[Security Solution]Legacy actions are deleted when user tries to save a rule and the run action interval is slower than rule run interval

[vgomez-el]

Describe the bug:

• When a user adds legacy actions to a rule via API and the actions run interval is lower than rule run interval and afterwards edits the rule via kibana UI, after pressing the Save Changes button, legacy action is "migrated", so sidecar SO is deleted, but rule cannot be saved, because an error message is displayed, which leads to lose the legacy action and leaves the rule without migrated action.

Kibana/Elasticsearch Stack version:

• 8.8.0-BC3

Original install method (e.g. download page, yum, from source, etc.):

• Cloud Instance

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

• Detection Alerts

Initial setup

User must have a rule with one legacy action ( rule run interval should be 5 minutes or more) and a legacy action injected using this PR steps

Steps to reproduce:

1. Edit the rule that contains the legacy action
2. Go to Actions tab and assure Action run interval is lower than Rule run Scheduled interval
3. Press Save Changes button

Current behavior:

• Error message is displayed and Rule is not saved but legacy action is deleted which means that data is lost

Expected behavior:

• Legacy action should not be deleted if rule cannot be saved and a warning message about the invalid action interval should be displayed

Screen recording:

REC-20230512113308.mp4

Any additional context (logs, chat logs, magical formulas, etc.):
-This bug will eventually be fixed once this task is done: #155502

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[yctercero]

Note: occurring in older versions as well.

[e40pud]

This fix has been merged into main and 8.9 branches.
cc @vgomez-el @MadameSheema @yctercero @nastasha-solomon

[ghost]

Hi @MadameSheema

we have validated this issue by upgrading the 8.8.0 to 8.9.0 and found that issue is still occuring . While duplicate the rule with legacy rule action there are error ❌

Moreover we are not able to add the legacy action directly on 8.9.1 directly as PR steps are not running on the 8.9 rule.

Build Details:

Version: 8.9.1 BC1
Commit: 6c664aeb22673e6eb42348ea50b5a098509f7deb
Build: 64802

Additional observation of 8.9.1 Direct Testing

we are following this pr steps to add legacy rule action ( in our case it was slack ) to rule present on 8.9.1 by running the post_legacy action.js <alert_id> but on 8.9.1 this script is returning error and not adding the rule action to target rule id passed along the script.

tried with different rule ID

Screen-Cast

Rules.-.Kibana.Mozilla.Firefox.2023-08-11.17-06-38.mp4

[MadameSheema]

@e40pud may you please help @karanbirsingh-qasource to validate the fix? Thanks!

[yctercero]

@karanbirsingh-qasource would it be possible to validate by first creating a legacy action in 7.16 then upgrading to latest? I only ask this because even the API to create legacy actions does not fully mock out the actual behavior so the best way to test legacy actions stuff accurately is to go through the flow of creating an action in <7.16 (before the new action migration code was introduced) and then upgrading.

[e40pud]

@karanbirsingh-qasource It is expected that duplication does not work with the broken legacy actions. Since action is not valid there is no good solution to fix it programatically on migration. Thus, we prevent user from migrating legacy actions in such cases to avoid data loss. Any operation that triggers legacy action migration (enable, disable, rule update, rule duplicate etc.) will throw an exception about invalid actions state.

[e40pud]

I will have a look why scripts to create legacy actions don't work in 8.9, but as @yctercero mentioned we can always create invalid legacy actions in older kibana and upgrade it to latest.

[ghost]

thanks @yctercero for the comment sure we have checked the issue by upgrading from 7.16.0 to 8.9.1 ( we have to upgrade 7.16.0 first to 7.17.2 in order to upgrade to 8.9.1) and found the issue still occuring

we are getting Failed to migrate legacy actions for SIEM rule 16243f40-3b2f-11ee-9589-9dd09d7bfb2b: Failed to validate actions due to the following error: Action frequency cannot be shorter than the schedule interval of 5m: default (1m) on editing/enabling the rule with legacy action.

