Skip to content

[Security Solution] Validation is not triggered correctly in rule actions form #142217

Open

Description

Steps to reproduce

Issue was found, once working on #140593.
Rule actions form is marked as invalid, even though all fields are populated in slack action form

Screen.Recording.2022-09-26.at.12.36.53.mov
  1. open rule actions form
  2. add slack action
  3. remove slack action
  4. add again slack action
  5. press Save rule
  6. validation error is displayed

Technical overview

Once slack rule actions form is rendered:
First setActionIdByIndex in x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_field/index.tsx fires update to actions field of form (but w/o params properties, only type of selector in action).
Then, subsequently setActionParamsProperty updates params in field actions of form with values displayed if form controls through calling field.setValue. In our case, it is a message form field in slack action form.

These updates trigger form validation, defined in schema:

  actions: {
    validations: [
      {
        validator: validateRuleActionsField(actionTypeRegistry),
      },
    ],
  },

validateRuleActionsField receives in curried function argument field value:

    const [{ value, path }] = data as [{ value: RuleAction[]; path: string }];

which doesn't have updates set in setActionParamsProperty, hence form is marked as invalid. It happens consistently when you add some action, remove it, add again it.

Here is logged form value of actions in functions calls

setActionIdByIndex [
  {
    "id": "50a49d70-34d4-11ed-87dc-f3f665e2eedb",
    "actionTypeId": ".slack",
    "group": "default",
    "params": {}
  }
]
validateRuleActionsField [
  {
    "id": "50a49d70-34d4-11ed-87dc-f3f665e2eedb",
    "actionTypeId": ".slack",
    "group": "default",
    "params": {}
  }
]
validateRuleActionsField [
  {
    "id": "50a49d70-34d4-11ed-87dc-f3f665e2eedb",
    "actionTypeId": ".slack",
    "group": "default",
    "params": {}
  }
]
setActionParamsProperty [
  {
    "id": "50a49d70-34d4-11ed-87dc-f3f665e2eedb",
    "actionTypeId": ".slack",
    "group": "default",
    "params": {
      "message": "Rule {{context.rule.name}} generated {{state.signals_count}} alerts"
    }
  }
]

From the log above: validateRuleActionsField is not getting called after setActionParamsProperty is called, instead validateRuleActionsField called twice after setActionIdByIndex has been triggered.

Expected behaviour

Validation to be triggered once new params values were updated through setActionParamsProperty.

Workaround

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    Feature:Alerting/RuleActionsIssues related to the Actions attached to Rules on the Alerting FrameworkFeature:Rule ActionsSecurity Solution Rule Actions featureFeature:Rule CreationSecurity Solution Detection Rule CreationTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection EngineSecurity Solution Detection Engine AreaTeam:Detections and RespSecurity Detection Response TeambugFixes for quality problems that affect the customer experienceimpact:mediumAddressing this issue will have a medium level of impact on the quality/strength of our product.technical debtImprovement of the software architecture and operational architecture

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions