Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution][Detections] - EQL preview not receiving expected response #82900

Closed
yctercero opened this issue Nov 6, 2020 · 1 comment
Assignees
Labels
bug Fixes for quality problems that affect the customer experience Feature:Detection Rules Anything related to Security Solution's Detection Rules Feature:Event Correlation (EQL) Rule Security Solution Event Correlation (EQL) Rule feature fixed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM v7.11.0

Comments

@yctercero
Copy link
Contributor

Kibana version:
7.11

Describe the bug:
When trying to preview an EQL query in rule creation/edit, Kibana blows up. This is because we are expecting rawResponse to include the meta object that includes all the info needed to fill out the inspect functionality. It is currently typed as a field guaranteed to be there, but as search strategy is something actively being developed, seems some updates have been made. More information is needed.

Steps to reproduce:

  1. Click to create rule in detections
  2. Add EQL query any where true
  3. See Kibana error

Expected behavior:
When previewing EQL query, histogram should successfully resolve.

Screenshots (if relevant):
image

Errors in browser console (if relevant):

TypeError: Cannot read property 'request' of undefined
    at formatInspect (https://kibana.siem.estc.dev/37875/bundles/plugin/securitySolution/securitySolution.chunk.3.js:7:384450)
    at https://kibana.siem.estc.dev/37875/bundles/plugin/securitySolution/securitySolution.chunk.3.js:7:393983
    at pa (https://kibana.siem.estc.dev/37875/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:375:60205)
    at ga (https://kibana.siem.estc.dev/37875/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:375:60872)
    at Object._a [as useState] (https://kibana.siem.estc.dev/37875/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:375:61316)
    at useState (https://kibana.siem.estc.dev/37875/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:353:5372)
    at useEqlPreview (https://kibana.siem.estc.dev/37875/bundles/plugin/securitySolution/securitySolution.chunk.3.js:7:391864)
    at PreviewQuery (https://kibana.siem.estc.dev/37875/bundles/plugin/securitySolution/securitySolution.chunk.3.js:7:404443)
    at ua (https://kibana.siem.estc.dev/37875/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:375:59332)
    at qa (https://kibana.siem.estc.dev/37875/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:375:67554)

Any additional context:
Error message originating from x-pack/plugins/security_solution/public/common/hooks/eql/helpers.ts - formatInspect

@yctercero yctercero self-assigned this Nov 6, 2020
@yctercero yctercero added bug Fixes for quality problems that affect the customer experience Feature:Detection Rules Anything related to Security Solution's Detection Rules Team:Detections and Resp Security Detection Response Team Team:SIEM v7.11.0 labels Nov 6, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/siem (Team:SIEM)

@peluja1012 peluja1012 added the impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. label Nov 7, 2020
@rylnd rylnd assigned rylnd and unassigned yctercero Nov 9, 2020
@MindyRS MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Nov 16, 2020
@peluja1012 peluja1012 added Feature:Event Correlation (EQL) Rule Security Solution Event Correlation (EQL) Rule feature fixed labels Nov 17, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Feature:Detection Rules Anything related to Security Solution's Detection Rules Feature:Event Correlation (EQL) Rule Security Solution Event Correlation (EQL) Rule feature fixed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM v7.11.0
Projects
None yet
Development

No branches or pull requests

6 participants