Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution]Edit Additional Filter not working for field added from few charts visualization #164406

Closed
ghost opened this issue Aug 22, 2023 · 9 comments
Closed

[Security Solution]Edit Additional Filter not working for field added from few charts visualization #164406

ghost opened this issue Aug 22, 2023 · 9 comments
Assignees
@angorayc @semd
Labels
bug Fixes for quality problems that affect the customer experience fixed impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. QA:Validated Issue has been validated by QA Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Explore Team:Threat Hunting Security Solution Threat Hunting Team v8.11.0

Comments

@ghost
Copy link

ghost commented Aug 22, 2023

Describe the bug:
Edit Additional Filter not working for field added from few charts visualization

Kibana/Elasticsearch Stack version
Version: 8.10.0 BC1
Commit: f8121b8
Build: 66085

Browser and Browser OS Version:
Firefox for windows OS
Version: 116.0.3(64-bit)

Elastic Endpoint Version:
v8.10.2

Original install method:
Build summary: https://staging.elastic.co/8.10.0-b637efd3/summary-8.10.0.html

Functional Area:
Additional Filter

Initial Setup:

  • Agent with Elastic Defend integration need to be installed
  • Generate multiple alert data on the kibana instance

Steps to reproduce

  • Navigate to Overview page

Additional Observation

  • Issue is not occuring under timeline

Current behavior

  • Edit filter is not working and filter field name and value are not showing

Issue is occuring on editing additional filter added from below locations: ❌

  • Alert Trend > Filter any Rule > Edit Additional filter
  • Events > Filter any event.dataset > Edit Additional filter
  • Trend chart > Filter any Rule > Edit Additional filter

image

Issue is not occuring on editing additional filter added from below locations: ✔️

  • Counts charts > Filter any Rule name or host name > Edit Additional filter
  • Tree Map > Filter any value > Edit Additional filter
  • Summary Map > Alert by name > Filter any value > Edit Additional filter
  • Summary Map > Top Alert by > Filter any value > Edit Additional filter
  • Severity Level > Top Alert by > Filter any value > Edit Additional filter

image

Note: There must be many more instance in application for this issue but above are few of them to diagnose the issue.

Expected behavior:

  • Edit additional Filter should work correct and filter configuration should show for updation

Screen-cast:

Alerts.-.Kibana.Mozilla.Firefox.2023-08-22.14-34-40.mp4

Errors in browser console:
N/A

Any additional context (logs, chat logs, magical formulas, etc.):

N/A
@ghost ghost added bug Fixes for quality problems that affect the customer experience triage_needed Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. labels Aug 22, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@ghost ghost added the impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. label Aug 22, 2023
@ghost
Copy link
Author

ghost commented Aug 22, 2023

@amolnater-qasource please review

@amolnater-qasource
Copy link

Reviewed & Assigned to @MadameSheema

@MadameSheema MadameSheema removed their assignment Aug 22, 2023
@MadameSheema MadameSheema added Team:Threat Hunting Security Solution Threat Hunting Team Team:Threat Hunting:Explore labels Aug 22, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@angorayc angorayc self-assigned this Aug 22, 2023
@angorayc
Copy link
Contributor

angorayc commented Oct 10, 2023 •
edited
Loading

When I click the Filter for from the action in here and edit the filter, it shows me the data view dropdown. But if I open it in Lens, and filter for a legend bucket, it wouldn't show the data view dropdown when editing.

Screen.Recording.2023-10-10.at.17.07.36.mov

@angorayc angorayc mentioned this issue Oct 16, 2023
Merged
1 task
angorayc added a commit that referenced this issue Oct 31, 2023
@angorayc @kibanamachine
[SecuritySolution] Global search bar Edit Additional Filter not worki…
c054a2d 
…ng (#168955)

## Summary

The issue and steps to reproduce:
#164406

Root cause:
https://github.com/elastic/kibana/pull/168955/files#r1360612921

After:



https://github.com/elastic/kibana/assets/6295984/dc338c53-2f04-4f8b-a794-ff188606332a



### Checklist

Delete any items that are not applicable to this PR.


- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: kibanamachine <[email protected]>
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Oct 31, 2023
@angorayc
[SecuritySolution] Global search bar Edit Additional Filter not worki…
2dbb5fc 
…ng (elastic#168955)

## Summary

The issue and steps to reproduce:
elastic#164406

Root cause:
https://github.com/elastic/kibana/pull/168955/files#r1360612921

After:

https://github.com/elastic/kibana/assets/6295984/dc338c53-2f04-4f8b-a794-ff188606332a

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: kibanamachine <[email protected]>
(cherry picked from commit c054a2d)
kibanamachine added a commit that referenced this issue Nov 1, 2023
@kibanamachine @angorayc
[8.11] [SecuritySolution] Global search bar Edit Additional Filter no…
24b4712 
…t working (#168955) (#170215)

# Backport

This will backport the following commits from `main` to `8.11`:
- [[SecuritySolution] Global search bar Edit Additional Filter not
working (#168955)](#168955)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Angela
Chuang","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-10-31T10:28:44Z","message":"[SecuritySolution]
Global search bar Edit Additional Filter not working (#168955)\n\n##
Summary\r\n\r\nThe issue and steps to
reproduce:\r\nhttps://github.com//issues/164406\r\n\r\nRoot
cause:\r\nhttps://github.com//pull/168955/files#r1360612921\r\n\r\nAfter:\r\n\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/6295984/dc338c53-2f04-4f8b-a794-ff188606332a\r\n\r\n\r\n\r\n###
Checklist\r\n\r\nDelete any items that are not applicable to this
PR.\r\n\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine
<[email protected]>","sha":"c054a2d32ac9e6f3cca5ef5cdd61ca2a42b5e95a","branchLabelMapping":{"^v8.12.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","Team:Threat
Hunting","Team: SecuritySolution","Team:Threat
Hunting:Explore","v8.12.0","v8.11.1"],"number":168955,"url":"https://github.com/elastic/kibana/pull/168955","mergeCommit":{"message":"[SecuritySolution]
Global search bar Edit Additional Filter not working (#168955)\n\n##
Summary\r\n\r\nThe issue and steps to
reproduce:\r\nhttps://github.com//issues/164406\r\n\r\nRoot
cause:\r\nhttps://github.com//pull/168955/files#r1360612921\r\n\r\nAfter:\r\n\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/6295984/dc338c53-2f04-4f8b-a794-ff188606332a\r\n\r\n\r\n\r\n###
Checklist\r\n\r\nDelete any items that are not applicable to this
PR.\r\n\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine
<[email protected]>","sha":"c054a2d32ac9e6f3cca5ef5cdd61ca2a42b5e95a"}},"sourceBranch":"main","suggestedTargetBranches":["8.11"],"targetPullRequestStates":[{"branch":"main","label":"v8.12.0","labelRegex":"^v8.12.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/168955","number":168955,"mergeCommit":{"message":"[SecuritySolution]
Global search bar Edit Additional Filter not working (#168955)\n\n##
Summary\r\n\r\nThe issue and steps to
reproduce:\r\nhttps://github.com//issues/164406\r\n\r\nRoot
cause:\r\nhttps://github.com//pull/168955/files#r1360612921\r\n\r\nAfter:\r\n\r\n\r\n\r\nhttps://github.com/elastic/kibana/assets/6295984/dc338c53-2f04-4f8b-a794-ff188606332a\r\n\r\n\r\n\r\n###
Checklist\r\n\r\nDelete any items that are not applicable to this
PR.\r\n\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine
<[email protected]>","sha":"c054a2d32ac9e6f3cca5ef5cdd61ca2a42b5e95a"}},{"branch":"8.11","label":"v8.11.1","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Angela Chuang <[email protected]>
@banderror banderror mentioned this issue Dec 28, 2023
Closed
@angorayc angorayc removed the fixed label Jan 11, 2024
@angorayc
Copy link
Contributor

In 8.12 this issue is back again: we could see that data view is not selected by default when editing a filter.
Screenshot 2024-01-11 at 23 24 04
I also found that in src/plugins/unified_search/public/filter_bar/filter_editor/filter_editor.tsx line 165, getIndexPatternFromFilter is not returning the correct data view as some of the filters on Security page does not have filter.meta.index

@e40pud
Copy link
Contributor

e40pud commented Jan 12, 2024

Here is the list of the places where we create filters without filter.meta.index set:

  • packages/kbn-cell-actions/src/actions/filter/create_filter.ts
  • x-pack/plugins/timelines/public/components/hover_actions/utils.ts

and there are quite a few places in security solution where we use those methods.

We do not add data view id to a filter within "cell actions".

