Skip to content

[Security Solution][Detection Engine] improve error messaging for value lists exceptions during rule execution #180349

Open

Description

Describe the issue:

Currently when value list is not applied in exception during rule execution, rule will have warning status with a general error message that does not give any information why exception did not work.

For example, if value is list is larger than 65k, the warning message will be logged as:

Screenshot 2024-04-09 at 10 11 22

No reason is why it happened. Similarly, exception value list can be not applied if ip_range list is greater than 200.
Or if any ES request to value list fails within https://github.com/elastic/kibana/blob/8.13/x-pack/plugins/lists/server/services/exception_lists/build_exception_filter.ts file utilities.

Instead, warning message should also contain a reason why exception did not apply.
Something like:

The following exceptions won't be applied to rule execution: Large value list. Value list is greater than limit 65k

Depends on an actual reason, why exception did not apply during rule run.

This enhancing messaging would greatly help us and customers in troubleshooting exception related issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    8.15 candidateTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection EngineSecurity Solution Detection Engine AreaenhancementNew value added to drive a business resultsdh-linkedtechnical debtImprovement of the software architecture and operational architecturetriage_needed

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions