Skip to content

[ResponseOps][Security][Rules] Fix fields missing from Cases action in Security Solution rule form#210547

Merged
umbopepato merged 5 commits intoelastic:mainfrom
umbopepato:210209-fix-cases-system-action-missing-fields
Feb 20, 2025
Merged

[ResponseOps][Security][Rules] Fix fields missing from Cases action in Security Solution rule form#210547
umbopepato merged 5 commits intoelastic:mainfrom
umbopepato:210209-fix-cases-system-action-missing-fields

Conversation

@umbopepato
Copy link
Member

@umbopepato umbopepato commented Feb 11, 2025 •
edited by kibanamachine
Loading

Summary

Correctly forwards the selected rule type id to the actions form section in the Security Solution rule creation/update flow.
Adds a functional test case to cover the bug.

To verify

  1. Navigate to Security > Rules > Detection rules > Create new rule
  2. Fill in the first 3 steps
  3. In the Actions step, select the Cases action
  4. Check that the Group by alert field dropdown shows the correct alert fields
  5. Create the rule, then repeat point 5 in the rule editing UI

References

Fixes #210209

@umbopepato umbopepato added Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// v9.1.0 labels Feb 11, 2025
@umbopepato umbopepato marked this pull request as ready for review February 11, 2025 14:36
@umbopepato umbopepato requested a review from a team as a code owner February 11, 2025 14:36
@elasticmachine
Copy link
Contributor

elasticmachine commented Feb 11, 2025

Pinging @elastic/response-ops (Team:ResponseOps)

@umbopepato umbopepato added the release_note:skip Skip the PR/issue when compiling release notes label Feb 11, 2025
jcger
jcger reviewed Feb 12, 2025
View reviewed changes
Copy link
Contributor

@jcger jcger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I miss a test to ensure it does not happen again

@umbopepato
Copy link
Member Author

umbopepato commented Feb 14, 2025 •
edited
Loading

I miss a test to ensure it does not happen again

@jcger it's not easy to test this on our side: the CasesParamsFieldsComponent was simply not receiving any rule type id from the ancestors (Security's own version of the rule form). I'll ask Security what would be an appropriate functional test to cover this case and contribute to their testing suite since I don't see any alternative way to test this in our code if not by throwing an error in case the ruleTypeId prop is undefined (this might make any related functional tests fail in case).

@cnasikas cnasikas added v9.0.0 backport:version Backport to applied version labels v8.18.0 v8.19.0 and removed release_note:skip Skip the PR/issue when compiling release notes labels Feb 18, 2025
@dhurley14 dhurley14 requested review from dhurley14 and removed request for nkhristinin February 18, 2025 14:49
@umbopepato umbopepato requested review from a team as code owners February 18, 2025 15:57
@cnasikas cnasikas added the release_note:skip Skip the PR/issue when compiling release notes label Feb 18, 2025
@dhurley14
Copy link
Contributor

dhurley14 commented Feb 18, 2025 •
edited
Loading

Edit: Approved - Difficult to enforce the required type when used generically for the actions form.

Hi @umbopepato,

Thank you for the quick fix. Is it possible to include in this PR a change to make the ruleTypeId param required for this component? Looks like the ruleTypeId is used in this hook useAlertsDataView and if it's undefined the hook is provided with an empty array which leads to the broken functionality reported in the bug.

If the field can be typed as a required field, it might be nice to type it as an array of allowed values. I believe since these rule type ids are not changing much maybe we could write a stricter type for that hook param, like type RULE_TYPE_IDS = Array<typeof EQL_RULE_TYPE_ID | typeof ESQL_RULE_TYPE_ID ...>; As opposed to how it is currently typed as string[] which allows for an empty array which re-introduces the bug we saw. The security solution keeps a list of the rule type ids we register here src/platform/packages/shared/kbn-securitysolution-rules/src/rule_type_constants.ts.

@umbopepato
Copy link
Member Author

umbopepato commented Feb 20, 2025 •
edited
Loading

If the field can be typed as a required field, it might be nice to type it as an array of allowed values. I believe since these rule type ids are not changing much maybe we could write a stricter type for that hook param, like type RULE_TYPE_IDS = Array<typeof EQL_RULE_TYPE_ID | typeof ESQL_RULE_TYPE_ID ...>; As opposed to how it is currently typed as string[] which allows for an empty array which re-introduces the bug we saw. The security solution keeps a list of the rule type ids we register here src/platform/packages/shared/kbn-securitysolution-rules/src/rule_type_constants.ts.

