[Security Solution] Host.ip are not formatted correctly.

[ghost]

Describe the bug
Host.ip are not formatted correctly.

Build Details:

Version:7.15.0 SNAPSHOT
Commit:aa12d107c38c5cda96fc32bcd1f8226df172826a
Build:43370

Browser Details:
N/A

Preconditions

1. Kibana users should be logged in.
2. endpoint should be installed.
3. Alerts should be generated say: mimikatz

Steps to Reproduce

1. Navigate to alerts page.
2. click on "view details" icon of generated alerts
3. Click on table tab and search the host.ip
4. Observe that Host.ip are not formatted correctly.

Actual Result
Host.ip are not formatted correctly.

Expected Result
Host.ip should be formatted correctly either with enter or with comma.

What's Working

• N/A

What's Not Working

• N/A

Screen-Shot

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[ghost]

@manishgupta-qasource Please review!!

[elasticmachine]

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

[MadameSheema]

@deepikakeshav-qasource can you please share the JSON data? Thanks :)

[ghost]

Hi @MadameSheema,

Please find the below Json Data for Rule.

Build Details:

Version : 8.0.0-SNAPSHOT
Commit:f952643e542a712149883d03f3cc99584d2b17eb

Json Data:

json.txt

Thanks!!

[jonathan-buttner]

@deepikakeshav-qasource can you email me the creds for the elastic stack that has the alert on it? Can you also confirm via the Discover app that searching for _id: 58af803e296a36b187910b341c75124af9efeb572f97fd0f3eb0b8e563e69c57 within index: .siem-signals-default-000001 shows that host.ip is a comma delimited string like in the json.txt file you provided? "10.0.6.31,127.0.0.1,::1" If it is a string then we'll want the endpoint to convert it to an array of IPs.

[ghost]

Hi @jonathan-buttner,

We have created a new environment for this ticket's required test data and shared the credentials for the same on email.

In discover tab the IPs are displaying with commas. Please find below the screenshot for the same:

Screenshot:

Please let us know if anything else is required from our end.

Thanks!!

[jonathan-buttner]

Looks like it is a valid array in Elasticsearch then, so the flyout is not displaying it correctly. Looks like a valid bug on our side. Thanks for finding it!

[ghost]

Hi Team ,

We have validated this ticket on 7.16.0 BC5 and found that issue is fixed. Please find the complete testing details:

Build Details:

Version:7.16.0 BC5
Build: 46061
COMMIT: f13296db8798dd0cd39ab6cc4a61a35a2a2b05cc

Screenshots:

Hence, We are closing this ticket and marking as QA Validated.

Thanks!!