Closed

Description
Describe the bug
{{alert.id}} and {{state.signals_count}} Object not working
Build Details:
Version:8.8
Commit:d0327fc75720e56ee76b640f07ffd1b154a348a8
Build:62765
Pre-conditions
- Rule Should be available on kibana instance
- Any one Connector should be available let say we have Ethereal mail instance
Steps
- Navigate to Rule Details page and Edit it
- Go to Actions and select any one connector let say Email
- Choose For each Alert with Per Rule Run as Action Frequency
- under Message body box click on add variable and search for state.signals_count and add that variable to message
{{state.signals_count}}
- Save the changes and generate the alert
- Observed on Connector that is Ethereal the {{state.signals_count}} variable value is not showing
- Now Edit the Rule again
- Choose Summary of Alert with Per Rule Run as Action Frequency
- Edit the existing Message body texx by appending {{alert.id}} variable
Rule {{context.rule.name}} generated {{state.signals_count}} alerts {{alert.id}}
- Save the changes and generate the alert
- Observed on Connector that is Ethereal the {{alert.id}} variable value is not showing
Action Frequency | Working | Not Workring |
---|---|---|
Summary of Alert Per Rule Run | {{state.signals_count}} | {{alert.id}} ❌ |
For Each Alert Per Rule Run | {{alert.id}} | {{state.signals_count}} ❌ |
Expected Result
- state.signals_count and alert.id variable should work for both action frequency or if they are not practical we have to restrict them being added in Message body plus not show invalid variable like state.signals_count variable is showing in variable list to be used for For Each Alert but as it is not working
Screen-Shot
Rules.-.Kibana.Mozilla.Firefox.2023-05-03.12-58-10.mp4
Metadata
Assignees
Labels
Issue has been validated by QASecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Detection Alerts Area TeamSecurity Detection Response TeamFixes for quality problems that affect the customer experienceAddressing this issue will have a medium level of impact on the quality/strength of our product.
Activity