Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] ES|QL tab under Timelines shows only elastic logo when user import the Timeline with having ES|QL query and Results. #182823

Closed
arvindersingh-qasource opened this issue May 7, 2024 · 8 comments
Closed

[Security Solution] ES|QL tab under Timelines shows only elastic logo when user import the Timeline with having ES|QL query and Results. #182823

arvindersingh-qasource opened this issue May 7, 2024 · 8 comments
Assignees
@logeekal
Labels
bug Fixes for quality problems that affect the customer experience fixed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. QA:Validated Issue has been validated by QA Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Investigations Team Team:Threat Hunting Security Solution Threat Hunting Team v8.14.0

Comments

@arvindersingh-qasource
Copy link

Describe the bug
ES|QL tab under Timelines shows only elastic logo when user import the Timeline with having ES|QL query and Results.

Build Details

VERSION: 8.14.0
BUILD: 73762
COMMIT: 2a492e1625f24336f3259b2b8df62b2b18127e81

Browser Details
This issue is occurring on all browsers.

Preconditions

  1. Kibana v8.14.0 must be available.
  2. Timeline.json file must be present with having ES|QL Query and Results.

Steps to Reproduce

  1. Navigate to Security -> Timelines .
  2. Click on Import to import pre requisite Timeline.
  3. Open the Imported timeline.
  4. Navigate to ES|QL tab.
  5. Observe that it will not show ES|QL query or results, instead it will show only elastic logo.

Actual Result
On removing column for result table under ES|QL query on Timeline, Column selector starts Flickering.

Expected Result
On removing column for result table under ES|QL query on Timeline, Column selector Should not Flicker.

What's Working

  • N/A

What's Not Working

  • N/A

Screen Recording

Timelines.-.Kibana.-.Google.Chrome.2024-05-07.17-53-06.mp4
@arvindersingh-qasource arvindersingh-qasource added bug Fixes for quality problems that affect the customer experience triage_needed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Team:Threat Hunting Security Solution Threat Hunting Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Investigations Team v8.14.0 labels May 7, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

@arvindersingh-qasource
Copy link
Author

@karanbirsingh-qasource Please review this ticket.

Thanks.

@logeekal logeekal mentioned this issue May 8, 2024
Merged
logeekal added a commit that referenced this issue May 9, 2024
@logeekal @janmonschke
[Security Solution] Handle invalid savedSearchId (#182937)
02a22fd 
## Summary

Handles #182823

This PR resolves the issue where user opens a timeline with a
`savedSearchId` which no longer exists.


## Desk Testing Guide

1. Create an `Untitled Timeline` and add `ESQL` query and save the
timeline.
2. Make sure `Saved Objects` in Stack Management contains a new saved
object. with name - `Saved search for timeline -
<name_of_timeline_above>`.
3. Export the above created timeline as `ndjson` as shown below.  
![Screenshot 2024-05-08 at 14 26
21](https://github.com/elastic/kibana/assets/7485038/cc134d53-7d07-40d9-8ee8-7e4e7a0c2cc9)
5. Delete the above created timeline
6. Make sure that corresponding saved objects is also deleted in `Saved
Objects` in Stack Management.
7. `Import` the timeline export in Step 3 on the Timelines Page. 
8. Once imported.. Navigate to ESQL tab and save a arbitrary query.
9. Save the timeline... Switch to another timeline and then back.
10. The query you saved should be restored.

---------

Co-authored-by: Jan Monschke <janmonschke@fastmail.com>
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue May 9, 2024
@logeekal
[Security Solution] Handle invalid savedSearchId (elastic#182937)
e82bd97 
## Summary

Handles elastic#182823

This PR resolves the issue where user opens a timeline with a
`savedSearchId` which no longer exists.

