Skip to content

Commit fdeed82

Browse files
authored
Prevent removal of actions via the UI from breaking rule AAD (#68184) (#68681)
This fixes #64870 _for real_. The issue ended up being caused by a conditional form field that mapped to a nested field on the rule's params: when a rule is created with an action, it has a meta.kibana_siem_app_url field. When the rule's actions were removed via the UI, that field was _also_ removed, which broke AAD and thus rule execution. This fixes the issue by making that field unconditional, and also removes the previous workaround.
1 parent 1e92db2 commit fdeed82

File tree

2 files changed

+5
-9
lines changed

2 files changed

+5
-9
lines changed

x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_rule_actions/index.tsx

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,6 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
158158
{myStepData.throttle !== stepActionsDefaultValue.throttle ? (
159159
<>
160160
<EuiSpacer />
161-
162161
<UseField
163162
path="actions"
164163
defaultValue={myStepData.actions}
@@ -167,11 +166,6 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
167166
messageVariables: actionMessageParams,
168167
}}
169168
/>
170-
<UseField
171-
path="kibanaSiemAppUrl"
172-
defaultValue={kibanaAbsoluteUrl}
173-
component={GhostFormField}
174-
/>
175169
</>
176170
) : (
177171
<UseField
@@ -180,6 +174,11 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
180174
component={GhostFormField}
181175
/>
182176
)}
177+
<UseField
178+
path="kibanaSiemAppUrl"
179+
defaultValue={kibanaAbsoluteUrl}
180+
component={GhostFormField}
181+
/>
183182
<UseField path="enabled" defaultValue={myStepData.enabled} component={GhostFormField} />
184183
</EuiForm>
185184
</Form>

x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules_notifications.ts

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,5 @@ export const updateRulesNotifications = async ({
4545
interval: ruleActions.alertThrottle,
4646
});
4747

48-
// TODO: Workaround for https://github.com/elastic/kibana/issues/67290
49-
await alertsClient.updateApiKey({ id: ruleAlertId });
50-
5148
return ruleActions;
5249
};

0 commit comments

Comments
 (0)