Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Filters broken for dashboards #1583

Closed
jesusgn90 opened this issue Jul 12, 2019 · 2 comments
Closed

Filters broken for dashboards #1583

jesusgn90 opened this issue Jul 12, 2019 · 2 comments
Assignees
Labels
request/operational Operational requests type/bug Bug issue

Comments

@jesusgn90
Copy link
Contributor

Wazuh Elastic Rev
3.9.3 7.2 520

Description
Filters are being applied the very first time, but if the user changes the tab and then go back, filters are now being applied as expected.

Steps to reproduce

  1. Click Agents > :some_agent
  2. Open Security Events
  3. Now click on a different dashboard such as FIM
  4. Go back to Security Events, now the agent.id filter is now being applied.

Screenshots

image

As we can see, there is a mixing of alerts in the above screenshot.

@jesusgn90
Copy link
Contributor Author

After some researching, I think we've found the main cause of this issue.

It's related to the latest changes in Discover directive, some functions are called for fetching data as it did before but now we have to check if the Wazuh filters are ready in one more place.

https://github.com/wazuh/wazuh-kibana-app/blob/0639d2eb58992f03e13dfeaa5fe016255818075a/public/kibana-integrations/kibana-discover.js#L399-L402

As we can see, the above function is updating the fetching source with no filter checks as other functions do. The solution was just adding our filter blocker at the very first line of that function f50ac08.

if(!filtersAreReady()) return;

That's like a lock for the Wazuh filters, and we were using it from a long time ago, but with the 7.2 changes we forgot to add the lock to the recently added event subscription named filterUpdateSubscription.

In any case, pending testing.

@juankaromo
Copy link
Contributor

juankaromo commented Jul 12, 2019

Testing report

Fully remove "rule.id" as URL feature #1584

  1. Rule link is removed in the Security Events Alerts summary rule.id table filed. ✅
    image

  2. Rule link is removed in Discover. ✅
    image

  3. Rule link is removed in the index pattern. ✅
    image

  4. Fixed after App update

Filters broken for dashboards #1583

Everything seems right, but there will be more intensive testing here #1593

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
request/operational Operational requests type/bug Bug issue
Projects
None yet
Development

No branches or pull requests

2 participants