Skip to content

Commit 7e5dead

Browse files
authored
[7.8] fix 400 error on initial signals search (#70618) (#70663)
* fix 400 error on initial signals search (#70618) ### Summary On initial render of the SIEM pages, a 400 error was showing for POST http://localhost:5601/api/detection_engine/signals/search. This PR is a temporary fix for this bug. This initial call is being used to populate the Last alert text that shows at the top of a number of the pages. The reason the size was 0 is because we weren't interested in the signals themselves, just the timestamp of the last alert. Teamed up with @XavierM and it seems to us that the issue is the server side validation. It may be Hapi misreading the 0 as false or our updated validation not accepting size 0.
1 parent 549fc5d commit 7e5dead

File tree

1 file changed

+1
-1
lines changed
  • x-pack/plugins/siem/public/pages/detection_engine/components/signals_info

1 file changed

+1
-1
lines changed

x-pack/plugins/siem/public/pages/detection_engine/components/signals_info/query.dsl.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ export const buildLastSignalsQuery = (ruleId: string | undefined | null) => {
3030
: queryFilter,
3131
},
3232
},
33-
size: 0,
33+
size: 1,
3434
track_total_hits: true,
3535
};
3636
};

0 commit comments

Comments
 (0)