@angorayc angorayc mentioned this issue Jan 18, 2024
Closed
1 task
@semd semd mentioned this issue Feb 23, 2024
Closed
@semd semd mentioned this issue Mar 4, 2024
Merged
semd added a commit that referenced this issue Mar 6, 2024
@semd @angorayc @kibanamachine
[Security Solution] Add dataViewId to filter actions (#177946)
406b24c 
## Summary

This PR fixes a bug related to the filter edition:
#164406

Filter actions were missing the `meta.index` value, which needs to be
assigned to the dataView id being used. When the filter is edited, the
filter component retrieves the index pattern from the dataView saved
object.

The `meta.index` value has been added to all the "Filter in/out" actions
using the `CellActions` metadata object.

Thanks @angorayc for catching this and implementing the fix

### Screenshots

Before:


![before](https://github.com/elastic/kibana/assets/17747913/6e60cc1f-7811-4c97-8da0-95b688dd3d96)

After:


![after](https://github.com/elastic/kibana/assets/17747913/abaf740f-6ec0-4263-8455-d9f14dc3e423)

---------

Co-authored-by: Angela Chuang <[email protected]>
Co-authored-by: kibanamachine <[email protected]>
Co-authored-by: Angela Chuang <[email protected]>
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Mar 6, 2024
@semd
[Security Solution] Add dataViewId to filter actions (elastic#177946)
cfd239f 
## Summary

This PR fixes a bug related to the filter edition:
elastic#164406

Filter actions were missing the `meta.index` value, which needs to be
assigned to the dataView id being used. When the filter is edited, the
filter component retrieves the index pattern from the dataView saved
object.

The `meta.index` value has been added to all the "Filter in/out" actions
using the `CellActions` metadata object.

Thanks @angorayc for catching this and implementing the fix

### Screenshots

Before:

![before](https://github.com/elastic/kibana/assets/17747913/6e60cc1f-7811-4c97-8da0-95b688dd3d96)

After:

![after](https://github.com/elastic/kibana/assets/17747913/abaf740f-6ec0-4263-8455-d9f14dc3e423)

---------

Co-authored-by: Angela Chuang <[email protected]>
Co-authored-by: kibanamachine <[email protected]>
Co-authored-by: Angela Chuang <[email protected]>
(cherry picked from commit 406b24c)
kibanamachine added a commit that referenced this issue Mar 6, 2024
@kibanamachine @semd
[8.13] [Security Solution] Add dataViewId to filter actions (#177946) (…
d4ec567 
…#178081)

