Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] ML jobs are missing on rule details/editing/update pages #202700

Closed
Tracked by #201502
xcrzx opened this issue Dec 3, 2024 · 5 comments · Fixed by #205483
Closed
Tracked by #201502

[Security Solution] ML jobs are missing on rule details/editing/update pages #202700

xcrzx opened this issue Dec 3, 2024 · 5 comments · Fixed by #205483
Assignees
@nikitaindik
Labels
8.18 candidate bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.18.0

Comments

@xcrzx
Copy link
Contributor

xcrzx commented Dec 3, 2024 •
edited by nikitaindik
Loading

PR: #205483

Summary

Some machine learning (ML) jobs are not displayed when viewing, editing, or updating rules.

Steps to Reproduce

  1. Open a rule, such as High Mean of RDP Session Duration, or another ML rule. From my observation, around 30-40% of ML rules appear to be affected by this issue.

Issue Details

In all affected cases:

  • The machine_learning_job_id is present in the rule configuration.
  • However, it is not displayed by the view or edit components.

Affected Components

Rule Details Page

Image

Rule Editing Page

Image

Rule Update Flyout (View Mode)

Image

Rule Update Flyout (Edit Mode)

Image

Note

From the component logic, it appears that we fetch a list of all security ML jobs. Next, we check if the rule's jobs are in that list. We then display only the jobs from the list.
@xcrzx xcrzx added bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team triage_needed labels Dec 3, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@approksiu
Copy link

This issue would occur for all the rules that reference uninstalled Advanced Analytics (ML) packages and use ML jobs from those.

@banderror
Copy link
Contributor

@xcrzx @approksiu The ML jobs UI component shouldn't reset its state to empty if it can't find a job in the list. This should only be done by the user explicitly. I think we should try to fix this within Milestone 3, but the priority is lower than fixing issues that are not field-specific.

@banderror banderror mentioned this issue Dec 5, 2024
Open
74 tasks
@nikitaindik nikitaindik mentioned this issue Jan 3, 2025
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Jan 6, 2025
@nikitaindik
[Security Solution] Display unavailable ML jobs (elastic#205483)
1bbd863 
**Resolves: elastic#202700

## Summary
This PR resolves an issue where an ML job referenced by a rule does not
appear in the Rule Details, Upgrade flyout, or Rule Editing pages if the
job is missing or not yet created.

For example, if you had an ML rule with a single selected job and this
job was not available, you would see a blank space instead of job name.

## Screenshots
**Rule Details: Before**
<img width="578" alt="Scherm­afbeelding 2025-01-03 om 13 20 32"
src="https://github.com/user-attachments/assets/e8bc073f-0420-4888-8dd9-b4dc70fd0682"
/>

**Rule Details: After**
<img width="578" alt="Scherm­afbeelding 2025-01-03 om 13 20 05"
src="https://github.com/user-attachments/assets/bd4d0f91-8adf-45c5-8d31-b42ac483027b"
/>

**Rule Edit: Before**
<img width="427" alt="Scherm­afbeelding 2025-01-03 om 13 21 21"
src="https://github.com/user-attachments/assets/bffcb871-8cfc-4f50-8d19-c14b122c0be4"
/>

**Rule Edit: After**
<img width="427" alt="Scherm­afbeelding 2025-01-03 om 13 21 09"
src="https://github.com/user-attachments/assets/be8f60b9-17a6-48d2-978c-cfa63c426a08"
/>

**Upgrade flyout: Before**
<img width="1066" alt="Scherm­afbeelding 2025-01-03 om 13 22 30"
src="https://github.com/user-attachments/assets/553ff837-95cf-4670-91f1-dffb169ec505"
/>

**Upgrade flyout: After**
<img width="1066" alt="Scherm­afbeelding 2025-01-03 om 13 21 55"
src="https://github.com/user-attachments/assets/150cfb82-bc69-4aeb-a20a-03f54c7edc70"
/>

## Testing
You can test by removing an ML job referenced by a rule in
`http://localhost:<port>/kbn/app/ml/jobs`.

(cherry picked from commit e04b200)
kowalczyk-krzysztof pushed a commit to kowalczyk-krzysztof/kibana that referenced this issue Jan 7, 2025
@nikitaindik @kowalczyk-krzysztof
[Security Solution] Display unavailable ML jobs (elastic#205483)
4c859f6 
**Resolves: elastic#202700

## Summary
This PR resolves an issue where an ML job referenced by a rule does not
appear in the Rule Details, Upgrade flyout, or Rule Editing pages if the
job is missing or not yet created.

For example, if you had an ML rule with a single selected job and this
job was not available, you would see a blank space instead of job name.

