[ML] Tokens in custom URLs to security plugin are not being substituted with anomaly values #76789
Labels
bug
Fixes for quality problems that affect the customer experience
Feature:Anomaly Detection
ML anomaly detection
Feature:Detection Rules
Anything related to Security Solution's Detection Rules
:ml
v7.10.0
Jobs in the
siem_auditbeat
andsiem_winlogbeat
modules contain custom URLs to the Hosts page in the Security plugin with$
delimited tokens to pass the anomaloususer.name
orprocess.name
for use in the query in the target page. However these tokens are no longer being substituted with values from the anomaly.For example, the
rare_process_by_host_linux_ecs
job contains the 'Host Details by process name' custom URL:But the anomalous
process.name
is not being substituted on opening, and instead a URL of the formis opened, where only the
host.name
,earliest
andlatest
tokens are being substituted. The value of theprocess.name
from the anomaly should be substituted into the custom URL too.The text was updated successfully, but these errors were encountered: