Kibana version:
7.9.0
Describe the bug:
CIDR queries for threshold rules do not work. If you add a CIDR query to a threshold rule it will not be able to correctly insert the signal because of the way it creates the synthetic signal in the file:
x-pack/plugins/security_solution/server/lib/detection_engine/signals/bulk_create_threshold_signals.ts
Steps to reproduce:
Create a threshold rule with a CIDR like below on a threshold rule:
destination.ip: 10.142.0.7/16
Run it and notice in your logs you see this error:
server log [13:43:52.965] [error][plugins][plugins][securitySolution][securitySolution] [-] bulkResponse had errors with responses of: {"failed to parse field [destination.ip] of type [ip] in document with id '75dc881c04149cc021e7e2ed5242e74349d33ff62ae1ce57317195738b200546'. Preview of field's value: '10.142.0.7/16'":{"count":1,"statusCode":400}}
Expected behavior:
It should write out the signal and not have errors.
Unit test for the code that shows the problem:
In this file:
x-pack/plugins/security_solution/server/lib/detection_engine/signals/bulk_create_threshold_signals.test.ts
Add this test:
it('should NOT add invalid characters from CIDR such as the "/" proper object for simple match_phrase filters', () => {
const filters = {
bool: {
must: [],
filter: [
{
bool: {
should: [
{
match: {
'destination.ip': '192.168.0.0/16',
},
},
],
minimum_should_match: 1,
},
},
],
should: [],
must_not: [],
},
};
expect(getThresholdSignalQueryFields(filters)).toEqual({
'destination.ip': '192.168.0.16',
});
});Get this failed result to fix:
● getThresholdSignalQueryFields › should NOT add invalid characters from CIDR such as the "/" proper object for simple match_phrase filters
expect(received).toEqual(expected) // deep equality
- Expected - 1
+ Received + 1
Object {
- "destination.ip": "192.168.0.16",
+ "destination.ip": "192.168.0.0/16",
Kibana version:
7.9.0
Describe the bug:
CIDR queries for threshold rules do not work. If you add a CIDR query to a threshold rule it will not be able to correctly insert the signal because of the way it creates the synthetic signal in the file:
Steps to reproduce:
Create a threshold rule with a CIDR like below on a threshold rule:
Run it and notice in your logs you see this error:
Expected behavior:
It should write out the signal and not have errors.
Unit test for the code that shows the problem:
In this file:
Add this test:
Get this failed result to fix: