Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Inconsistent conflict state messaging in Rule Upgrade flyout #200811

Closed
Tracked by #201502
pborgonovi opened this issue Nov 19, 2024 · 6 comments
Closed
Tracked by #201502
Assignees
Labels
8.18 candidate bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area fixed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.18.0

Comments

@pborgonovi
Copy link
Contributor

pborgonovi commented Nov 19, 2024

Epic: #174168

Summary

Describe the bug:
When the Related Integrations field is removed in a customized rule and the rule is opened in the Update Flyout, inconsistent conflict state messages are displayed. Specifically:

  • The top red banner shows an “Unsolved conflict” message, indicating user action is required.
  • Simultaneously, the “Related Integrations” field displays a “Solved conflict” message in the Diff view, even though the Final update column remains empty.

Kibana/Elasticsearch Stack version:
8.x

Current branch: 8.x  
Latest commit: f38870d176a - [8.x] Swaps template literals for sprintf style interpolation (#200634) (#200737)  
Remote tracking: origin/8.x  
Status relative to remote: up to date (no pending commits)  

Pre requisites:

  1. Old rules package is installed
  2. A rule containing related integrations is available (e.g: GitHub Repo Created)

Steps to reproduce:

  1. Open a rule with existing Related Integrations in the rule settings
  2. Edit rule and remove all related integrations and save the changes
  3. Update rules package to the latest
  4. Open Rules Updates page
  5. Open the Update Flyout for the rule.

Current behavior:

  • The red banner at the top of the flyout displays “Unsolved conflict” messaging.
  • The Related Integrations field in the Diff view displays a “Solved conflict” message.
  • The Final update column for the Related Integrations field is empty, despite being marked as solved.

Expected behavior:

Conflict Messaging Consistency:

  • If the field has no proposed resolution, only the “Unsolved conflict” message should appear.

  • The “Solved conflict” message should display only when a valid proposal exists in the Final update column.

  • If the system marks the field as “Solved conflict”, the Final update column must include a valid proposal.

  • If no proposal is available, the field should remain marked as an “Unsolved conflict.”

No Simultaneous Messages:

  • “Unsolved conflict” and “Solved conflict” messages should never appear together.

Screenshots (if relevant):

Image

@pborgonovi pborgonovi added bug Fixes for quality problems that affect the customer experience impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team triage_needed labels Nov 19, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@banderror
Copy link
Contributor

@pborgonovi Yes, this UI is very confusing and we discussed this during the demo made by @maximpn at the product meeting.

We'll keep the bug: we discussed with @maximpn @nikitaindik and @xcrzx that we should prioritize fixing rule upgrade blockers and UX issues such as this one in the next 1 or 2 weeks.

@banderror banderror added Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area 8.18 candidate and removed triage_needed labels Nov 23, 2024
@banderror banderror changed the title [Security Solution] Inconsistent Conflict State Messaging in Update Flyout for Removed Related Integrations [Security Solution] Inconsistent conflict state messaging in Rule Upgrade flyout Nov 23, 2024
@banderror banderror assigned maximpn and nikitaindik and unassigned banderror Nov 23, 2024
@banderror
Copy link
Contributor

@pborgonovi This one should have been fixed by @maximpn in #201501

@pborgonovi
Copy link
Contributor Author

Retested with latest changes and fix looks good:

Without Elastic updates:

Image

With Elastic updates causing unsolved conflict:

Image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
8.18 candidate bug Fixes for quality problems that affect the customer experience Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area fixed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.18.0
Projects
None yet
Development

No branches or pull requests

5 participants