Skip to content

[SIEM] Updating an existing detection rule shows the risk and criticality of the last created rule #78572

@ismael-hasan

Description

@ismael-hasan

Kibana version: 7.9.1

Elasticsearch version: 7.9.1

Server OS version: Windows 10

Browser version: 85.0.4183.121 (Official Build) (64-bit)

Browser OS version: Windows 10

Original install method (e.g. download page, yum, from source, etc.): Unzip

Describe the bug:
When trying to update a rule, the criticality and risk levels are populated with the values of the last added rule, not the current one.
This can lead to overwriting the wanted values of the rule.

Steps to reproduce:
1 - Start with an empty detection ruleset and create the first one called test1
image

2 - Leave the about as critical and with a risk of 90
image

3 - Save it without any other customizations

4 - Create a second rule called test2 with criticality medium and risk 50

5 - Edit the first rule test1. The about tab of the rule is correctly showing its values, but when in the update UI it is prepopulated with the values of test2, not test1.

image

image

6 - If saving now, the values will be effectively overriden

Expected behavior:
When updating a rule the fields should be populated with the current values of that rule

Metadata

Metadata

Assignees

No one assigned

    Labels

    Feature:Detection RulesSecurity Solution rules and Detection EngineTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detections and RespSecurity Detection Response TeamTeam:SIEMbugFixes for quality problems that affect the customer experience

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions