Skip to content

Commit f54da2a

Browse files
mergify[bot]nastasha-solomon
mergify[bot]
and
nastasha-solomon
authored
[8.16] [Known issue][Detection Engine][8.16.0 & 8.16.1] Exception item comment validation on newline chars (backport #6280) (#6312)
* First draft * Minor tweaks * missing word * Grammar * More small tweaks * Ryland's input * Small fixes * Cleanup * Update docs/release-notes/8.16.asciidoc Co-authored-by: Ryland Herrick <[email protected]> * Update docs/release-notes/8.16.asciidoc Co-authored-by: Ryland Herrick <[email protected]> * Update docs/release-notes/8.16.asciidoc Co-authored-by: Ryland Herrick <[email protected]> * Update docs/release-notes/8.16.asciidoc * Formatting fixes * fixes sample commands * Update docs/release-notes/8.16.asciidoc * Update docs/release-notes/8.16.asciidoc * Update docs/release-notes/8.16.asciidoc * Updates last step * Adds fix info * Removes fix details --------- Co-authored-by: Ryland Herrick <[email protected]> (cherry picked from commit f0d60d6) Co-authored-by: Nastasha Solomon <[email protected]>
1 parent c0f67bd commit f54da2a

File tree

1 file changed

+114
-0
lines changed

1 file changed

+114
-0
lines changed

‎docs/release-notes/8.16.asciidoc‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,63 @@
99
[[known-issue-8.16.1]]
1010
==== Known issues
1111

12+
// tag::known-issue[201820]
13+
[discrete]
14+
.The **Exceptions** tab won't properly load if exceptions contain comments with newline characters (`\n`)
15+
[%collapsible]
16+
====
17+
*Details* +
18+
On December 5, 2024, it was discovered that the **Exceptions** tab won't load properly if any exceptions contain comments with newline characters (`\n`). This issue occurs when you upgrade to 8.16.0 or later ({kibana-issue}201820[#201820]).
19+
20+
*Workaround* +
21+
22+
For custom rules:
23+
24+
. From the **Rules** page, <<import-export-rules-ui,export>> the rule or rules with the affected exception lists.
25+
. Modify the `.ndjson` file so `comments` no longer contain newline characters.
26+
. Return to the **Rules** page and <<import-export-rules-ui,re-import>> the rules. Make sure to select the **Overwrite existing exception lists with conflicting "list_id"** option.
27+
28+
For prebuilt rules:
29+
30+
NOTE: If you only need to fix exceptions for the Elastic Endpoint rule, you can export and re-import its exception list from the <<shared-exception-lists,**Shared Exception Lists**>> page.
31+
32+
. Follow these steps to fetch the affected exception list ID or IDs that are associated with the rule:
33+
.. Find the affected rule's ID (`id`). From the **Rules** page, open the details of a rule, go to the page URL, and copy the string at the end. For example, in the URL http://host.name/app/security/rules/id/167a5f6f-2148-4792-8226-b5e7a58ef46e, the string at the end (`167a5f6f-2148-4792-8226-b5e7a58ef46e`) is the `id`.
34+
.. Specify the `id` when fetching the rule's details using the {api-kibana}/operation/operation-readrule[Retrieve a detection rule API]. Here is an example request that includes the `id`:
35+
+
36+
[source,console]
37+
----
38+
curl -H 'Authorization: ApiKey API_KEY_HERE' -H 'kbn-xsrf: true' -H 'elastic-api-version: 2023-10-31' KIBANA_URL/api/detection_engine/rules?id=167a5f6f-2148-4792-8226-b5e7a58ef46e
39+
----
40+
+
41+
.. The JSON response contains the `id`, `list_id`, and `namespace_type` values within the `exceptions_list` key (as shown below). You need these values when using the Exception list API to retrieve the affected exception list.
42+
+
43+
[source,console]
44+
----
45+
{
46+
"id": "167a5f6f-2148-4792-8226-b5e7a58ef46e",
47+
"exceptions_list": [
48+
{
49+
"id": "490525a2-eb66-4320-95b5-88bdd1302dc4",
50+
"list_id": "f75aae6f-0229-413f-881d-81cb3abfbe2d",
51+
"namespace_type": "single"
52+
}
53+
]
54+
}
55+
----
56+
+
57+
. Use the export exceptions API to retrieve the affected exception list. Insert the values for the `id`, `list_id`, and `namespace_type` parameters into the following API call:
58+
+
59+
[source,console]
60+
----
61+
curl -XPOST -H 'Authorization: ApiKey API_KEY_HERE' -H 'kbn-xsrf: true' -H 'elastic-api-version: 2023-10-31' 'KIBANA_URL/api/exception_lists/_export?list_id=f75aae6f-0229-413f-881d-81cb3abfbe2d&id=490525a2-eb66-4320-95b5-88bdd1302dc4&namespace_type=single' -o list.ndjson
62+
----
63+
+
64+
. Modify the exception list's `.ndjson` file to ensure `comments[].comment` values don't contain newline characters (`\n`).
65+
. Re-import the modified exception list using **Import exception lists** option on the <<shared-exception-lists,**Shared Exception Lists**>> page. The import will initially fail because the exception list already exists, and an option to overwrite the existing list will appear. Select the option, then resubmit the request to import the corrected exception list.
66+
====
67+
// end::known-issue[201820]
68+
1269
// tag::known-issue[]
1370
[discrete]
1471
.Duplicate alerts can be produced from manually running threshold rules
@@ -50,6 +107,63 @@ On November 12, 2024, it was discovered that manually running a custom query rul
50107
[[known-issue-8.16.0]]
51108
==== Known issues
52109

110+
// tag::known-issue[201820]
111+
[discrete]
112+
.The **Exceptions** tab won't properly load if exceptions contain comments with newline characters (`\n`)
113+
[%collapsible]
114+
====
115+
*Details* +
116+
On December 5, 2024, it was discovered that the **Exceptions** tab won't load properly if any exceptions contain comments with newline characters (`\n`). This issue occurs when you upgrade to 8.16.0 or later ({kibana-issue}201820[#201820]).
117+
118+
*Workaround* +
119+
120+
For custom rules:
121+
122+
. From the **Rules** page, <<import-export-rules-ui,export>> the rule or rules with the affected exception lists.
123+
. Modify the `.ndjson` file so `comments` no longer contain newline characters.
124+
. Return to the **Rules** page and <<import-export-rules-ui,re-import>> the rules. Make sure to select the **Overwrite existing exception lists with conflicting "list_id"** option.
125+
126+
For prebuilt rules:
127+
128+
NOTE: If you only need to fix exceptions for the Elastic Endpoint rule, you can export and re-import its exception list from the <<shared-exception-lists,**Shared Exception Lists**>> page.
129+
130+
. Follow these steps to fetch the affected exception list ID or IDs that are associated with the rule:
131+
.. Find the affected rule's ID (`id`). From the **Rules** page, open the details of a rule, go to the page URL, and copy the string at the end. For example, in the URL http://host.name/app/security/rules/id/167a5f6f-2148-4792-8226-b5e7a58ef46e, the string at the end (`167a5f6f-2148-4792-8226-b5e7a58ef46e`) is the `id`.
132+
.. Specify the `id` when fetching the rule's details using the {api-kibana}/operation/operation-readrule[Retrieve a detection rule API]. Here is an example request that includes the `id`:
133+
+
134+
[source,console]
135+
----
136+
curl -H 'Authorization: ApiKey API_KEY_HERE' -H 'kbn-xsrf: true' -H 'elastic-api-version: 2023-10-31' KIBANA_URL/api/detection_engine/rules?id=167a5f6f-2148-4792-8226-b5e7a58ef46e
137+
----
138+
+
139+
.. The JSON response contains the `id`, `list_id`, and `namespace_type` values within the `exceptions_list` key (as shown below). You need these values when using the Exception list API to retrieve the affected exception list.
140+
+
141+
[source,console]
142+
----
143+
{
144+
"id": "167a5f6f-2148-4792-8226-b5e7a58ef46e",
145+
"exceptions_list": [
146+
{
147+
"id": "490525a2-eb66-4320-95b5-88bdd1302dc4",
148+
"list_id": "f75aae6f-0229-413f-881d-81cb3abfbe2d",
149+
"namespace_type": "single"
150+
}
151+
]
152+
}
153+
----
154+
+
155+
. Use the export exceptions API to retrieve the affected exception list. Insert the values for the `id`, `list_id`, and `namespace_type` parameters into the following API call:
156+
+
157+
[source,console]
158+
----
159+
curl -XPOST -H 'Authorization: ApiKey API_KEY_HERE' -H 'kbn-xsrf: true' -H 'elastic-api-version: 2023-10-31' 'KIBANA_URL/api/exception_lists/_export?list_id=f75aae6f-0229-413f-881d-81cb3abfbe2d&id=490525a2-eb66-4320-95b5-88bdd1302dc4&namespace_type=single' -o list.ndjson
160+
----
161+
+
162+
. Modify the exception list's `.ndjson` file to ensure `comments[].comment` values don't contain newline characters (`\n`).
163+
. Re-import the modified exception list using **Import exception lists** option on the <<shared-exception-lists,**Shared Exception Lists**>> page. The import will initially fail because the exception list already exists, and an option to overwrite the existing list will appear. Select the option, then resubmit the request to import the corrected exception list.
164+
====
165+
// end::known-issue[201820]
166+
53167
// tag::known-issue[]
54168
[discrete]
55169
.Attempting to edit an Elastic AI Assistant Knowledge Base index results in an error

0 commit comments

Comments
 (0)