[Security Solution] Handle invalid savedSearchId #182937
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
logeekal
added
release_note:skip
|
Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations) |
janmonschke
reviewed
May 8, 2024
x-pack/plugins/security_solution/public/timelines/components/timeline/tabs/esql/index.tsx
Outdated
Show resolved
Hide resolved
janmonschke
reviewed
May 8, 2024
| savedSearchAppState = getAppStateFromSavedSearch(localSavedSearch); | ||
| } catch (e) { | ||
| // eslint-disable-next-line no-console | ||
| console.error('Stale Saved search Id which no longer exists', e); |
There was a problem hiding this comment.
Do we want to keep this log in prod?
There was a problem hiding this comment.
yep.. I was thinking the same and decided to keep it.
Co-authored-by: Jan Monschke <janmonschke@fastmail.com>
💚 Build Succeeded
Metrics [docs]Async chunks
Unknown metric groupsESLint disabled line counts
Total ESLint disabled count
History
To update your PR or re-run it, just comment with: |
PhilippeOberti
approved these changes
May 8, 2024
There was a problem hiding this comment.
Desk tested and code LGTM!
This actually fixes a related issue I just noticed while testing:
- create a timeline with an ESQL query
- verify the saved search object exists
- delete the timeline
- verify the saved search object is deleted
- create a new timeline and save it with the same name
The saved search object isn't created again...
This PR fixes that, awesome job!
christineweng
approved these changes
May 8, 2024
| @@ -117,6 +122,12 @@ export const DiscoverTabContent: FC<DiscoverTabContentProps> = ({ timelineId }) | |||
|
|
|||
| useEffect(() => { | |||
| if (isFetching) return; | |||
| if (savedSearchByIdStatus === 'error' && savedSearchId) { | |||
| // when a timeline json is uploaded with a saved search Id that not longer | |||
| // exists, we need to reset the saved search Id in the timeline and remove th saved search | |||
There was a problem hiding this comment.
nit: remove the saved search?
There was a problem hiding this comment.
Thanks.. will try to do it... In follow up PR.
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
May 9, 2024
## Summary Handles elastic#182823 This PR resolves the issue where user opens a timeline with a `savedSearchId` which no longer exists. ## Desk Testing Guide 1. Create an `Untitled Timeline` and add `ESQL` query and save the timeline. 2. Make sure `Saved Objects` in Stack Management contains a new saved object. with name - `Saved search for timeline - <name_of_timeline_above>`. 3. Export the above created timeline as `ndjson` as shown below.  5. Delete the above created timeline 6. Make sure that corresponding saved objects is also deleted in `Saved Objects` in Stack Management. 7. `Import` the timeline export in Step 3 on the Timelines Page. 8. Once imported.. Navigate to ESQL tab and save a arbitrary query. 9. Save the timeline... Switch to another timeline and then back. 10. The query you saved should be restored. --------- Co-authored-by: Jan Monschke <janmonschke@fastmail.com> (cherry picked from commit 02a22fd)
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
kibanamachine
added a commit
that referenced
this pull request
May 9, 2024
…83059) # Backport This will backport the following commits from `main` to `8.14`: - [[Security Solution] Handle invalid savedSearchId (#182937)](#182937) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Jatin Kathuria","email":"jatin.kathuria@elastic.co"},"sourceCommit":{"committedDate":"2024-05-09T15:44:33Z","message":"[Security Solution] Handle invalid savedSearchId (#182937)\n\n## Summary\n\nHandles https://github.com/elastic/kibana/issues/182823\n\nThis PR resolves the issue where user opens a timeline with a\n`savedSearchId` which no longer exists.\n\n\n## Desk Testing Guide\n\n1. Create an `Untitled Timeline` and add `ESQL` query and save the\ntimeline.\n2. Make sure `Saved Objects` in Stack Management contains a new saved\nobject. with name - `Saved search for timeline -\n<name_of_timeline_above>`.\n3. Export the above created timeline as `ndjson` as shown below. \n\n5. Delete the above created timeline\n6. Make sure that corresponding saved objects is also deleted in `Saved\nObjects` in Stack Management.\n7. `Import` the timeline export in Step 3 on the Timelines Page. \n8. Once imported.. Navigate to ESQL tab and save a arbitrary query.\n9. Save the timeline... Switch to another timeline and then back.\n10. The query you saved should be restored.\n\n---------\n\nCo-authored-by: Jan Monschke <janmonschke@fastmail.com>","sha":"02a22fd01acb56ff60512a31d4ed824b56b48d4e","branchLabelMapping":{"^v8.15.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Threat Hunting:Investigations","backport:prev-minor","v8.15.0"],"title":"[Security Solution] Handle invalid savedSearchId","number":182937,"url":"https://github.com/elastic/kibana/pull/182937","mergeCommit":{"message":"[Security Solution] Handle invalid savedSearchId (#182937)\n\n## Summary\n\nHandles https://github.com/elastic/kibana/issues/182823\n\nThis PR resolves the issue where user opens a timeline with a\n`savedSearchId` which no longer exists.\n\n\n## Desk Testing Guide\n\n1. Create an `Untitled Timeline` and add `ESQL` query and save the\ntimeline.\n2. Make sure `Saved Objects` in Stack Management contains a new saved\nobject. with name - `Saved search for timeline -\n<name_of_timeline_above>`.\n3. Export the above created timeline as `ndjson` as shown below. \n\n5. Delete the above created timeline\n6. Make sure that corresponding saved objects is also deleted in `Saved\nObjects` in Stack Management.\n7. `Import` the timeline export in Step 3 on the Timelines Page. \n8. Once imported.. Navigate to ESQL tab and save a arbitrary query.\n9. Save the timeline... Switch to another timeline and then back.\n10. The query you saved should be restored.\n\n---------\n\nCo-authored-by: Jan Monschke <janmonschke@fastmail.com>","sha":"02a22fd01acb56ff60512a31d4ed824b56b48d4e"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v8.15.0","branchLabelMappingKey":"^v8.15.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/182937","number":182937,"mergeCommit":{"message":"[Security Solution] Handle invalid savedSearchId (#182937)\n\n## Summary\n\nHandles https://github.com/elastic/kibana/issues/182823\n\nThis PR resolves the issue where user opens a timeline with a\n`savedSearchId` which no longer exists.\n\n\n## Desk Testing Guide\n\n1. Create an `Untitled Timeline` and add `ESQL` query and save the\ntimeline.\n2. Make sure `Saved Objects` in Stack Management contains a new saved\nobject. with name - `Saved search for timeline -\n<name_of_timeline_above>`.\n3. Export the above created timeline as `ndjson` as shown below. \n\n5. Delete the above created timeline\n6. Make sure that corresponding saved objects is also deleted in `Saved\nObjects` in Stack Management.\n7. `Import` the timeline export in Step 3 on the Timelines Page. \n8. Once imported.. Navigate to ESQL tab and save a arbitrary query.\n9. Save the timeline... Switch to another timeline and then back.\n10. The query you saved should be restored.\n\n---------\n\nCo-authored-by: Jan Monschke <janmonschke@fastmail.com>","sha":"02a22fd01acb56ff60512a31d4ed824b56b48d4e"}}]}] BACKPORT--> Co-authored-by: Jatin Kathuria <jatin.kathuria@elastic.co>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Handles #182823
This PR resolves the issue where user opens a timeline with a
savedSearchIdwhich no longer exists.Desk Testing Guide
Untitled Timelineand addESQLquery and save the timeline.Saved Objectsin Stack Management contains a new saved object. with name -Saved search for timeline - <name_of_timeline_above>.ndjsonas shown below.Saved Objectsin Stack Management.Importthe timeline export in Step 3 on the Timelines Page.