Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution]Refresh every parameter can be set in negative under Rule Execution Log #129332

Closed
ghost opened this issue Apr 4, 2022 · 8 comments · Fixed by #129003 or #129518
Closed

[Security Solution]Refresh every parameter can be set in negative under Rule Execution Log #129332

ghost opened this issue Apr 4, 2022 · 8 comments · Fixed by #129003 or #129518
Assignees
@spong @banderror
Labels
bug Fixes for quality problems that affect the customer experience Feature:Rule Monitoring Security Solution Detection Rule Monitoring area fixed QA:Validated Issue has been validated by QA Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.2.0

Comments

@ghost
Copy link

ghost commented Apr 4, 2022

Describe the bug
Refresh every parameter can be set in negative under Rule Execution Log

Build Details

Version:8.2.0-BC1
Commit : d18a093a2cf03991b93ea3de6a1054d580d3e82f
Build:51685

Preconditions

  • Any Rule with generated alert should exist on the build

Steps

  • Login to Kibana

  • Navigate to Rule Execution Tab of the Precondition rule

  • Click on Calendar icon

  • Enable Refresh Every parameter with positive number let say 2 second

  • Now add minus in front of 2 or use the arrow button to go negative index

  • re-enable the toggle

  • Observed that refresh every is working under rule execution for negative number

  • This issue is also occuring on other page of security like alert,host and network page got unresponsive

Screen-Cast

  • Rule Execution log
Rules.-.Kibana.Mozilla.Firefox.2022-04-04.16-56-30.mp4
Rules.-.Kibana.Mozilla.Firefox.2022-04-04.16-55-53.mp4
@ghost ghost added bug Fixes for quality problems that affect the customer experience triage_needed Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. labels Apr 4, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@manishgupta-qasource
Copy link

Reviewed & assigned to @MadameSheema

@MadameSheema MadameSheema added Team:Detections and Resp Security Detection Response Team Team:Detection Rule Management Security Detection Rule Management Team labels Apr 4, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@MadameSheema MadameSheema assigned spong and banderror and unassigned MadameSheema Apr 4, 2022
@spong
Copy link
Member

spong commented Apr 4, 2022

This issue is also occuring on other page of security like alert,host and network page got unresponsive

We'll likely want to address this in the reusable refresh/date component we're using so it's fixed everywhere, but for the Rule Execution log I'll look to setting a lower bound (was going to make it 1min based on team feedback) and address in #129003.

@peluja1012 peluja1012 added the Feature:Rule Monitoring Security Solution Detection Rule Monitoring area label Apr 4, 2022
@spong spong mentioned this issue Apr 5, 2022
Merged
12 tasks
spong added a commit that referenced this issue Apr 5, 2022
@spong
[Security Solution][Detections] Rule Execution Log Feedback and Fixes (…
bc413c6 
…#129003)

## Summary

Addresses feedback and fixes identified in #126215

Feedback addressed includes:
* Adds route validation via io-ts decode and schema tests
* Fixed styling of max execution events error by wrapping text (#129321)
* Fixed types within `view alerts for execution` action onClick
* Caps auto-refresh minimum to `1min` (#129332)
* Adds cardinality aggs to initial `execution_uuid` query to properly report total counts when filtering by status
* Disabled `View Alerts from Execution` action as current UX was too cumbersome with erasing users existing filters

---
Additional follow-ups for another PR:
- [ ] UI Unit tests
- [ ] Finalize API Integration tests for gap remediation events
- [ ] Persist table state (DatePicker/StatusFilter/SortField/SortOrder/Pagination) when navigating to other tabs on the same page
- [ ] Update global DatePicker to daterange of execution for `view alerts for execution` action (and clear all other filters)
- [ ] Support `disabled rule` platform error #126215 (comment)
- [ ] Verify StatusFilter issue #126215 (comment)

---
### Checklist

Delete any items that are not applicable to this PR.

- [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
- [X] Any UI touched in this PR is usable by keyboard only (learn more about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [X] This renders correctly on smaller devices using a responsive layout. (You can test this [in your browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
kibanamachine pushed a commit that referenced this issue Apr 5, 2022
@spong
[Security Solution][Detections] Rule Execution Log Feedback and Fixes (…
89e700a 
…#129003)

## Summary

Addresses feedback and fixes identified in #126215

Feedback addressed includes:
* Adds route validation via io-ts decode and schema tests
* Fixed styling of max execution events error by wrapping text (#129321)
* Fixed types within `view alerts for execution` action onClick
* Caps auto-refresh minimum to `1min` (#129332)
* Adds cardinality aggs to initial `execution_uuid` query to properly report total counts when filtering by status
* Disabled `View Alerts from Execution` action as current UX was too cumbersome with erasing users existing filters

---
Additional follow-ups for another PR:
- [ ] UI Unit tests
- [ ] Finalize API Integration tests for gap remediation events
- [ ] Persist table state (DatePicker/StatusFilter/SortField/SortOrder/Pagination) when navigating to other tabs on the same page
- [ ] Update global DatePicker to daterange of execution for `view alerts for execution` action (and clear all other filters)
- [ ] Support `disabled rule` platform error #126215 (comment)
- [ ] Verify StatusFilter issue #126215 (comment)

---
### Checklist

Delete any items that are not applicable to this PR.

