Skip to content

[SIEM] Navigating from the Overview to the Detections page resets date selection in 7.6.1 #60076

@andrew-goldstein

Description

@andrew-goldstein

Kibana version:

7.6.1

Describe the bug:

In 7.6.0, navigating from the Overview page to the Detections page via clicking on the View signals and View alerts buttons carries-over the date range selected on the Overview page, but in 7.6.1, the global date picker on the Detections page resets to Last 24 hours.

The change in behavior is related to new cache invalidation logic on the Detections page (introduced in 7.6.1), however as a root-cause, all inter-app link-to buttons in the SIEM app, including the existing Veiw hosts and View network buttons, should always include URL state as query string parameters. (Otherwise, the single-click vs "open in new tab" behavior of inter-app link-to links will differ; single-clicking a link-to link will carry-over state, but "open in new tab" actions will not.)

Steps to reproduce:

  1. Click on the SIEM icon in Kibana's side navigation to load a fresh instance of the SIEM app (with no URL state)
  2. On the Overview page, change the global date picker from it's default to Last 30 minutes
  3. Click the View signals or View alerts button on the Overview page

Expected behavior:

The global date picker on the Detections page retains the Last 30 minutes selection

Actual behavior:

The global date picker on the Detections page reverts to the Last 24 hours, per the animated gif below:

date-picker-reset

Metadata

Metadata

Assignees

No one assigned

    Labels

    Team: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:SIEMbugFixes for quality problems that affect the customer experiencev7.6.1

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions