Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Unable to upgrade rules with deleted connectors #203752

Closed
xcrzx opened this issue Dec 11, 2024 · 4 comments
Closed

[Security Solution] Unable to upgrade rules with deleted connectors #203752

xcrzx opened this issue Dec 11, 2024 · 4 comments
Labels
bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Feature:Rule Actions Security Solution Detection Rule Actions area impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. sdh-linked Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.

Comments

@xcrzx
Copy link
Contributor

xcrzx commented Dec 11, 2024

Summary

Rules with connectors attached to them that were deleted are unable to upgrade.

Steps to Reproduce

  1. Open any prebuilt rule that has an update
  2. Attach an action to it, e.g., a simple webhook
  3. Navigate to Stack Management -> Connectors and delete the webhook connector you just created
  4. Try to update the rule

Expected Result

The rule upgrades without errors.

Actual Result

The rule upgrade fails without providing any meaningful information to the user, except for a generic notification.

Image

Inspecting the upgrade response reveals the following error:

Failed to load action 16dcb976-bd2f-43c0-b4cd-2d567c742ed9 (404): Saved object [action/16dcb976-bd2f-43c0-b4cd-2d567c742ed9] not found.

Workaround

  1. Select all the problematic rules on the Installed Rules page
  2. Apply the Add Rule Actions bulk action to them, choosing Overwrite all selected rules actions in the flyout
  3. After completing this step, all rules should become upgradeable
@xcrzx xcrzx added bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area sdh-linked Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team triage_needed labels Dec 11, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@banderror banderror self-assigned this Dec 20, 2024
@banderror banderror added impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. and removed triage_needed labels Dec 20, 2024
@banderror banderror mentioned this issue Dec 20, 2024
Open
@banderror banderror added the Feature:Rule Actions Security Solution Detection Rule Actions area label Dec 20, 2024
@banderror banderror removed their assignment Dec 20, 2024
@banderror
Copy link
Contributor

@xcrzx Great catch, but we already have #198771.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Feature:Rule Actions Security Solution Detection Rule Actions area impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. sdh-linked Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@xcrzx @banderror @elasticmachine