Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Failed detector not reported in SIEM #75434

Closed
honzakral opened this issue Aug 19, 2020 · 3 comments
Closed

Failed detector not reported in SIEM #75434

honzakral opened this issue Aug 19, 2020 · 3 comments
Labels
bug Fixes for quality problems that affect the customer experience Feature:Detection Rules Anything related to Security Solution's Detection Rules Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM

Comments

@honzakral
Copy link
Contributor

Kibana version: 7.9.0

Elasticsearch version: 7.9.0

Original install method (e.g. download page, yum, from source, etc.): docker

Describe the bug: Detector fails to create a document in the signal index yet no error or exception is reported, status of detector is "success"

Steps to reproduce:

  1. create an index with document with incompatible mappings with signals, for example: {"message": {"not": "text"}}
  2. Create a simple query detector on that index

Expected behavior: I would expect to see the error reported

Provide logs and/or server output (if relevant):

{"type":"log","@timestamp":"2020-08-19T14:13:54Z","tags":["error","plugins","securitySolution","plugins","securitySolution"],"pid":6,"message":"[-] bulkResponse had errors with responses of: {\"failed to parse field [message] of type [text] in document with id '1ee2259a9c261a52c62ece88816b9b8f069f0f62c88cc8df4a99441a22c595e6'. Preview of field's value: '{doc_count=14, key=XXXXX}'\":{\"count\":1,\"statusCode\":400},\"failed to parse field [message] of type [text] in document with id '91c5e4722750c8a0062dce26334ecb749a956d0a4f3e2c39eb9f2b718a67ef6b'. Preview of field's value: '{doc_count=14, key=XXXXXX}'\":{\"count\":1,\"statusCode\":400},\"failed to parse field [message] of type [text] in document with id 'f1216d508b3dc841fd289bf5c4b5ca59dc0e393d769606d1b2a2734bdf003dbb'. Preview of field's value: '{doc_count=7, key=XXXXX}'\":{\"count\":1,\"statusCode\":400}}"}
@elasticmachine
Copy link
Contributor

Pinging @elastic/siem (Team:SIEM)

@spong spong added bug Fixes for quality problems that affect the customer experience Feature:Detection Rules Anything related to Security Solution's Detection Rules labels Aug 20, 2020
@MadameSheema MadameSheema added the Team:Detections and Resp Security Detection Response Team label Oct 1, 2020
@MindyRS MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Oct 15, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-security (Team:Security Solution)

@FrankHassanabad
Copy link
Contributor

This should be fixed by:
#77687

for 7.10.0+ now. Closing out.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Feature:Detection Rules Anything related to Security Solution's Detection Rules Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM
Projects
None yet
Development

No branches or pull requests

7 participants