elastic/kibana

[Security Solution] Deleting exception container using the API can break a rule

Open

#163,122 opened on Aug 3, 2023

View on GitHub
 (2 comments) (0 reactions) (0 assignees)TypeScript (8,021 forks)batch import
Feature:Rule ExceptionsTeam: SecuritySolutionTeam:Detection EngineTeam:Detection EngineeringTeam:Detections and Respbugeffort:mediumgood first issueimpact:mediumvalue:high

Repository metrics

Stars
 (19,065 stars)
PR merge metrics
 (Avg merge 1d 16h) (999 merged PRs in 30d)

Description

Describe the bug: Deleting exception container using the API can break any linked rules.

Kibana/Elasticsearch Stack version: 8.7.0

Steps to reproduce: Occurs when deleting an exception container from a rule with at least 1 exception item using the API without first removing/unlinking the exception from the rule.

  1. Create a rule and link an exception container with at least 1 item.
  2. Delete the exception container using the API without unlinking the rule first.

Current behavior: The Kibana interface for a given rule is broken and rules are stuck with non-existent exception containers.

Expected behavior: Add a warning to the docs or unlink all rules automatically when deleting an exception container.

Screenshots (if relevant): image

Contributor guide

Research direction
Investigate how the delete exception container API endpoint interacts with linked rules. Determine whether rules should be automatically unlinked or a warning should be displayed.
Tech stack
typescriptnodejsrest apielasticsearch
Domain
backendapi
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
REST APIElasticsearch
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65