Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SIEM] Signal's rule name is not showing properly on signals table #65764

Closed
cnasikas opened this issue May 7, 2020 · 3 comments
Closed

[SIEM] Signal's rule name is not showing properly on signals table #65764

cnasikas opened this issue May 7, 2020 · 3 comments
Assignees
Labels
bug Fixes for quality problems that affect the customer experience fixed Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM Team:Threat Hunting Security Solution Threat Hunting Team

Comments

@cnasikas
Copy link
Member

cnasikas commented May 7, 2020

Kibana version:
7.6.1

Elasticsearch version:
7.6.1

Server OS version:

Browser version:
Chrome 81.0.4044.129

Browser OS version:
macOS Catalina 10.15.4

Original install method (e.g. download page, yum, from source, etc.):
Elastic Cloud

Describe the bug:
The name of the signal's rule (signals.rule.name) is not showing on the expanded (detailed) table of the signal. JSON View shows the name correctly.

Steps to reproduce:

  1. Go to SIEM -> Detections -> Signals (Table at the bottom of the page).
  2. Click the arrow at the left of the timestamp.
  3. Go to the signals.rule.name. The value of the fields is - where it should be the name of the rule.

Expected behavior:
It should show the name of the rule correctly.

Screenshots (if relevant):
bug3

bug1

bug2

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context:
I reproduce the bug on master.

@elasticmachine
Copy link
Contributor

Pinging @elastic/siem (Team:SIEM)

@yctercero
Copy link
Contributor

It appears to be a bug in x-pack/plugins/siem/public/components/timeline/body/renderers/formatted_field_helpers.tsx. The function renderRuleName is checking for linkValue to exist for it to render the name value. However, linkValue is never being passed through to it in that view (see x-pack/plugins/siem/public/components/event_details/columns.tsx line 176).

@FrankHassanabad FrankHassanabad added the bug Fixes for quality problems that affect the customer experience label May 7, 2020
@jberry777
Copy link

jberry777 commented Jul 24, 2020

I'm also experiencing this issue. Native signals generated by Elasticsearch detection rules seem to have their signal.rule.name values show up in the table but for the signals we directly write to the .siem-signals-* index, those signal.rule.name values do not render in the table. (To be clear, the events render in the table, but the signal.rule.name value does not.)

@spong spong added the Feature:Detection Rules Anything related to Security Solution's Detection Rules label Jul 24, 2020
@MadameSheema MadameSheema added Team:Detections and Resp Security Detection Response Team Team:Threat Hunting Security Solution Threat Hunting Team and removed Feature:Detection Rules Anything related to Security Solution's Detection Rules Team:Detections and Resp Security Detection Response Team labels Oct 1, 2020
@XavierM XavierM added the fixed label Oct 13, 2020
@MindyRS MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Oct 27, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience fixed Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM Team:Threat Hunting Security Solution Threat Hunting Team
Projects
None yet
Development

No branches or pull requests

9 participants