Hey @dhurley14, thanks for taking a look! 😊

Thank you for the quick fix. Is it possible to include in this PR a change to make the ruleTypeId param required for this component? Looks like the ruleTypeId is used in this hook useAlertsDataView and if it's undefined the hook is provided with an empty array which leads to the broken functionality reported in the bug.

Unfortunately that's something we cannot do easily: the CasesParamsFieldsComponent props are based on ActionParamsProps, like any other action editor component. Making ruleTypeId required there is wrong since not all action components depend on it. On the other hand, just making the prop required breaks the connector definition because the types become incompatible and doesn't help avoiding this issue since the component is instantiated dynamically by the generic action form.

@umbopepato umbopepato enabled auto-merge (squash) February 20, 2025 15:35
@umbopepato umbopepato merged commit 0abbd17 into elastic:main Feb 20, 2025
10 checks passed
@kibanamachine
Copy link
Contributor

kibanamachine commented Feb 20, 2025

Starting backport for target branches: 8.18, 8.x, 9.0

https://github.com/elastic/kibana/actions/runs/13441279794

@elasticmachine
Copy link
Contributor

elasticmachine commented Feb 20, 2025

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 8.9MB 8.9MB +405.0B

History

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 20, 2025
@umbopepato
[ResponseOps][Security][Rules] Fix fields missing from Cases action i…
754a0ae 
…n Security Solution rule form (elastic#210547)

## Summary

Correctly forwards the selected rule type id to the actions form section
in the Security Solution rule creation/update flow.
Adds a functional test case to cover the bug.

## To verify

1. Navigate to `Security > Rules > Detection rules > Create new rule`
2. Fill in the first 3 steps
3. In the Actions step, select the Cases action
4. Check that the `Group by alert field` dropdown shows the correct
alert fields
5. Create the rule, then repeat point 5 in the rule editing UI

## References

Fixes elastic#210209

(cherry picked from commit 0abbd17)
@kibanamachine kibanamachine mentioned this pull request Feb 20, 2025
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 20, 2025
@umbopepato
[ResponseOps][Security][Rules] Fix fields missing from Cases action i…
f86fb44 
…n Security Solution rule form (elastic#210547)

## Summary

Correctly forwards the selected rule type id to the actions form section
in the Security Solution rule creation/update flow.
Adds a functional test case to cover the bug.

## To verify

1. Navigate to `Security > Rules > Detection rules > Create new rule`
2. Fill in the first 3 steps
3. In the Actions step, select the Cases action
4. Check that the `Group by alert field` dropdown shows the correct
alert fields
5. Create the rule, then repeat point 5 in the rule editing UI

## References

Fixes elastic#210209

(cherry picked from commit 0abbd17)
@kibanamachine kibanamachine mentioned this pull request Feb 20, 2025
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 20, 2025
@umbopepato
[ResponseOps][Security][Rules] Fix fields missing from Cases action i…
b709cb2 
…n Security Solution rule form (elastic#210547)

## Summary

Correctly forwards the selected rule type id to the actions form section
in the Security Solution rule creation/update flow.
Adds a functional test case to cover the bug.

## To verify

1. Navigate to `Security > Rules > Detection rules > Create new rule`
2. Fill in the first 3 steps
3. In the Actions step, select the Cases action
4. Check that the `Group by alert field` dropdown shows the correct
alert fields
5. Create the rule, then repeat point 5 in the rule editing UI

## References

Fixes elastic#210209

(cherry picked from commit 0abbd17)
@kibanamachine kibanamachine mentioned this pull request Feb 20, 2025
Merged
@kibanamachine
Copy link
Contributor

kibanamachine commented Feb 20, 2025

💚 All backports created successfully

Status Branch Result
✅ 8.18
✅ 8.x
✅ 9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Feb 20, 2025
@kibanamachine @umbopepato
[8.x] [ResponseOps][Security][Rules] Fix fields missing from Cases ac…
9b062e2 
…tion in Security Solution rule form (#210547) (#211943)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[ResponseOps][Security][Rules] Fix fields missing from Cases action
in Security Solution rule form
(#210547)](#210547)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Umberto
Pepato","email":"umbopepato@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-02-20T17:36:39Z","message":"[ResponseOps][Security][Rules]
Fix fields missing from Cases action in Security Solution rule form
(#210547)\n\n## Summary\n\nCorrectly forwards the selected rule type id
to the actions form section\nin the Security Solution rule
creation/update flow.\nAdds a functional test case to cover the
bug.\n\n## To verify\n\n1. Navigate to `Security > Rules > Detection
rules > Create new rule`\n2. Fill in the first 3 steps\n3. In the
Actions step, select the Cases action\n4. Check that the `Group by alert
field` dropdown shows the correct\nalert fields\n5. Create the rule,
then repeat point 5 in the rule editing UI\n\n## References\n\nFixes
#210209","sha":"0abbd173b124bcb5f83a377c3923f57120f144e9","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:ResponseOps","v9.0.0","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[ResponseOps][Security][Rules]
Fix fields missing from Cases action in Security Solution rule
form","number":210547,"url":"https://github.com/elastic/kibana/pull/210547","mergeCommit":{"message":"[ResponseOps][Security][Rules]
Fix fields missing from Cases action in Security Solution rule form
(#210547)\n\n## Summary\n\nCorrectly forwards the selected rule type id
to the actions form section\nin the Security Solution rule
creation/update flow.\nAdds a functional test case to cover the
bug.\n\n## To verify\n\n1. Navigate to `Security > Rules > Detection
rules > Create new rule`\n2. Fill in the first 3 steps\n3. In the
Actions step, select the Cases action\n4. Check that the `Group by alert
field` dropdown shows the correct\nalert fields\n5. Create the rule,
then repeat point 5 in the rule editing UI\n\n## References\n\nFixes
#210209","sha":"0abbd173b124bcb5f83a377c3923f57120f144e9"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/210547","number":210547,"mergeCommit":{"message":"[ResponseOps][Security][Rules]
Fix fields missing from Cases action in Security Solution rule form
(#210547)\n\n## Summary\n\nCorrectly forwards the selected rule type id
to the actions form section\nin the Security Solution rule
creation/update flow.\nAdds a functional test case to cover the
bug.\n\n## To verify\n\n1. Navigate to `Security > Rules > Detection
rules > Create new rule`\n2. Fill in the first 3 steps\n3. In the
Actions step, select the Cases action\n4. Check that the `Group by alert
field` dropdown shows the correct\nalert fields\n5. Create the rule,
then repeat point 5 in the rule editing UI\n\n## References\n\nFixes
#210209","sha":"0abbd173b124bcb5f83a377c3923f57120f144e9"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Umberto Pepato <umbopepato@users.noreply.github.com>
kibanamachine added a commit that referenced this pull request Feb 20, 2025
@kibanamachine @umbopepato
[9.0] [ResponseOps][Security][Rules] Fix fields missing from Cases ac…
dbe2e4c 
…tion in Security Solution rule form (#210547) (#211944)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[ResponseOps][Security][Rules] Fix fields missing from Cases action
in Security Solution rule form
(#210547)](#210547)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Umberto
Pepato","email":"umbopepato@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-02-20T17:36:39Z","message":"[ResponseOps][Security][Rules]
Fix fields missing from Cases action in Security Solution rule form
(#210547)\n\n## Summary\n\nCorrectly forwards the selected rule type id
to the actions form section\nin the Security Solution rule
creation/update flow.\nAdds a functional test case to cover the
bug.\n\n## To verify\n\n1. Navigate to `Security > Rules > Detection
rules > Create new rule`\n2. Fill in the first 3 steps\n3. In the
Actions step, select the Cases action\n4. Check that the `Group by alert
field` dropdown shows the correct\nalert fields\n5. Create the rule,
then repeat point 5 in the rule editing UI\n\n## References\n\nFixes
#210209","sha":"0abbd173b124bcb5f83a377c3923f57120f144e9","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:ResponseOps","v9.0.0","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[ResponseOps][Security][Rules]
Fix fields missing from Cases action in Security Solution rule
form","number":210547,"url":"https://github.com/elastic/kibana/pull/210547","mergeCommit":{"message":"[ResponseOps][Security][Rules]
Fix fields missing from Cases action in Security Solution rule form
