elastic/kibana
[Security Solution] Empty Alert Table Lines Displayed in Rule Preview When No Alerts Are Found
オープン
#211,820 opened on 2025/02/19
Feature:Detection Rule PreviewTeam: SecuritySolutionTeam:Detection Engineeringbugeffort:lowgood first issueimpact:lowvalue:low
Repository metrics
- Stars
- (19,065 個のスター)
- PR merge metrics
- (平均マージ 1d 16h) (30d で 999 merged PRs)
説明
Description:
When a user enters a query that would not result any result and clicks Rule Preview, an empty alert table with blank rows is displayed if the query does not return any matching alerts.
Kibana/Elasticsearch Stack version:
8.18 BC4
Functional Area (e.g. Endpoint management, timelines, resolver, etc.):
Detection Rules Preview
Steps to reproduce:
- Navigate to the Rule Creation/Edit page.
- Enter a query in the rule configuration that is expected to return zero alerts.
- Click on Rule Preview to see a preview of the rule’s potential results.
- Observe the Rule Preview section.
Current behavior:
The alert table is displayed with empty rows, even though no alerts exist.
Expected behavior:
The empty rows should not appear in the preview.
Screenshots :
https://github.com/user-attachments/assets/ff7d7593-9edd-4ed3-ad63-dbf96b951037