[Endpoint] Use a search query for alert details#66912
Closed
jonathan-buttner wants to merge 1 commit intoelastic:masterfrom
Closed
[Endpoint] Use a search query for alert details#66912jonathan-buttner wants to merge 1 commit intoelastic:masterfrom
jonathan-buttner wants to merge 1 commit intoelastic:masterfrom
Conversation
jonathan-buttner
added
Feature:Endpoint
Contributor
|
Pinging @elastic/endpoint-app-team (Feature:Endpoint) |
Contributor
|
We already had a solution for this here: 6d0b12e Can we not just use that? |
Contributor
💔 Build Failed
Failed CI StepsTest FailuresKibana Pipeline / x-pack-intake-agent / X-Pack Jest Tests.x-pack/plugins/infra/public/containers/logs/log_summary.useLogSummary hook provides an empty list of buckets by defaultStandard OutStack TraceKibana Pipeline / x-pack-intake-agent / X-Pack Jest Tests.x-pack/plugins/infra/public/containers/logs/log_summary.useLogSummary hook queries for new summary buckets when the source id changesStandard OutStack TraceKibana Pipeline / x-pack-intake-agent / X-Pack Jest Tests.x-pack/plugins/infra/public/containers/logs/log_summary.useLogSummary hook queries for new summary buckets when the filter query changesStandard OutStack Traceand 1 more failures, only showing the first 3. To update your PR or re-run it, just comment with: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Retrieving alerts from ES is currently not working because of data streams. To reproduce this issue:
This will not happen when using the resolver data generator because it uses a mapping file which forces the index to not use data streams.
You should see the following in the UI
Alert UI Failure
The issue is that the ingest manager leverages v2 templates and data streams for the data sent by an endpoint. The endpoint binary is configured to send event data and alerts to
event-endpoint-1. Instead of creating a normal index in ES, a data stream will be created and the actual index will be something likeevents-endpoint-1-000001. When the alert details server code tries to retrieve the alert it uses a hard coded index value here: https://github.com/elastic/kibana/blob/master/x-pack/plugins/endpoint/common/alert_constants.ts#L19 (events-endpoint-1) and uses the ES Get api for retrieving the alert by it's ID.This fails with the following error:
To solve this, instead of using an ES Get, I've changed it to use a Search. A search on a data stream is valid. Another solution would be to encode the index of each alert in the alert list api that way the alert details handler would have the exact index (e.g.
events-endpoint-1-000001) when it does the ES Get. That solution seemed like more intrusive changes and I'm not sure what the state of transitioning this code to the SIEM app is.Testing
Connect a live endpoint and trigger an alert. You should be able to see the alert in resolver.