elastic/kibana

[Security Solution][Bug] `Alerts actions` checkbox selection is not retaining on edit exception flyout.

Open

#252294 opened on Feb 9, 2026

View on GitHub
 (10 comments) (0 reactions) (2 assignees)TypeScript (19,065 stars) (8,021 forks)batch import
Team: SecuritySolutionTeam:Detection EngineTeam:Detections and Respbuggood first issueimpact:lowv9.4.0

Description

Describe the bug: The user created an exception and enabled the “Alert actions” checkbox while creating the rule exception. However, when the user edited the same exception, the checkbox selection was not retained and was displayed as unchecked.

Kibana/Elasticsearch Stack version:

VERSION: 9.4.0
BUILD: 9007199254740991
PR : https://github.com/elastic/kibana/pull/244637

Steps to reproduce: 1.Kibana 9.4.0 must be running and alerts are generated by executed rules. 2.Go to Alerts and Add a rule exception by filling all the required details and click on the checkboxes under Alerts actions for Close this alert and Close all alerts that match this exception and were generated by selected rules/s. 3.Save the exception. 4.Navigate to Rules > Detection rules (SIEM) and go to rule detail page. 5.Switch to Rule exceptions tab and the recently added exception displayed. 6.Click on the three dots and select Edit rule exception option. 7.The Edit rule exception flyout opens up and scroll down. 8.Observe the checkbox for Close all alerts that match this exception and were generated by selected rules/s under Alerts actions is displayed unchecked.

Current behavior: Alerts actions checkbox selection is not retaining on edit exception flyout.

Expected behavior: The checkbox for Close all alerts that match this exception and were generated by selected rules/s under Alerts actions should be displayed checked.

Screenshots (if relevant):

https://github.com/user-attachments/assets/922766dd-ee1b-4c66-a2f6-7e491215ac22

Contributor guide

Tech stack
typescriptreact
Domain
frontendsecurity
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
blocked
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
Familiarity with Kibana Security SolutionUnderstanding of React state managementBasic knowledge of exception management
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
25
Research direction
Investigate why the 'Close all alerts that match this exception' checkbox is not unchecked when editing an exception. The bug is likely in the edit exception flyout component that initializes the checkbox state from the exception data. Check the related PR #244637 for context and look at the state management in the flyout component (e.g., in the Security Solution plugin). Ensure that the checkbox value is properly mapped from the exception's alert action configuration.