- [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
- [X] Any UI touched in this PR is usable by keyboard only (learn more about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [X] This renders correctly on smaller devices using a responsive layout. (You can test this [in your browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))

(cherry picked from commit bc413c6)
kibanamachine added a commit that referenced this issue Apr 5, 2022
@kibanamachine @spong
[Security Solution][Detections] Rule Execution Log Feedback and Fixes (…
20fee3a 
…#129003) (#129518)

## Summary

Addresses feedback and fixes identified in #126215

Feedback addressed includes:
* Adds route validation via io-ts decode and schema tests
* Fixed styling of max execution events error by wrapping text (#129321)
* Fixed types within `view alerts for execution` action onClick
* Caps auto-refresh minimum to `1min` (#129332)
* Adds cardinality aggs to initial `execution_uuid` query to properly report total counts when filtering by status
* Disabled `View Alerts from Execution` action as current UX was too cumbersome with erasing users existing filters

---
Additional follow-ups for another PR:
- [ ] UI Unit tests
- [ ] Finalize API Integration tests for gap remediation events
- [ ] Persist table state (DatePicker/StatusFilter/SortField/SortOrder/Pagination) when navigating to other tabs on the same page
- [ ] Update global DatePicker to daterange of execution for `view alerts for execution` action (and clear all other filters)
- [ ] Support `disabled rule` platform error #126215 (comment)
- [ ] Verify StatusFilter issue #126215 (comment)

---
### Checklist

Delete any items that are not applicable to this PR.

- [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
- [X] Any UI touched in this PR is usable by keyboard only (learn more about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [X] This renders correctly on smaller devices using a responsive layout. (You can test this [in your browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))

(cherry picked from commit bc413c6)

Co-authored-by: Garrett Spong <spong@users.noreply.github.com>
@spong
Copy link
Member

spong commented Apr 5, 2022

#129003 is merged, so this'll now be fixed for the Rule Execution Log SuperDatePicker in 8.2-BC2. Note, there's not much control on our end for specifying the units within the SuperDatePicker's refresh options (will need to open an EUI issue or check with them), so I just forced any value under 60000ms to be 60000ms, which is what we wanted the minimum refresh value to be anyway. The main UI works fine with this and will display 1m when the refresh value is anything under 60s, which seemed reasonable given the options.

May want to open a separate issue to track the other two touchpoints, as I'm not if we'll want to fix those the same way, or wait for more configuration options from the EUI side?

This was linked to pull requests Apr 5, 2022
[Security Solution][Detections] Rule Execution Log Feedback and Fixes #129003
Merged
[8.2] [Security Solution][Detections] Rule Execution Log Feedback and Fixes (#129003) #129518
Merged
@MadameSheema
Copy link
Member

@karanbirsingh-qasource can you please follow @spong instructions and open a separate ticket?? Thanks!! ^^

@ghost
Copy link
Author

ghost commented Apr 7, 2022 •
edited by ghost
Loading

separate issue logged #129697 as per the request @spong

@ghost
Copy link
Author

ghost commented Apr 7, 2022

Hi @machadoum

we have validated this issue on 8.2.0 BC2 and found it fixed .

Build Details:

Version:8.2.0-BC2
Commit:3535a206838845689639344afaf64a58c663b3c1
Build:51772

Screen-Cast

Rules.-.Kibana.Mozilla.Firefox.2022-04-07.14-12-05.mp4

Hence we are closing this issue and adding "QA:Validated" label to it.

thanks !!

@MadameSheema

@ghost ghost closed this as completed Apr 7, 2022
@ghost ghost added the QA:Validated Issue has been validated by QA label Apr 7, 2022
@banderror banderror mentioned this issue Apr 20, 2022
Closed
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@spong spong

@banderror banderror

Labels
bug Fixes for quality problems that affect the customer experience Feature:Rule Monitoring Security Solution Detection Rule Monitoring area fixed QA:Validated Issue has been validated by QA Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.2.0
Projects
None yet
Milestone
No milestone
6 participants
@peluja1012 @spong @banderror @elasticmachine @MadameSheema @manishgupta-qasource