Alerts and security solutions rules with spaces have validation issues #76035
Labels
bug
Fixes for quality problems that affect the customer experience
Team:ResponseOps
Label for the ResponseOps team (formerly the Cases and Alerting teams)
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Team:SIEM
Kibana version:
7.9.0
Both alerting and security solution alerts cannot have trailing spaces in their names or you end up not being able to create the rules. For existing rules/alerts that already have trailing spaces, those alerts cannot be modified, disabled, enabled, without errors being thrown.
This has to do with recent changes in a few areas involving ES API names:
#71623
#71620
#71558
elastic/elasticsearch#58156
However, a lot of code paths flow through:
https://github.com/elastic/kibana/blob/master/x-pack/plugins/security/server/authentication/api_keys.ts#L210
And not just the alerting framework fwiw, so we might consider changing things and truncating/throwing errors within the bottom most layer rather than fixing it within the solution layers? Or... It's up to each solutions team and people built on the alerting framework to fix this locally by doing a
trim()
on their strings and continue letting the errors bubble up stricter API key validation changes.The nature of the fix depends on if the API key generator not allowing trailing and leading spaces is the correct validation for it within ES or not. If that is the correct new validation to not allow leading or trailing spaces, then any code in the Kibana stack and else where should be doing a
trimRight()
and/ortrim()
if it is creating an API key with customer data driven values to avoid these blowups since we already have alerts and security rules with trailing spaces and the alerting framework uses the names as part of the key generation process.It's subjective where in the stack this type of fix should be such as here:
https://github.com/elastic/kibana/blob/master/x-pack/plugins/security/server/authentication/api_keys.ts
Or more upstream such as here in the alerting solution with a
trimRight()
on the alert name:https://github.com/elastic/kibana/blob/master/x-pack/plugins/alerts/server/alerts_client.ts#L943
So far it looks like the solutions themselves are to manage this new validation change.
Steps to reproduce:
Go to alerting and make an alert with a trailing spaces like so. You can't see the trailing spaces in the UI below but really it should have something like, "dfdf ":
And then when you hit save you get the error message:
If you do the same with security detection rules by creating a rule with a trailing space or already have an existing one with trailing spaces that you try to enable/disable in the name then you get errors like so:
Stack traces are:
Expected behavior:
No errors for rules/alerts that have trailing spaces already
The text was updated successfully, but these errors were encountered: