-
Notifications
You must be signed in to change notification settings - Fork 8.6k
[Security Solution] “Author” and “License” Fields Are Editable in UI but Result in Errors When Updated #200251
Copy link
Copy link
Labels
8.18 candidateFeature:Prebuilt Detection RulesSecurity Solution Prebuilt Detection Rules areaSecurity Solution Prebuilt Detection Rules areaFeature:Rule EditSecurity Solution Detection Rule Editing workflowSecurity Solution Detection Rule Editing workflowTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeamSecurity Detection Response TeambugFixes for quality problems that affect the customer experienceFixes for quality problems that affect the customer experiencefixedimpact:mediumAddressing this issue will have a medium level of impact on the quality/strength of our product.Addressing this issue will have a medium level of impact on the quality/strength of our product.v8.17.0v8.18.0
Metadata
Metadata
Assignees
Labels
8.18 candidateFeature:Prebuilt Detection RulesSecurity Solution Prebuilt Detection Rules areaSecurity Solution Prebuilt Detection Rules areaFeature:Rule EditSecurity Solution Detection Rule Editing workflowSecurity Solution Detection Rule Editing workflowTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeamSecurity Detection Response TeambugFixes for quality problems that affect the customer experienceFixes for quality problems that affect the customer experiencefixedimpact:mediumAddressing this issue will have a medium level of impact on the quality/strength of our product.Addressing this issue will have a medium level of impact on the quality/strength of our product.v8.17.0v8.18.0
Type
Fields
Give feedbackNo fields configured for Bug.
Describe the bug:
In the rule editing UI, the fields “Author” and “License” for prebuilt rules are currently enabled, allowing users to make edits. However, when the user attempts to save the changes, errors occur:
For the Author field: “Cannot update ‘author’ field for prebuilt rules (400)”
For the License field: “Cannot update ‘license’ field for prebuilt rules (400)”
The backend validation correctly blocks these changes, as these fields are not meant to be edited for prebuilt rules. However, the UI behavior is misleading, as it suggests that these fields can be modified.
Kibana/Elasticsearch Stack version:
8.x
Server OS version:
Browser and Browser OS versions:
Elastic Endpoint version:
Original install method (e.g. download page, yum, from source, etc.):
Functional Area (e.g. Endpoint management, timelines, resolver, etc.):
Steps to reproduce:
• For “Author”: “Cannot update ‘author’ field for prebuilt rules (400)”
• For “License”: “Cannot update ‘license’ field for prebuilt rules (400)”
Current behavior:
The “Author” and “License” fields are enabled and editable in the UI.
Expected behavior:
The “Author” and “License” fields should be disabled (read-only) in the UI for prebuilt rules, preventing users from attempting to edit them.
Screenshots (if relevant):
Screen.Recording.2024-11-14.at.11.49.38.AM.mov
Errors in browser console (if relevant):
Provide logs and/or server output (if relevant):
Any additional context (logs, chat logs, magical formulas, etc.):