(#210547)\n\n## Summary\n\nCorrectly forwards the selected rule type id
to the actions form section\nin the Security Solution rule
creation/update flow.\nAdds a functional test case to cover the
bug.\n\n## To verify\n\n1. Navigate to `Security > Rules > Detection
rules > Create new rule`\n2. Fill in the first 3 steps\n3. In the
Actions step, select the Cases action\n4. Check that the `Group by alert
field` dropdown shows the correct\nalert fields\n5. Create the rule,
then repeat point 5 in the rule editing UI\n\n## References\n\nFixes
#210209","sha":"0abbd173b124bcb5f83a377c3923f57120f144e9"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/210547","number":210547,"mergeCommit":{"message":"[ResponseOps][Security][Rules]
Fix fields missing from Cases action in Security Solution rule form
(#210547)\n\n## Summary\n\nCorrectly forwards the selected rule type id
to the actions form section\nin the Security Solution rule
creation/update flow.\nAdds a functional test case to cover the
bug.\n\n## To verify\n\n1. Navigate to `Security > Rules > Detection
rules > Create new rule`\n2. Fill in the first 3 steps\n3. In the
Actions step, select the Cases action\n4. Check that the `Group by alert
field` dropdown shows the correct\nalert fields\n5. Create the rule,
then repeat point 5 in the rule editing UI\n\n## References\n\nFixes
#210209","sha":"0abbd173b124bcb5f83a377c3923f57120f144e9"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Umberto Pepato <umbopepato@users.noreply.github.com>
kibanamachine added a commit that referenced this pull request Feb 21, 2025
@kibanamachine @umbopepato
[8.18] [ResponseOps][Security][Rules] Fix fields missing from Cases a…
b353c98 
…ction in Security Solution rule form (#210547) (#211942)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[ResponseOps][Security][Rules] Fix fields missing from Cases action
in Security Solution rule form
(#210547)](#210547)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Umberto
Pepato","email":"umbopepato@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-02-20T17:36:39Z","message":"[ResponseOps][Security][Rules]
Fix fields missing from Cases action in Security Solution rule form
(#210547)\n\n## Summary\n\nCorrectly forwards the selected rule type id
to the actions form section\nin the Security Solution rule
creation/update flow.\nAdds a functional test case to cover the
bug.\n\n## To verify\n\n1. Navigate to `Security > Rules > Detection
rules > Create new rule`\n2. Fill in the first 3 steps\n3. In the
Actions step, select the Cases action\n4. Check that the `Group by alert
field` dropdown shows the correct\nalert fields\n5. Create the rule,
then repeat point 5 in the rule editing UI\n\n## References\n\nFixes
#210209","sha":"0abbd173b124bcb5f83a377c3923f57120f144e9","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:ResponseOps","v9.0.0","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[ResponseOps][Security][Rules]
Fix fields missing from Cases action in Security Solution rule
form","number":210547,"url":"https://github.com/elastic/kibana/pull/210547","mergeCommit":{"message":"[ResponseOps][Security][Rules]
Fix fields missing from Cases action in Security Solution rule form
(#210547)\n\n## Summary\n\nCorrectly forwards the selected rule type id
to the actions form section\nin the Security Solution rule
creation/update flow.\nAdds a functional test case to cover the
bug.\n\n## To verify\n\n1. Navigate to `Security > Rules > Detection
rules > Create new rule`\n2. Fill in the first 3 steps\n3. In the
Actions step, select the Cases action\n4. Check that the `Group by alert
field` dropdown shows the correct\nalert fields\n5. Create the rule,
then repeat point 5 in the rule editing UI\n\n## References\n\nFixes
#210209","sha":"0abbd173b124bcb5f83a377c3923f57120f144e9"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/210547","number":210547,"mergeCommit":{"message":"[ResponseOps][Security][Rules]
Fix fields missing from Cases action in Security Solution rule form
(#210547)\n\n## Summary\n\nCorrectly forwards the selected rule type id
to the actions form section\nin the Security Solution rule
creation/update flow.\nAdds a functional test case to cover the
bug.\n\n## To verify\n\n1. Navigate to `Security > Rules > Detection
rules > Create new rule`\n2. Fill in the first 3 steps\n3. In the
Actions step, select the Cases action\n4. Check that the `Group by alert
field` dropdown shows the correct\nalert fields\n5. Create the rule,
then repeat point 5 in the rule editing UI\n\n## References\n\nFixes
#210209","sha":"0abbd173b124bcb5f83a377c3923f57120f144e9"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Umberto Pepato <umbopepato@users.noreply.github.com>
@umbopepato umbopepato mentioned this pull request Mar 7, 2025
Merged
1 task
umbopepato added a commit that referenced this pull request Mar 10, 2025
@umbopepato
[ResponseOps][Cases] Fix flaky Cases action Cypress test (#213529)
6c281ca 
## Summary