## Screenshots
**Rule Details: Before**
<img width="578" alt="Scherm­afbeelding 2025-01-03 om 13 20 32"
src="https://github.com/user-attachments/assets/e8bc073f-0420-4888-8dd9-b4dc70fd0682"
/>

**Rule Details: After**
<img width="578" alt="Scherm­afbeelding 2025-01-03 om 13 20 05"
src="https://github.com/user-attachments/assets/bd4d0f91-8adf-45c5-8d31-b42ac483027b"
/>

**Rule Edit: Before**
<img width="427" alt="Scherm­afbeelding 2025-01-03 om 13 21 21"
src="https://github.com/user-attachments/assets/bffcb871-8cfc-4f50-8d19-c14b122c0be4"
/>

**Rule Edit: After**
<img width="427" alt="Scherm­afbeelding 2025-01-03 om 13 21 09"
src="https://github.com/user-attachments/assets/be8f60b9-17a6-48d2-978c-cfa63c426a08"
/>

**Upgrade flyout: Before**
<img width="1066" alt="Scherm­afbeelding 2025-01-03 om 13 22 30"
src="https://github.com/user-attachments/assets/553ff837-95cf-4670-91f1-dffb169ec505"
/>

**Upgrade flyout: After**
<img width="1066" alt="Scherm­afbeelding 2025-01-03 om 13 21 55"
src="https://github.com/user-attachments/assets/150cfb82-bc69-4aeb-a20a-03f54c7edc70"
/>

## Testing
You can test by removing an ML job referenced by a rule in
`http://localhost:<port>/kbn/app/ml/jobs`.
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this issue Jan 13, 2025
@nikitaindik @CAWilson94
[Security Solution] Display unavailable ML jobs (elastic#205483)
425eb8b 
**Resolves: elastic#202700

## Summary
This PR resolves an issue where an ML job referenced by a rule does not
appear in the Rule Details, Upgrade flyout, or Rule Editing pages if the
job is missing or not yet created.

For example, if you had an ML rule with a single selected job and this
job was not available, you would see a blank space instead of job name.

## Screenshots
**Rule Details: Before**
<img width="578" alt="Scherm­afbeelding 2025-01-03 om 13 20 32"
src="https://github.com/user-attachments/assets/e8bc073f-0420-4888-8dd9-b4dc70fd0682"
/>

**Rule Details: After**
<img width="578" alt="Scherm­afbeelding 2025-01-03 om 13 20 05"
src="https://github.com/user-attachments/assets/bd4d0f91-8adf-45c5-8d31-b42ac483027b"
/>

**Rule Edit: Before**
<img width="427" alt="Scherm­afbeelding 2025-01-03 om 13 21 21"
src="https://github.com/user-attachments/assets/bffcb871-8cfc-4f50-8d19-c14b122c0be4"
/>

**Rule Edit: After**
<img width="427" alt="Scherm­afbeelding 2025-01-03 om 13 21 09"
src="https://github.com/user-attachments/assets/be8f60b9-17a6-48d2-978c-cfa63c426a08"
/>

**Upgrade flyout: Before**
<img width="1066" alt="Scherm­afbeelding 2025-01-03 om 13 22 30"
src="https://github.com/user-attachments/assets/553ff837-95cf-4670-91f1-dffb169ec505"
/>

**Upgrade flyout: After**
<img width="1066" alt="Scherm­afbeelding 2025-01-03 om 13 21 55"
src="https://github.com/user-attachments/assets/150cfb82-bc69-4aeb-a20a-03f54c7edc70"
/>

## Testing
You can test by removing an ML job referenced by a rule in
`http://localhost:<port>/kbn/app/ml/jobs`.
viduni94 pushed a commit to viduni94/kibana that referenced this issue Jan 23, 2025
@nikitaindik @viduni94
[Security Solution] Display unavailable ML jobs (elastic#205483)
20168da 
**Resolves: elastic#202700

## Summary
This PR resolves an issue where an ML job referenced by a rule does not
appear in the Rule Details, Upgrade flyout, or Rule Editing pages if the
job is missing or not yet created.

For example, if you had an ML rule with a single selected job and this
job was not available, you would see a blank space instead of job name.

## Screenshots
**Rule Details: Before**
<img width="578" alt="Scherm­afbeelding 2025-01-03 om 13 20 32"
src="https://github.com/user-attachments/assets/e8bc073f-0420-4888-8dd9-b4dc70fd0682"
/>

**Rule Details: After**
<img width="578" alt="Scherm­afbeelding 2025-01-03 om 13 20 05"
src="https://github.com/user-attachments/assets/bd4d0f91-8adf-45c5-8d31-b42ac483027b"
/>

**Rule Edit: Before**
<img width="427" alt="Scherm­afbeelding 2025-01-03 om 13 21 21"
src="https://github.com/user-attachments/assets/bffcb871-8cfc-4f50-8d19-c14b122c0be4"
/>

**Rule Edit: After**
<img width="427" alt="Scherm­afbeelding 2025-01-03 om 13 21 09"
src="https://github.com/user-attachments/assets/be8f60b9-17a6-48d2-978c-cfa63c426a08"
/>

**Upgrade flyout: Before**
<img width="1066" alt="Scherm­afbeelding 2025-01-03 om 13 22 30"
src="https://github.com/user-attachments/assets/553ff837-95cf-4670-91f1-dffb169ec505"
/>

**Upgrade flyout: After**
<img width="1066" alt="Scherm­afbeelding 2025-01-03 om 13 21 55"
src="https://github.com/user-attachments/assets/150cfb82-bc69-4aeb-a20a-03f54c7edc70"
/>

## Testing
You can test by removing an ML job referenced by a rule in
`http://localhost:<port>/kbn/app/ml/jobs`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@nikitaindik nikitaindik

Labels
8.18 candidate bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.18.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Security Solution] Display unavailable ML jobs nikitaindik/kibana
5 participants
@xcrzx @banderror @elasticmachine @nikitaindik @approksiu