[Security Solution]Error while Bulk index delete operation on Rule with Data view

[ghost]

Describe the bug
Error while Bulk index delete operation on Rule with Data view

Build Details:

Version:8.4.0-SNAPSHOT
Commit:f94d5ff26bf1f14f9992e426d9a56ac6c5d48fb0
Build:54194

Steps

• Create a Rule with data view
• click drop-down and select any one data view let say default data view
• Fill in all the required field and create the rule
• perform bulk delete index operation by selecting checkbox
• Observed that red error is shown and bulk delete index operation is not performed

Screen-Cast

Rules.-.Kibana.Mozilla.Firefox.2022-07-08.17-55-28.mp4

Rule Export fiIe:
rules_export.zip

Error logs:

{
  "name": "Error",
  "body": {
    "message": "Bulk edit failed",
    "status_code": 500,
    "attributes": {
      "errors": [
        {
          "message": "Mutated params invalid: Index patterns can't be empty",
          "status_code": 500,
          "rules": [
            {
              "id": "e7bf1520-feb8-11ec-82b8-5592ca3da59a",
              "name": "Rule with Data View"
            }
          ]
        }
      ],
      "results": {
        "updated": [],
        "created": [],
        "deleted": []
      },
      "summary": {
        "failed": 1,
        "succeeded": 0,
        "total": 1
      }
    }
  },
  "stack": "{\n  \"message\": \"Bulk edit failed\",\n  \"status_code\": 500,\n  \"attributes\": {\n    \"errors\": [\n      {\n        \"message\": \"Mutated params invalid: Index patterns can't be empty\",\n        \"status_code\": 500,\n        \"rules\": [\n          {\n            \"id\": \"e7bf1520-feb8-11ec-82b8-5592ca3da59a\",\n            \"name\": \"Rule with Data View\"\n          }\n        ]\n      }\n    ],\n    \"results\": {\n      \"updated\": [],\n      \"created\": [],\n      \"deleted\": []\n    },\n    \"summary\": {\n      \"failed\": 1,\n      \"succeeded\": 0,\n      \"total\": 1\n    }\n  }\n}",
  "message": "Internal Server Error"
}

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[banderror]

@vitaliidm @dhurley14 -- just FYI that we have this bug. I think we should get it fixed in the next dev cycle, but please feel free to do it sooner if you like.

Also, I'm thinking about what we could have done to prevent it from happening - maybe rule params schema could be expressed in a different way?..

[peluja1012]

hmm wouldn't the user also get this bug if they bulk delete all of index patterns configured for a regular rule (not necessarily a "data view" rule)? @karanbirsingh-qasource would you mind testing this scenario?

[ghost]

sure @peluja1012 in that scenario issue is not occuring and the selected index got removed from the rule index pattern.

Please find below detailed observations

• created rule with default ES index pattern
• performed Bulk index delete operation and deleted auditbeat index ( without selecting the data view rule checkbox )
• auditbeat index removed from the index pattern of rule and rule remain in success state .

Rules.-.Kibana.Mozilla.Firefox.2022-07-22.10-02-37.mp4

[vitaliidm]

@karanbirsingh-qasource
I believe Pedro refers to a case, when users try to delete all index patterns from a rule. So, index field can become empty.
In that case, yes, error will be displayed: index patterns can't be empty.

Screen.Recording.2022-07-22.at.10.14.34.mov

It seemed also, a root cause of the reported issue. Before introducing data views, rules couldn't have empty index patterns

[ghost]

correct @vitaliidm yes in that case we face the error on bulk delete with normal rule created with index pattern.

Rules.-.Kibana.Mozilla.Firefox.2022-07-22.15-51-56.mp4

[banderror]

Since it looks like it might be easy to fix this one (#137029 (comment)), I moved this ticket to Todo on our board.

[banderror]

@karanbirsingh-qasource This bug has been fixed in #137585 and will be available in the next BC. Please note that there's another one that is similar to but a little bit trickier than this one: #137585 (review).

[ghost]

Hi @banderror

we have validated this issue on 8.4.0 BC3 and issue is fixed now ✔️

Build Details:

Version:8.4.0 BC3
Commit:e42c547d7ab545472fd978383c2c43fa203a5b06

Scenarios:

• Bulk index delete operation on index which is not present in rule : no error prompt observed in the rule as rule with data view have no impact

ksingh.-.ec2-54-172-240-11.compute-1.amazonaws.com.-.Remote.Desktop.Connection.2022-08-11.10-36-51.mp4

• Bulk index delete operation on index which is present in rule : no error prompt but the targeted index is also not getting delete from the rule as rule with data view has no impact

ksingh.-.ec2-54-172-240-11.compute-1.amazonaws.com.-.Remote.Desktop.Connection.2022-08-11.10-45-18.mp4

Hence we are closing this issue and adding "QA:Valdiated" tag to it.

thanks !!