# Backport

This will backport the following commits from `main` to `8.13`:
- [[Security Solution] Add dataViewId to filter actions
(#177946)](#177946)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Sergi
Massaneda","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-03-06T10:57:41Z","message":"[Security
Solution] Add dataViewId to filter actions (#177946)\n\n##
Summary\r\n\r\nThis PR fixes a bug related to the filter
edition:\r\nhttps://github.com//issues/164406\r\n\r\nFilter
actions were missing the `meta.index` value, which needs to
be\r\nassigned to the dataView id being used. When the filter is edited,
the\r\nfilter component retrieves the index pattern from the dataView
saved\r\nobject.\r\n\r\nThe `meta.index` value has been added to all the
\"Filter in/out\" actions\r\nusing the `CellActions` metadata
object.\r\n\r\nThanks @angorayc for catching this and implementing the
fix\r\n\r\n###
Screenshots\r\n\r\nBefore:\r\n\r\n\r\n![before](https://github.com/elastic/kibana/assets/17747913/6e60cc1f-7811-4c97-8da0-95b688dd3d96)\r\n\r\nAfter:\r\n\r\n\r\n![after](https://github.com/elastic/kibana/assets/17747913/abaf740f-6ec0-4263-8455-d9f14dc3e423)\r\n\r\n---------\r\n\r\nCo-authored-by:
Angela Chuang <[email protected]>\r\nCo-authored-by:
kibanamachine
<[email protected]>\r\nCo-authored-by:
Angela Chuang
<[email protected]>","sha":"406b24c6a8758fc82218ad5dbaf048677454d0d9","branchLabelMapping":{"^v8.14.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","Team:Threat
Hunting","Team:Threat
Hunting:Explore","v8.13.0","v8.14.0","v8.12.3"],"title":"[Security
Solution] Add dataViewId to filter
actions","number":177946,"url":"https://github.com/elastic/kibana/pull/177946","mergeCommit":{"message":"[Security
Solution] Add dataViewId to filter actions (#177946)\n\n##
Summary\r\n\r\nThis PR fixes a bug related to the filter
edition:\r\nhttps://github.com//issues/164406\r\n\r\nFilter
actions were missing the `meta.index` value, which needs to
be\r\nassigned to the dataView id being used. When the filter is edited,
the\r\nfilter component retrieves the index pattern from the dataView
saved\r\nobject.\r\n\r\nThe `meta.index` value has been added to all the
\"Filter in/out\" actions\r\nusing the `CellActions` metadata
object.\r\n\r\nThanks @angorayc for catching this and implementing the
fix\r\n\r\n###
Screenshots\r\n\r\nBefore:\r\n\r\n\r\n![before](https://github.com/elastic/kibana/assets/17747913/6e60cc1f-7811-4c97-8da0-95b688dd3d96)\r\n\r\nAfter:\r\n\r\n\r\n![after](https://github.com/elastic/kibana/assets/17747913/abaf740f-6ec0-4263-8455-d9f14dc3e423)\r\n\r\n---------\r\n\r\nCo-authored-by:
Angela Chuang <[email protected]>\r\nCo-authored-by:
kibanamachine
<[email protected]>\r\nCo-authored-by:
Angela Chuang
<[email protected]>","sha":"406b24c6a8758fc82218ad5dbaf048677454d0d9"}},"sourceBranch":"main","suggestedTargetBranches":["8.13","8.12"],"targetPullRequestStates":[{"branch":"8.13","label":"v8.13.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.14.0","branchLabelMappingKey":"^v8.14.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/177946","number":177946,"mergeCommit":{"message":"[Security
Solution] Add dataViewId to filter actions (#177946)\n\n##
Summary\r\n\r\nThis PR fixes a bug related to the filter
edition:\r\nhttps://github.com//issues/164406\r\n\r\nFilter
actions were missing the `meta.index` value, which needs to
be\r\nassigned to the dataView id being used. When the filter is edited,
the\r\nfilter component retrieves the index pattern from the dataView
saved\r\nobject.\r\n\r\nThe `meta.index` value has been added to all the
\"Filter in/out\" actions\r\nusing the `CellActions` metadata
object.\r\n\r\nThanks @angorayc for catching this and implementing the
fix\r\n\r\n###
Screenshots\r\n\r\nBefore:\r\n\r\n\r\n![before](https://github.com/elastic/kibana/assets/17747913/6e60cc1f-7811-4c97-8da0-95b688dd3d96)\r\n\r\nAfter:\r\n\r\n\r\n![after](https://github.com/elastic/kibana/assets/17747913/abaf740f-6ec0-4263-8455-d9f14dc3e423)\r\n\r\n---------\r\n\r\nCo-authored-by:
Angela Chuang <[email protected]>\r\nCo-authored-by:
kibanamachine
<[email protected]>\r\nCo-authored-by:
Angela Chuang
<[email protected]>","sha":"406b24c6a8758fc82218ad5dbaf048677454d0d9"}},{"branch":"8.12","label":"v8.12.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

---------

Co-authored-by: Sergi Massaneda <[email protected]>
@semd semd added the fixed label Mar 6, 2024
@semd semd self-assigned this Mar 6, 2024
@semd
Copy link
Contributor

semd commented Mar 6, 2024 •
edited
Loading

Fix merged into 8.13 and above. @karanbirsingh-qasource could you test again?

@ghost
Copy link
Author

ghost commented Apr 1, 2024

Hi @MadameSheema

we have validated this issue on 8.13.1 and found this issue to be fixed now ✔️

Build Details:

Version: 8.13.1
Commit: 091f486ab05863258cf2f3fa18ea0c59097dee80
Build: 72107

image

image

@ghost ghost closed this as completed Apr 1, 2024
@ghost ghost added the QA:Validated Issue has been validated by QA label Apr 1, 2024
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@angorayc angorayc

@semd semd

Labels
bug Fixes for quality problems that affect the customer experience fixed impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. QA:Validated Issue has been validated by QA Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Explore Team:Threat Hunting Security Solution Threat Hunting Team v8.11.0
Projects
Security Bug Audit
Status: Done
Milestone
No milestone
Development

No branches or pull requests
6 participants
@e40pud @angorayc @elasticmachine @MadameSheema @semd @amolnater-qasource