Skip to content

Commit

Permalink
[Security Solution] Fix coverage overview console errors (elastic#178126
Browse files Browse the repository at this point in the history
)

**Fixes: elastic#164846

## Summary

This PR fixes MITRE ATT&CK® Coverage Overview dashboard console errors when the page loads or filter is changed.

## Details

An error message `Exception list is null when it never should be. This indicates potentially that saved object migrations did not run correctly. Returning empty exception list` appears each time MITRE ATT&CK® Coverage Overview dashboard is loaded or filter is changed (which lead to data reloading).

If one tried to find the source of the console error message it lead to [kibana/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/saved_object_references/inject_exceptions_list.ts](https://github.com/elastic/kibana/blob/6cb73aaec15b230a65d2e17a9d6ef970a1061709/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/saved_object_references/inject_exceptions_list.ts#L30-L33). It happens whenever there is an attempt to inject rule exceptions from SO references. This operations happens for every rule wrapped in `securityRuleTypeWrapper` and registered in `alerting` plugin. Whenever such rule if fetched via `rulesClient.find()` it invokes registered `useSavedObjectReferences.injectReferences` finally invoking mentioned above `inject_exceptions_list.ts`. Coverage Overview API endpoint fetches only necessary set of rule fields (`name`, `enabled`, `params.threat`) to reduce transferring unnecessary data. It's not hard to guess that `params.exceptionsList` is missed  and it ends up to be `undefined` (it's always an array in a SO) when the validation happens in `inject_exceptions_list.ts`. So it leads to the warning message appearing.

This PR removes redundant `exceptionsList` injection validation.
  • Loading branch information
maximpn authored Mar 11, 2024
1 parent d6550ef commit cd16d03
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 18 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -46,15 +46,14 @@ describe('inject_exceptions_list', () => {
).toEqual<FuncReturn>([]);
});

test('logs expect error message if the exceptionsList is undefined', () => {
injectExceptionsReferences({
logger,
exceptionsList: undefined as unknown as RuleParams['exceptionsList'],
savedObjectReferences: mockSavedObjectReferences(),
});
expect(logger.error).toBeCalledWith(
'Exception list is null when it never should be. This indicates potentially that saved object migrations did not run correctly. Returning empty exception list'
);
test('returns empty array given undefined', () => {
expect(
injectExceptionsReferences({
logger,
exceptionsList: undefined as unknown as RuleParams['exceptionsList'],
savedObjectReferences: mockSavedObjectReferences(),
})
).toEqual([]);
});

test('returns empty array given an empty array for "exceptionsList"', () => {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,14 +26,8 @@ export const injectExceptionsReferences = ({
logger: Logger;
exceptionsList: RuleParams['exceptionsList'];
savedObjectReferences: SavedObjectReference[];
}): RuleParams['exceptionsList'] => {
if (exceptionsList == null) {
logger.error(
'Exception list is null when it never should be. This indicates potentially that saved object migrations did not run correctly. Returning empty exception list'
);
return [];
}
return exceptionsList.map((exceptionItem, index) => {
}): RuleParams['exceptionsList'] =>
(exceptionsList ?? []).map((exceptionItem, index) => {
const savedObjectReference = getSavedObjectReferenceForExceptionsList({
logger,
index,
Expand All @@ -54,4 +48,3 @@ export const injectExceptionsReferences = ({
return exceptionItem;
}
});
};

0 comments on commit cd16d03

Please sign in to comment.