Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error when pinning an agent to vulnerabilities when using an index pattern other than default wazuh-alerts #6826

Closed
jbiset opened this issue Jul 16, 2024 · 1 comment · Fixed by #6827
Assignees
Labels
level/task Task issue type/bug Bug issue

Comments

@jbiset
Copy link
Member

jbiset commented Jul 16, 2024

Description

When an index pattern is used for wazuh-alerts that is not wazuh-alerts-*, in the vulnerabilities module when pinning an agent its filter appears with an error

Steps to reproduce

1- It is necessary to remove both the index and the index pattern from wazuh-alerts-*.
2- To emulate the problem, the indexes generated with sample data will be used, so sample data must be added.
3- The default index pattern name in AppSettings must be changed. In this case I changed to wazuh-alerts-4.x-sample-security to take advantage of the sample data.

image

4- An index pattern named wazuh-alerts-4.x-sample-security must be created to match the wazuh-alerts-4.x-sample-security index of sample data.
5- Go to the vulnerabilities module, pin an agent in Dashboard/Inventory and then go to the Events tab. When you do this, the pinned agent filter will show an error.

Expected Result

  1. The pinned agent filter should appear correctly without error

Actual Result

  1. The pinned agent filter will show an error

Screenshots

The pinned agent error

image

@jbiset jbiset added type/bug Bug issue level/task Task issue labels Jul 16, 2024
@jbiset jbiset self-assigned this Jul 16, 2024
@jbiset
Copy link
Member Author

jbiset commented Jul 16, 2024

Triage

When you go from the Dashboard/Inventory tab to the Events tab, when Dashboard/Inventory is unmounted, different methods are executed to change from the vulnerabilities index pattern (used in Dashboard/Inventory) to the wazuh-alerts index pattern. However, when these methods are executed, the prevStoragePattern parameter that defines the target index pattern is arriving with null, defaulting to the constant WAZUH_ALERTS_PATTERN, whose value is wazuh-alerts-* (See image below).

image

This causes it to not take into account the name of the configured index pattern, in this case wazuh-alerts, generating the error in the filter.
In order to solve this, it is necessary to change the use of that constant to the currentPattern stored in the application cache through AppState.getCurrentPattern(), as shown below.

image

This way, instead of taking the value of the constant it now takes the value of the currentPattern as it should be, solving the problem:

image

@wazuhci wazuhci moved this to In progress in Release 4.8.1 Jul 16, 2024
@jbiset jbiset changed the title Error when pinning an agent to vulnerabilities when using an index pattern other than wazuh-alerts-* Error when pinning an agent to vulnerabilities when using an index pattern other than default wazuh-alerts Jul 16, 2024
@wazuhci wazuhci moved this from In progress to Pending review in Release 4.8.1 Jul 16, 2024
@asteriscos asteriscos linked a pull request Jul 16, 2024 that will close this issue
6 tasks
@wazuhci wazuhci moved this from Pending review to Pending final review in Release 4.8.1 Jul 16, 2024
@wazuhci wazuhci moved this from Pending final review to Done in Release 4.8.1 Jul 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
level/task Task issue type/bug Bug issue
Projects
No open projects
Status: Done
Development

Successfully merging a pull request may close this issue.

2 participants