Build Details:

Version: 7.16.0
Commit:b7b724b4f677db8b3ca0b7d5a35a822fef9766a0
Build:46197

Version: 8.9.1
Commit:6c664aeb22673e6eb42348ea50b5a098509f7deb
Build: 64802

Observations:

• Created slack connector on 7.16.0
• Ran below query in Dev Tool and fetched the above connector action id

GET .kibana/_search
{
  "query": {
    "term": {
      "type": "action"
    }
  }
}

• Edited the one_action.json and replace with above fetched the action id under "id" field
• Created custom rule by the name of cmd_custom_rule on kibana but not added any connector to it
• Copied the rule id from the browser URL
• Ran the post_legacy_notification.sh <above copied rule id>
• Slack action got added to rule

Rules.-.Kibana.Mozilla.Firefox.2023-08-15.11-31-59.mp4

• Generated some alert to test slack connector working on 7.16.0 instance ✔️
  

• Upgraded the instance to 7.17.2 first due to below attached reason
  

• Upgraded the instance to 8.9.1

• Checking legacy action present on upgrade kibana version 8.9.1

Console.-.Dev.Tools.-.Elastic.Mozilla.Firefox.Private.Browsing.2023-08-15.12-01-16.mp4

• Tried to enable existing rule cmd_custom_rule on kibana 8.9.1 but throws error ❌ Failed to migrate legacy actions for SIEM rule 16243f40-3b2f-11ee-9589-9dd09d7bfb2b: Failed to validate actions due to the following error: Action frequency cannot be shorter than the schedule interval of 5m: default (1m)

Rules.-.Kibana.Mozilla.Firefox.Private.Browsing.2023-08-15.12-01-45.mp4

Rule Enable Error Logs

{
  "name": "Error",
  "body": {
    "statusCode": 500,
    "error": "Internal Server Error",
    "message": "Bulk edit failed",
    "attributes": {
      "errors": [
        {
          "message": "Failed to migrate legacy actions for SIEM rule 16243f40-3b2f-11ee-9589-9dd09d7bfb2b: Failed to validate actions due to the following error: Action frequency cannot be shorter than the schedule interval of 5m: default (1m)",
          "status_code": 400,
          "rules": [
            {
              "id": "16243f40-3b2f-11ee-9589-9dd09d7bfb2b",
              "name": "cmd_custom_rule"
            }
          ]
        }
      ],
      "results": {
        "updated": [],
        "created": [],
        "deleted": [],
        "skipped": []
      },
      "summary": {
        "failed": 1,
        "succeeded": 0,
        "skipped": 0,
        "total": 1
      }
    }
  },
  "stack": "{\n  \"statusCode\": 500,\n  \"error\": \"Internal Server Error\",\n  \"message\": \"Bulk edit failed\",\n  \"attributes\": {\n    \"errors\": [\n      {\n        \"message\": \"Failed to migrate legacy actions for SIEM rule 16243f40-3b2f-11ee-9589-9dd09d7bfb2b: Failed to validate actions due to the following error: Action frequency cannot be shorter than the schedule interval of 5m: default (1m)\",\n        \"status_code\": 400,\n        \"rules\": [\n          {\n            \"id\": \"16243f40-3b2f-11ee-9589-9dd09d7bfb2b\",\n            \"name\": \"cmd_custom_rule\"\n          }\n        ]\n      }\n    ],\n    \"results\": {\n      \"updated\": [],\n      \"created\": [],\n      \"deleted\": [],\n      \"skipped\": []\n    },\n    \"summary\": {\n      \"failed\": 1,\n      \"succeeded\": 0,\n      \"skipped\": 0,\n      \"total\": 1\n    }\n  }\n}",
  "message": "Internal Server Error"
}

• Editing the rule and clicking on save throws error ❌ But in our case the connector dont get removed from the rule

Editing Rule Error Logs

{
  "name": "Error",
  "body": {
    "message": "Failed to migrate legacy actions for SIEM rule 16243f40-3b2f-11ee-9589-9dd09d7bfb2b: Failed to validate actions due to the following error: Action frequency cannot be shorter than the schedule interval of 5m: default (1m)",
    "status_code": 400
  },
  "message": "Bad Request",
  "stack": "http_fetch_error_HttpFetchError@https://c495067b1d5b440fbbefde3bb3e8acea.europe-west1.gcp.cloud.es.io:9243/64802/bundles/core/core.entry.js:1:270487\nfetchResponse@https://c495067b1d5b440fbbefde3bb3e8acea.europe-west1.gcp.cloud.es.io:9243/64802/bundles/core/core.entry.js:1:274385\n"
}

c.c @MadameSheema @vgomez-el

[e40pud]

All the described behaviours above are expected.

The main goal is to avoid data loss (legacy actions) during the migration. Thus, we throw an exception when user tries to migrate the rule with invalid legacy actions to prevent legacy actions to be removed.

There will be a known issue added to security docs elastic/security-docs#3572 saying that Rule changes can’t be saved if the rule’s action frequency is shorter than the rule’s run interval. (elastic/security-docs#3722)

[ghost]

ok @e40pud thanks for looking into the observation. so can we close this issue or not and track other issue separately.

[e40pud]

I would say yes. Thank you for performing thorough testing!