## Desk Testing Guide

1. Create an `Untitled Timeline` and add `ESQL` query and save the
timeline.
2. Make sure `Saved Objects` in Stack Management contains a new saved
object. with name - `Saved search for timeline -
<name_of_timeline_above>`.
3. Export the above created timeline as `ndjson` as shown below.
![Screenshot 2024-05-08 at 14 26
21](https://github.com/elastic/kibana/assets/7485038/cc134d53-7d07-40d9-8ee8-7e4e7a0c2cc9)
5. Delete the above created timeline
6. Make sure that corresponding saved objects is also deleted in `Saved
Objects` in Stack Management.
7. `Import` the timeline export in Step 3 on the Timelines Page.
8. Once imported.. Navigate to ESQL tab and save a arbitrary query.
9. Save the timeline... Switch to another timeline and then back.
10. The query you saved should be restored.

---------

Co-authored-by: Jan Monschke <janmonschke@fastmail.com>
(cherry picked from commit 02a22fd)
kibanamachine added a commit that referenced this issue May 9, 2024
@kibanamachine @logeekal
[8.14] [Security Solution] Handle invalid savedSearchId (#182937) (#1…
f3de2e9 
…83059)

# Backport

This will backport the following commits from `main` to `8.14`:
- [[Security Solution] Handle invalid savedSearchId
(#182937)](#182937)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Jatin
Kathuria","email":"jatin.kathuria@elastic.co"},"sourceCommit":{"committedDate":"2024-05-09T15:44:33Z","message":"[Security
Solution] Handle invalid savedSearchId (#182937)\n\n##
Summary\n\nHandles
#182823 PR resolves the
issue where user opens a timeline with a\n`savedSearchId` which no
longer exists.\n\n\n## Desk Testing Guide\n\n1. Create an `Untitled
Timeline` and add `ESQL` query and save the\ntimeline.\n2. Make sure
`Saved Objects` in Stack Management contains a new saved\nobject. with
name - `Saved search for timeline -\n<name_of_timeline_above>`.\n3.
Export the above created timeline as `ndjson` as shown below.
\n![Screenshot 2024-05-08 at 14
26\n21](https://github.com/elastic/kibana/assets/7485038/cc134d53-7d07-40d9-8ee8-7e4e7a0c2cc9)\n5.
Delete the above created timeline\n6. Make sure that corresponding saved
objects is also deleted in `Saved\nObjects` in Stack Management.\n7.
`Import` the timeline export in Step 3 on the Timelines Page. \n8. Once
imported.. Navigate to ESQL tab and save a arbitrary query.\n9. Save the
timeline... Switch to another timeline and then back.\n10. The query you
saved should be restored.\n\n---------\n\nCo-authored-by: Jan Monschke
<janmonschke@fastmail.com>","sha":"02a22fd01acb56ff60512a31d4ed824b56b48d4e","branchLabelMapping":{"^v8.15.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Threat
Hunting:Investigations","backport:prev-minor","v8.15.0"],"title":"[Security
Solution] Handle invalid
savedSearchId","number":182937,"url":"#182937
Solution] Handle invalid savedSearchId (#182937)\n\n##
Summary\n\nHandles
#182823 PR resolves the
issue where user opens a timeline with a\n`savedSearchId` which no
longer exists.\n\n\n## Desk Testing Guide\n\n1. Create an `Untitled
Timeline` and add `ESQL` query and save the\ntimeline.\n2. Make sure
`Saved Objects` in Stack Management contains a new saved\nobject. with
name - `Saved search for timeline -\n<name_of_timeline_above>`.\n3.
Export the above created timeline as `ndjson` as shown below.
\n![Screenshot 2024-05-08 at 14
26\n21](https://github.com/elastic/kibana/assets/7485038/cc134d53-7d07-40d9-8ee8-7e4e7a0c2cc9)\n5.
Delete the above created timeline\n6. Make sure that corresponding saved
objects is also deleted in `Saved\nObjects` in Stack Management.\n7.
`Import` the timeline export in Step 3 on the Timelines Page. \n8. Once
imported.. Navigate to ESQL tab and save a arbitrary query.\n9. Save the
timeline... Switch to another timeline and then back.\n10. The query you
saved should be restored.\n\n---------\n\nCo-authored-by: Jan Monschke
<janmonschke@fastmail.com>","sha":"02a22fd01acb56ff60512a31d4ed824b56b48d4e"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v8.15.0","branchLabelMappingKey":"^v8.15.0$","isSourceBranch":true,"state":"MERGED","url":"#182937
Solution] Handle invalid savedSearchId (#182937)\n\n##
Summary\n\nHandles
#182823 PR resolves the
issue where user opens a timeline with a\n`savedSearchId` which no
longer exists.\n\n\n## Desk Testing Guide\n\n1. Create an `Untitled
Timeline` and add `ESQL` query and save the\ntimeline.\n2. Make sure
`Saved Objects` in Stack Management contains a new saved\nobject. with
name - `Saved search for timeline -\n<name_of_timeline_above>`.\n3.
Export the above created timeline as `ndjson` as shown below.
\n![Screenshot 2024-05-08 at 14
26\n21](https://github.com/elastic/kibana/assets/7485038/cc134d53-7d07-40d9-8ee8-7e4e7a0c2cc9)\n5.
Delete the above created timeline\n6. Make sure that corresponding saved
objects is also deleted in `Saved\nObjects` in Stack Management.\n7.
`Import` the timeline export in Step 3 on the Timelines Page. \n8. Once
imported.. Navigate to ESQL tab and save a arbitrary query.\n9. Save the
timeline... Switch to another timeline and then back.\n10. The query you
saved should be restored.\n\n---------\n\nCo-authored-by: Jan Monschke
<janmonschke@fastmail.com>","sha":"02a22fd01acb56ff60512a31d4ed824b56b48d4e"}}]}]
BACKPORT-->

