
alert matches a query" is left blank
(#159690)](#159690)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Ievgen
Sorokopud","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-07-11T14:27:24Z","message":"[Security
Solution] Rule is created when the conditional logic \"If alert matches
a query\" is left blank (#159690)\n\n## Summary\r\n\r\nOriginal ticket:
https://github.com/elastic/kibana/issues/156706\r\n\r\nThese changes
prevent user from creating/updating the rule when alert\r\nfilter is
selected and query left blank on the rule's action page. We\r\ngonna
show an error saying \"A custom query is required.\" in this
case.\r\n\r\n<img width=\"1739\" alt=\"Screenshot 2023-06-14 at 14 36
35\"\r\nsrc=\"https://github.com/elastic/kibana/assets/2700761/0456f211-603c-44d9-9271-9cfdf59f12b6\">\r\n\r\nCo-authored-by:
Kibana Machine
<[email protected]>","sha":"9b6ad7280de61c0ed1471eda54b98a64d485b637","branchLabelMapping":{"^v8.10.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","ci:cloud-deploy","Team:Detection
Engine","v8.10.0","v8.9.1"],"number":159690,"url":"https://github.com/elastic/kibana/pull/159690","mergeCommit":{"message":"[Security
Solution] Rule is created when the conditional logic \"If alert matches
a query\" is left blank (#159690)\n\n## Summary\r\n\r\nOriginal ticket:
https://github.com/elastic/kibana/issues/156706\r\n\r\nThese changes
prevent user from creating/updating the rule when alert\r\nfilter is
selected and query left blank on the rule's action page. We\r\ngonna
show an error saying \"A custom query is required.\" in this
case.\r\n\r\n<img width=\"1739\" alt=\"Screenshot 2023-06-14 at 14 36
35\"\r\nsrc=\"https://github.com/elastic/kibana/assets/2700761/0456f211-603c-44d9-9271-9cfdf59f12b6\">\r\n\r\nCo-authored-by:
Kibana Machine
<[email protected]>","sha":"9b6ad7280de61c0ed1471eda54b98a64d485b637"}},"sourceBranch":"main","suggestedTargetBranches":["8.9"],"targetPullRequestStates":[{"branch":"main","label":"v8.10.0","labelRegex":"^v8.10.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/159690","number":159690,"mergeCommit":{"message":"[Security
Solution] Rule is created when the conditional logic \"If alert matches
a query\" is left blank (#159690)\n\n## Summary\r\n\r\nOriginal ticket:
https://github.com/elastic/kibana/issues/156706\r\n\r\nThese changes
prevent user from creating/updating the rule when alert\r\nfilter is
selected and query left blank on the rule's action page. We\r\ngonna
show an error saying \"A custom query is required.\" in this
case.\r\n\r\n<img width=\"1739\" alt=\"Screenshot 2023-06-14 at 14 36
35\"\r\nsrc=\"https://github.com/elastic/kibana/assets/2700761/0456f211-603c-44d9-9271-9cfdf59f12b6\">\r\n\r\nCo-authored-by:
Kibana Machine
<[email protected]>","sha":"9b6ad7280de61c0ed1471eda54b98a64d485b637"}},{"branch":"8.9","label":"v8.9.1","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Ievgen Sorokopud <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ci:cloud-deploy Create or update a Cloud deployment release_note:fix Team:Detection Engine Security Solution Detection Engine Area Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.9.0 v8.9.1 v8.10.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants