Skip to content

[Security Solution] “Author” and “License” Fields Are Editable in UI but Result in Errors When Updated #200251

@pborgonovi

Description

@pborgonovi

Describe the bug:
In the rule editing UI, the fields “Author” and “License” for prebuilt rules are currently enabled, allowing users to make edits. However, when the user attempts to save the changes, errors occur:

For the Author field: “Cannot update ‘author’ field for prebuilt rules (400)”
For the License field: “Cannot update ‘license’ field for prebuilt rules (400)”

The backend validation correctly blocks these changes, as these fields are not meant to be edited for prebuilt rules. However, the UI behavior is misleading, as it suggests that these fields can be modified.

Kibana/Elasticsearch Stack version:
8.x

Current branch: 8.x  
Latest commit: d0c9a2f1f52 - [8.x] [Stack Monitoring / Logs] Fix Stack Monitoring logs links (#200043) (#200227)  
Remote tracking: origin/8.x  
Status relative to remote: up to date (no pending commits)  

Server OS version:

Browser and Browser OS versions:

Elastic Endpoint version:

Original install method (e.g. download page, yum, from source, etc.):

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Steps to reproduce:

  1. Open the Edit Rule page for a prebuilt rule.
  2. Modify the “Author” or “License” field.
  3. Attempt to save the changes.
  4. Observe the following errors in the UI:
    • For “Author”: “Cannot update ‘author’ field for prebuilt rules (400)”
    • For “License”: “Cannot update ‘license’ field for prebuilt rules (400)”

Current behavior:
The “Author” and “License” fields are enabled and editable in the UI.

Expected behavior:
The “Author” and “License” fields should be disabled (read-only) in the UI for prebuilt rules, preventing users from attempting to edit them.

Screenshots (if relevant):

Screen.Recording.2024-11-14.at.11.49.38.AM.mov

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context (logs, chat logs, magical formulas, etc.):

Metadata

Metadata

Assignees

Labels

8.18 candidateFeature:Prebuilt Detection RulesSecurity Solution Prebuilt Detection Rules areaFeature:Rule EditSecurity Solution Detection Rule Editing workflowTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeambugFixes for quality problems that affect the customer experiencefixedimpact:mediumAddressing this issue will have a medium level of impact on the quality/strength of our product.v8.17.0v8.18.0

Type

No fields configured for Bug.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions