Can't seem to add a second tuning rule without navigating away

[bdodds]

Version

2.4.120

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

16

RAM

128

Storage for /

512G

Storage for /nsm

8TB

Network Traffic Collection

span port

Network Traffic Speeds

more than 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello, I looked around for someone else reporting this issue, but I did not see anything - standard apology for duplicate work if I missed something.

In 2.4.120 (and I believe I saw this in 2.4.111 as well) I'm noticing that I can't add a second tuning entry without navigating away from the rule overview. This is how I reproduce the issue:

1. Navigate to Alerts
2. Drill down on an Alert
3. In the Overview frame on the right, click the + under Tuning to add an entry (In this case, I usually add a Suppress type entry by IP address)
4. When the IP address is complete and acceptable, the CREATE button turns light blue, and I can add that entry.
5. After the frame reloads, click the + again to add a second suppress rule
6. When the IP address is complete and acceptable this time, the CREATE button does not turn light blue.

There are several ways I can navigate away and back to the alert and add the next entry, but I don't think that's the intended behavior. Is this just me, am I doing something wrong?

Many thanks.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

I've duplicated this problem and created an issue to fix it in the next release:
#14374