Skip to content

[Security Solution]{{alert.id}} and {{state.signals_count}} Object not working #156472

Closed
@ghost

Description

Describe the bug
{{alert.id}} and {{state.signals_count}} Object not working

Build Details:

Version:8.8
Commit:d0327fc75720e56ee76b640f07ffd1b154a348a8
Build:62765

Pre-conditions

  • Rule Should be available on kibana instance
  • Any one Connector should be available let say we have Ethereal mail instance

Steps

  • Navigate to Rule Details page and Edit it
  • Go to Actions and select any one connector let say Email
  • Choose For each Alert with Per Rule Run as Action Frequency
  • under Message body box click on add variable and search for state.signals_count and add that variable to message

{{state.signals_count}}

  • Save the changes and generate the alert
  • Observed on Connector that is Ethereal the {{state.signals_count}} variable value is not showing
  • Now Edit the Rule again
  • Choose Summary of Alert with Per Rule Run as Action Frequency
  • Edit the existing Message body texx by appending {{alert.id}} variable

Rule {{context.rule.name}} generated {{state.signals_count}} alerts {{alert.id}}

  • Save the changes and generate the alert
  • Observed on Connector that is Ethereal the {{alert.id}} variable value is not showing
Action Frequency Working Not Workring
Summary of Alert Per Rule Run {{state.signals_count}} {{alert.id}} ❌
For Each Alert Per Rule Run {{alert.id}} {{state.signals_count}} ❌

Expected Result

  • state.signals_count and alert.id variable should work for both action frequency or if they are not practical we have to restrict them being added in Message body plus not show invalid variable like state.signals_count variable is showing in variable list to be used for For Each Alert but as it is not working

Screen-Shot

image

image

Rules.-.Kibana.Mozilla.Firefox.2023-05-03.12-58-10.mp4

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

Labels

QA:ValidatedIssue has been validated by QATeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection AlertsSecurity Detection Alerts Area TeamTeam:Detections and RespSecurity Detection Response TeambugFixes for quality problems that affect the customer experiencefixedimpact:mediumAddressing this issue will have a medium level of impact on the quality/strength of our product.v8.8.0

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions