Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Make Rule Execution Errors more user friendly and actionable #128340

Open
Tracked by #165878
spong opened this issue Mar 23, 2022 · 5 comments
Open
Tracked by #165878

[Security Solution] Make Rule Execution Errors more user friendly and actionable #128340

spong opened this issue Mar 23, 2022 · 5 comments
Labels
consider-next enhancement New value added to drive a business result Feature:Detection Rules Security Solution rules and Detection Engine Feature:Rule Monitoring Security Solution Detection Rule Monitoring area Team:Detection Engine Security Solution Detection Engine Area Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.

Comments

@spong
Copy link
Member

spong commented Mar 23, 2022

We do a pretty good job surfacing the many different types of errors that may occur during rule execution, however often these errors are quite lengthy and require a bit of deciphering on the user's part. This issue is for providing more friendly and actionable rule execution errors, perhaps by introducing dedicated error_code's that can be referenced in documentation, UI, telemetry, etc.

Most recent discuss post where this was raised:

https://discuss.elastic.co/t/elastic-security-rule-exception/300273
@spong spong added triage_needed enhancement New value added to drive a business result Feature:Detection Rules Security Solution rules and Detection Engine Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Feature:Rule Monitoring Security Solution Detection Rule Monitoring area Team:Detection Rule Management Security Detection Rule Management Team Team:Detection Alerts Security Detection Alerts Area Team labels Mar 23, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@spong spong mentioned this issue Mar 24, 2022
Open
@banderror
Copy link
Contributor

banderror commented Mar 24, 2022 •
edited
Loading

Added it to several backlogs. cc @jethr0null @peluja1012 for visibility.

I think it's a great idea but it could take a lot of effort to figure out and formalize all the possible (or at least typical/well-known) errors. Sounds like an epic maybe?

If we want to address this, maybe we could first try to figure out a better way of showing this particular error from the description. Also, it would be useful to collect other not-so-clear warnings and errors we show.

@spong
Copy link
Member Author

spong commented Apr 18, 2022

With regards to ML Rule failures, we should surface the underlying job/datafeed error(s) as the current job missing/not running error is not helpful in guiding the user to the ML App to determine why their ML Jobs are not operational. We should also include a link to (and expand) the ML Rule Troubleshooting documentation to aid in the user resolving these issues on their own.

@banderror banderror changed the title [Security Solution][Detections] Make Rule Execution Errors more user friendly and actionable [Security Solution] Make Rule Execution Errors more user friendly and actionable Nov 24, 2022
@spong spong mentioned this issue Jan 31, 2023
Merged
3 tasks
@yctercero yctercero added Team:Detection Engine Security Solution Detection Engine Area and removed Team:Detection Alerts Security Detection Alerts Area Team labels May 13, 2023
@yctercero yctercero mentioned this issue Sep 6, 2023
Closed
@spong
Copy link
Member Author

spong commented Sep 22, 2023

Another option here is bringing in our robot reinforcements... 😀 Thanks for #166778 @dhurley14!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
consider-next enhancement New value added to drive a business result Feature:Detection Rules Security Solution rules and Detection Engine Feature:Rule Monitoring Security Solution Detection Rule Monitoring area Team:Detection Engine Security Solution Detection Engine Area Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@spong @banderror @yctercero @elasticmachine