[Detections][Security Solution] Values are not populated on exceptions dialog

[MadameSheema]

Describe the bug:

• Values are not populated on exceptions dialog

Kibana/Elasticsearch Stack version:
7.14.0 - BC1

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

• Detections
• Exceptions

Steps to reproduce:

1. Create a rule
2. Generate alerts for that rule
3. Open the add exception dialog

Current behavior:

• The value list is not populated

Expected behavior:

• The value list should be populated

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[MadameSheema]

@peluja1012 @spong can you please help to prioritise this bug? for me is critical/high.

@deepikakeshav-qasource @mandeepkaur-qasource please take into consideration this during your testing.

Thanks :)

[spong]

++ @MadameSheema, this is critical/high and will need to be addressed for 7.14.

[MadameSheema]

Thanks @spong!

@MikePaquette this issue was listed in your ticket: elastic/security-team#1412 and has been raised to Critical. Thanks :)

[spong]

In reviewing #104559 (review), a stack trace was identified coming from the auto-complete service, and seemingly related to #100174, so will want to cross-check the changes there with this issue is well.

[MikePaquette]

Here's a bit more information:
There seems to be a difference in behavior, based on the rule type.

I just tried three cases:

1. custom rule - exception field autocomplete OK - value autocomplete NG
2. prebuilt rule - exception field autocomplete OK - value autocomplete OK
3. endpoint rule - exception field autocomplete NG

cc: @FrankHassanabad

[MadameSheema]

@deepikakeshav-qasource can you please try to reproduce the issue on BC2? Thanks! :)

[ghost]

Hi @MadameSheema ,

We have validated this ticket on 7.14.0 BC2 build and observed that issue is Not occurring. Values are populated on Rule exception for both in custom rule as well as elastic rule.

Build Details:

VERSION: 7.14.0 BC2
BUILD: 42401
COMMIT: 9826a943dc2e47f26ec6de94816e7d297b752994
ARTIFACT: https://staging.elastic.co/7.14.0-e99135ef/summary-7.14.0.html

Screenshot:
Custom Rule
https://user-images.githubusercontent.com/61860752/125057942-61de3b80-e0c7-11eb-8af5-2e650ff49a9e.mp4

Elastic Rule:

Malware_exception.mp4

Please let us know if anything else is required from our end

Thanks!!

[FrankHassanabad]

I have also validated this for BC2, but to leave a note here, this issue was due to problems with autocomplete and a newer algorithm called terms_enum being used. So all of auto complete across the application was malfunctioning.

As of BC2, you still can see autocomplete malfunctioning with one usecase which is if you use logs-* it will give errors in the network panel since logs-* adds this extra string, logs-*,*-elasticlcoud-logs-*

However, they fixed that here and it should be ready by BC3:
elastic/elasticsearch#75155

And Kibana has a ticket opened to bubble up the error rather than a 500 internal server error so we can get more information from here:
#104974

That is a work in progress but hopefully makes it by the next BC.

[FrankHassanabad]

Another open issue for the terms_enum fyi:
elastic/elasticsearch#75190

which auto-complete has changed its algorithm to

[ghost]

Hi @FrankHassanabad ,

We have validated this on 7.14.0 BC2 build and We are able to reproduce this issue. Error is displaying in dev tool network.

Build Details:

VERSION: 7.14.0 BC2
BUILD: 42401
COMMIT: 9826a943dc2e47f26ec6de94816e7d297b752994
ARTIFACT: https://staging.elastic.co/7.14.0-e99135ef/summary-7.14.0.html

Screenshot:

Thanks!!

cc: @MadameSheema

[FrankHassanabad]

Thanks, let's wait for BC3 and see if it's fixed there. I expect this part to still be broken BC2 but fixed BC3 🤞 as the issue is further down the stack from the security solutions team and within ElasticSearch.

[MadameSheema]

@deepikakeshav-qasource can you please validate this issue on BC3? Thanks

[ghost]

Hi @MadameSheema,

We have validated this ticket on 7.14.0 BC3 build and observed that issue is Fixed. Please find the our below observations:

Build Details:

VERSION: 7.14.0 BC3
BUILD: 42545
COMMIT: c314921a9893e0b46d9a3958f5520e3d6b1ce7d5
ARTIFACT: https://staging.elastic.co/7.14.0-682a8012/summary-7.14.0.html

Observation 1: No error is displaying in dev tool network when enter the query in search under host tab.

Screen Recording:

host_network_error.mp4

Observation 2: Values are populated on Rule exception.

Screenshot:

Please let us know if we are missing anything and anything else is required from our end.

Thanks!!

[ghost]

Bug Conversion:

01 Test-Case updated

• C22490