Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution][Detections] Indicator Rules cannot be duplicated from the Rule Details page #90356

Closed
rylnd opened this issue Feb 4, 2021 · 4 comments · Fixed by #92565
Closed

[Security Solution][Detections] Indicator Rules cannot be duplicated from the Rule Details page #90356

rylnd opened this issue Feb 4, 2021 · 4 comments · Fixed by #92565
Assignees
@FrankHassanabad
Labels
bug Fixes for quality problems that affect the customer experience impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v7.12.0

Comments

@rylnd
Copy link
Contributor

rylnd commented Feb 4, 2021 •
edited
Loading

Summary

When attempting to duplicate an Indicator Match rule from that rule's Details page, the action fails and an error toast is displayed:

Initial toast:
69cc1500-663e-11eb-a93b-d39c7477f8ec_-_Kibana
Expanded toast:
69cc1500-663e-11eb-a93b-d39c7477f8ec_-_Kibana

Other notes:

  • The rule can be duplicated from the rules table on the main Detections page
  • This does not appear to affect 7.10; I have only been able to reproduce on 7.11 master/7.12.
@rylnd rylnd added bug Fixes for quality problems that affect the customer experience Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. labels Feb 4, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@FrankHassanabad FrankHassanabad self-assigned this Feb 5, 2021
@FrankHassanabad
Copy link
Contributor

This should only effect unreleased 7.12 at the moment and not soon to be released 7.11. The cause of this bug is from the fix here:
#89066

I just need to strip out the id when the rule is being duplicated and before it is sent to the backend and that will fix it.

@MindyRS MindyRS added the Team:Detections and Resp Security Detection Response Team label Feb 8, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@peluja1012 peluja1012 added the impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. label Feb 18, 2021
@FrankHassanabad FrankHassanabad mentioned this issue Feb 24, 2021
Merged
1 task
@FrankHassanabad FrankHassanabad linked a pull request Feb 24, 2021 that will close this issue
[Security Solutions][Detection Engine] Fixes bug with not being able to duplicate indicator matches #92565
Merged
1 task
FrankHassanabad added a commit that referenced this issue Feb 24, 2021
@FrankHassanabad
[Security Solutions][Detection Engine] Fixes bug with not being able …
ebb0435 
…to duplicate indicator matches (#92565)

## Summary

Fixes an unreleased regression bug where indicator rules could not be be duplicated.
#90356

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Feb 24, 2021
@FrankHassanabad @kibanamachine
[Security Solutions][Detection Engine] Fixes bug with not being able …
1a25478 
…to duplicate indicator matches (elastic#92565)

## Summary

Fixes an unreleased regression bug where indicator rules could not be be duplicated.
elastic#90356

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Feb 24, 2021
@FrankHassanabad @kibanamachine
[Security Solutions][Detection Engine] Fixes bug with not being able …
9cd13bc 
…to duplicate indicator matches (elastic#92565)

## Summary

Fixes an unreleased regression bug where indicator rules could not be be duplicated.
elastic#90356

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
kibanamachine added a commit that referenced this issue Feb 25, 2021
@kibanamachine @FrankHassanabad
[Security Solutions][Detection Engine] Fixes bug with not being able …
044de1e 
…to duplicate indicator matches (#92565) (#92717)

## Summary

Fixes an unreleased regression bug where indicator rules could not be be duplicated.
#90356

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

Co-authored-by: Frank Hassanabad <frank.hassanabad@elastic.co>
kibanamachine added a commit that referenced this issue Feb 25, 2021
@kibanamachine @FrankHassanabad
[Security Solutions][Detection Engine] Fixes bug with not being able …
025ac2c 
…to duplicate indicator matches (#92565) (#92716)

## Summary

Fixes an unreleased regression bug where indicator rules could not be be duplicated.
#90356

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

Co-authored-by: Frank Hassanabad <frank.hassanabad@elastic.co>
@ghost
Copy link

ghost commented Mar 26, 2021

Bug Conversion:

Created 01 Test-Case for this Ticket
https://elastic.testrail.io/index.php?/cases/view/76923

Thanks!!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@FrankHassanabad FrankHassanabad

Labels
bug Fixes for quality problems that affect the customer experience impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v7.12.0
Projects
None yet
Milestone
No milestone
6 participants
@peluja1012 @rylnd @FrankHassanabad @MindyRS @elasticmachine @MadameSheema