- Fixes the flaky functional test added in #210547 by adding a network
request intercept and clicking on the correct dropdown button
- Unskips the test file

## References

Closes #211959

### Checklist

- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 10, 2025
@umbopepato
[ResponseOps][Cases] Fix flaky Cases action Cypress test (elastic#213529
f965fe0 
)

## Summary

- Fixes the flaky functional test added in elastic#210547 by adding a network
request intercept and clicking on the correct dropdown button
- Unskips the test file

## References

Closes elastic#211959

### Checklist

- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

(cherry picked from commit 6c281ca)
kibanamachine added a commit that referenced this pull request Mar 10, 2025
@kibanamachine @umbopepato
[8.x] [ResponseOps][Cases] Fix flaky Cases action Cypress test (#213529…
3cae3ba 
…) (#213701)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[ResponseOps][Cases] Fix flaky Cases action Cypress test
(#213529)](#213529)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Umberto
Pepato","email":"umbopepato@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-03-10T10:16:02Z","message":"[ResponseOps][Cases]
Fix flaky Cases action Cypress test (#213529)\n\n## Summary\n\n- Fixes
the flaky functional test added in #210547 by adding a network\nrequest
intercept and clicking on the correct dropdown button\n- Unskips the
test file\n\n## References\n\nCloses #211959\n\n### Checklist\n\n- [x]
[Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests
changed","sha":"6c281caceb180c5e541ecdcf86d528cd2bafe701","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:ResponseOps","backport:version","v9.1.0","v8.19.0"],"title":"[ResponseOps][Cases]
Fix flaky Cases action Cypress
test","number":213529,"url":"https://github.com/elastic/kibana/pull/213529","mergeCommit":{"message":"[ResponseOps][Cases]
Fix flaky Cases action Cypress test (#213529)\n\n## Summary\n\n- Fixes
the flaky functional test added in #210547 by adding a network\nrequest
intercept and clicking on the correct dropdown button\n- Unskips the
test file\n\n## References\n\nCloses #211959\n\n### Checklist\n\n- [x]
[Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests
changed","sha":"6c281caceb180c5e541ecdcf86d528cd2bafe701"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/213529","number":213529,"mergeCommit":{"message":"[ResponseOps][Cases]
Fix flaky Cases action Cypress test (#213529)\n\n## Summary\n\n- Fixes
the flaky functional test added in #210547 by adding a network\nrequest
intercept and clicking on the correct dropdown button\n- Unskips the
test file\n\n## References\n\nCloses #211959\n\n### Checklist\n\n- [x]
[Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests
changed","sha":"6c281caceb180c5e541ecdcf86d528cd2bafe701"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Umberto Pepato <umbopepato@users.noreply.github.com>
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Mar 22, 2025
@umbopepato @CAWilson94
[ResponseOps][Security][Rules] Fix fields missing from Cases action i…
d92a1ab 
…n Security Solution rule form (elastic#210547)

## Summary

Correctly forwards the selected rule type id to the actions form section
in the Security Solution rule creation/update flow.
Adds a functional test case to cover the bug.

## To verify

1. Navigate to `Security > Rules > Detection rules > Create new rule`
2. Fill in the first 3 steps
3. In the Actions step, select the Cases action
4. Check that the `Group by alert field` dropdown shows the correct
alert fields
5. Create the rule, then repeat point 5 in the rule editing UI

## References

Fixes elastic#210209
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Mar 22, 2025
@umbopepato @CAWilson94
[ResponseOps][Cases] Fix flaky Cases action Cypress test (elastic#213529
9bfee6b 
)

## Summary

- Fixes the flaky functional test added in elastic#210547 by adding a network
request intercept and clicking on the correct dropdown button
- Unskips the test file

## References

Closes elastic#211959

### Checklist

- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jcger jcger jcger left review comments

@dhurley14 dhurley14 dhurley14 approved these changes

Assignees

No one assigned

Labels

backport:version Backport to applied version labels release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// v8.18.0 v8.19.0 v9.0.0 v9.1.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Security Solution] [Detections] Cases system action not loading group by fields

6 participants

@umbopepato @elasticmachine @dhurley14 @kibanamachine @jcger @cnasikas