SIEM "Additional look-back time" UI logic clobbers partial hours: e.g. 73 minutes becomes 1h in the UI #74767
Labels
bug
Fixes for quality problems that affect the customer experience
Feature:Detection Rules
Security Solution rules and Detection Engine
fixed
impact:medium
Addressing this issue will have a medium level of impact on the quality/strength of our product.
Team:Detections and Resp
Security Detection Response Team
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Team:SIEM
Kibana version: 7.8.0
Elasticsearch version: 7.8.0
Describe the bug:
If a detection rule sets an "Additional look-back time" using minutes or seconds to what equates to a fractional hour, the rule is persisted correctly, and the API returns the response correctly. However, that UI clobbers response, taking the floor of the fractional hour. So, 67 minutes gets displayed as
1h
, 139 minutes gets rendered as2h
. I think I've been able to track down the responsible UI code that clobbers it:If I read this right, a duration as seconds of greater than or equal to 60 will be set to:
which will round down to the nearest whole hour.
Steps to reproduce:
137 minutes
2h
displayed.Expected behavior: Either see the time in the original units entered, or as some fractional value of a larger order of magnitude unit.
The text was updated successfully, but these errors were encountered: