elastic/kibana
Vedi su GitHub[Security Solution] Empty Alert Table Lines Displayed in Rule Preview When No Alerts Are Found
Open
#211.820 aperta il 19 feb 2025
Feature:Detection Rule PreviewTeam: SecuritySolutionTeam:Detection EngineTeam:Detection EngineeringTeam:Detections and Respbugeffort:lowgood first issueimpact:lowvalue:low
Metriche repository
- Star
- (19.065 star)
- Metriche merge PR
- (Merge medio 1g 16h) (999 PR mergiate in 30 g)
Descrizione
Description:
When a user enters a query that would not result any result and clicks Rule Preview, an empty alert table with blank rows is displayed if the query does not return any matching alerts.
Kibana/Elasticsearch Stack version:
8.18 BC4
Functional Area (e.g. Endpoint management, timelines, resolver, etc.):
Detection Rules Preview
Steps to reproduce:
- Navigate to the Rule Creation/Edit page.
- Enter a query in the rule configuration that is expected to return zero alerts.
- Click on Rule Preview to see a preview of the rule’s potential results.
- Observe the Rule Preview section.
Current behavior:
The alert table is displayed with empty rows, even though no alerts exist.
Expected behavior:
The empty rows should not appear in the preview.
Screenshots :
https://github.com/user-attachments/assets/ff7d7593-9edd-4ed3-ad63-dbf96b951037