elastic/kibana

[Security Solution] Shared Exception List does not get refreshed after deleting previous search input

Open

#245936 opened on Dec 10, 2025

View on GitHub
 (6 comments) (0 reactions) (1 assignee)TypeScript (19,065 stars) (8,021 forks)batch import
Feature:Rule ExceptionsTeam: SecuritySolutionTeam:Detection EngineTeam:Detections and Respbugbug-fixereffort:lowgood first issueurgency:normalvalue:medium

Description

Describe the bug:

After doing a search on Shared Exception Lis, deleting the search term and clicking 'Refresh" button, the list does not get refreshed. The action is just complete if the user uses the delete button 'X' in the search bar.

https://github.com/user-attachments/assets/859bcc24-2ab8-4fe8-adc5-faf0babb61e5

Kibana/Elasticsearch Stack version:

9.3

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Shared Exception List

Steps to reproduce:

  1. Have a list of Shared Exception Lists
  2. On search bar, search for a term that returns a result
  3. Delete (backspace) the term entered
  4. Click 'Refresh'

Current behavior:

The list does not get refreshed. The action is just complete if the user uses the delete button 'X' in the search bar.

Expected behavior:

The list should be refreshed.

Contributor guide

Tech stack
typescriptreact
Domain
frontend
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
blocked
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
ReactTypeScriptKibana Security Solution
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
Investigate the Shared Exception List component in the Security Solution plugin (likely in x pack/plugins/security solution). Focus on the search bar and refresh button interaction. Determine why deleting the search term manually (via backspace) does not trigger a refresh, while the 'X' button does. Look at the component's state and the refresh function's dependencies. Consider if a useEffect or callback is missing the manual delete case. Check if there are any existing tests for this behavior.