Co-authored-by: Jatin Kathuria <jatin.kathuria@elastic.co>
@logeekal
Copy link
Contributor

Hello It looks like the fix for this did not make it to BC4. But it should automatically be included in BC5.

@logeekal logeekal added the fixed label May 13, 2024
@arvindersingh-qasource
Copy link
Author

Hi @logeekal

Thanks for the update.

We have validated this ticket on latest kibana v8.14 BC build and found that issue is still reproducible.

Please find the below observations

Build Details

VERSION: 8.14.0
BUILD: 73836
COMMIT: 23ed1207772b3ae958cb05bc4cdbe39b83507707

Observations

  • For imported TimeLine ESQL only shows Elastic Logo.
Timelines.-.Kibana.-.Google.Chrome.2024-05-14.15-02-49.mp4

Thanks.

@logeekal
Copy link
Contributor

Hey @arvindersingh-qasource , Please see my comment here : #182823 (comment).

Unfortunately bug did not make it to BC4 and it will make it to BC5 on 16th of May.

@arvindersingh-qasource
Copy link
Author

Hi @logeekal

Thanks for the update.

We have validated this ticket on latest kibana v8.14 BC build and found that issue is now fixed

Please find the below observations

Build Details

VERSION: 8.14.0
BUILD: 73931
COMMIT: 7ea00b6178d67183a4def9bdd060b062cced043e

Observations

Timelines.-.Kibana.-.Google.Chrome.2024-05-21.13-12-17.mp4

Hence, we are closing this ticket.

Thanks.

@arvindersingh-qasource arvindersingh-qasource added the QA:Validated Issue has been validated by QA label May 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@logeekal logeekal

Labels
bug Fixes for quality problems that affect the customer experience fixed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. QA:Validated Issue has been validated by QA Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Investigations Team Team:Threat Hunting Security Solution Threat Hunting Team v8.14.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@logeekal @elasticmachine @PhilippeOberti @MadameSheema @karanbirsingh-qasource @arvindersingh-qasource