Skip to content

[Security Solution] Value lists cannot be deleted when the name of the uploaded file has a special character #86273

@MadameSheema

Description

@MadameSheema

Describe the bug:

  • Value lists cannot be deleted when the name of the uploaded file has a special character like (

Kibana/Elasticsearch Stack version:

  • 7.11.0 BC1

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

  • Value lists

Preconditions:

  • To have uploaded a value list with a name with special characters i.e. 1000_words (1).csv

Steps to reproduce:

  1. Navigate to Security > Detections
  2. Click on Manage detection rules button
  3. Click on Upload value lists
  4. Click on the Icon trash
  5. Click on Remove value list

Current behavior:

  • No error message is displayed
  • Value list is not deleted

Expected behavior:

  • The value list is deleted

Errors in browser console (if relevant):

{"message":"KQLSyntaxError: Expected \")\", AND, OR, whitespace but \"(\" found.\n(exception-list.attributes.list_type: item AND exception-list.attributes.entries.list.id:1000_words (1).csv) OR (exception-list-agnostic.attributes.list_type: item AND exception-list-agnostic.attributes.entries.list.id:1000_words (1).csv) \n----------------------------------------------------------------------------------------------------^: Bad Request","status_code":400}

Metadata

Metadata

Assignees

Labels

Feature:Rule Value ListsSecurity Solution Detection Rule Value Lists areaQA:ValidatedIssue has been validated by QATeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detections and RespSecurity Detection Response TeambugFixes for quality problems that affect the customer experienceimpact:highAddressing this issue will have a high level of impact on the quality/strength of our product.v7.12.0

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions