[Security Solution] Inconsistent Behavior When Saving Additional Look-Back Time

[pborgonovi]

Epic: #179907
Related to: #204317, #223446

Summary

Description:

When updating the Additional look-back time field in a prebuilt rule’s schedule settings, the system exhibits inconsistent behavior when saving the value depending on whether the input can be fully converted to minutes.
Same behavior is observed when creating/editing a custom rule.

Kibana/Elasticsearch Stack version:

VERSION: 9.0.0
BUILD: 82496
COMMIT: a90a9fc92a469656ba16ad54bd36b2375b386137

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Prebuilt Rules

Pre requisites:

1. prebuiltRulesCustomizationEnabled flag is enabled
2. Prebuilt rules are available

Steps to reproduce:

1. Open a prebuilt rule where the Schedule interval is set to “Runs every 5 minutes” and Additional look-back time is set to “4 minutes”.
2. Update the Runs every 5 minutes interval to:

• 300 seconds → Save works correctly, and the value is displayed as “300 seconds”.
• Any other valid time format (e.g. 10 minutes, 20 seconds, etc.) → Save works correctly, and the value is displayed as entered.

3. Update the Additional look-back time to:

• A value that cannot be fully converted to minutes (e.g. 350 seconds) → Save works correctly, but the value is saved and displayed as seconds.
• A value that can be fully converted to minutes (e.g. 360 seconds, which equals 6 minutes) → Save works, but the system automatically converts and displays the value in minutes instead of seconds.

Current behavior:

• If the Additional look-back time cannot be fully converted to minutes, it is saved and displayed as seconds.
• If the Additional look-back time can be fully converted to minutes, the system converts it and displays it as minutes, even if it was initially saved as seconds.

Expected behavior:

• The Additional look-back time should always be saved and displayed in the exact format entered by the user (seconds, minutes, or hours) without automatic conversion.
• Consistency should be maintained in how time values are displayed, ensuring that users see the format they selected during rule editing.

Screenshots

Screen.Recording.2025-01-13.at.11.22.20.AM.mov

Screen.Recording.2025-01-13.at.11.33.58.AM.mov

Screen.Recording.2025-01-13.at.11.34.47.AM.mov

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-engine (Team:Detection Engine)