Not Getting "file.path.text" and "file.EXt.code_signature" fields value under the Endpoint Exception Form

[ghost]

Description
Not Getting "file.path.text" and "file.EXt.code_signature" fields value under the Endpoint Exception Form

Build Details:

Version: 7.11.0 BC7
Build: 37897
Commit: 3f71ce7177a41e067ddb1e670ec4ace5f6d4f5fe
Artifacts: https://staging.elastic.co/7.11.0-657c0367/summary-7.11.0.html

Browser Details:
All

Preconditions:

1. Cloud environment should exist
2. Endpoint security should be installed.
3. Mimikatz alert with signer should be generated. Link to the File is here

Steps to Reproduce:

1. Navigate to the Detection tab of the security
2. Execute the Mimikatz file on the endpoint
3. Click on more action on the generated alert.
4. Click on add endpoint exception.
5. Observe that file.path.text and file.EXt.code_signature fields value are missing in the Add Endpoint Exception Form.

Note: The missing Fields though are present in Alert signal detailed view [ table view ]

Impacted Test case:

• C20386
• C18024

Actual Result:
Not Getting "file.path.text" and "file.EXt.code_signature" field value under the Add Endpoint Exception Form

Expected Result:
"file.path.text" and "file.EXt.code_signature value" field value should be present under the Add Endpoint Exception Form

What's working:

• Required fields value are present the alert signal detailed view [ Table view ]
  
  

What's not working:

• User is not even able to add missing field manually and get their value by auto-suggestion.
  

Screenshot:

Logs
N/A

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[ghost]

@karanbirsingh-qasource Please review!!

[manishgupta-qasource]

Reviewed & Assigned to @peluja1012

[dplumlee]

Related #90808

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[dplumlee]

@deepikakeshav-qasource I think this is ready to be tested again, we've made a few different changes in master that seem to solve the issues listed. For case C20386, we'll need to update it from file.path.text to file.path.caseless as well, we no longer have .text fields as exceptionable fields. Once that case is updated I believe everything should be good to go

[ghost]

Hi @dplumlee

We have validated this Ticket on 7.12.0 BC3 and found that issue is Fixed and We have updated below test case from file.path.text to file.path.caseless:

Test case Updated:

• C20386

Build Details:

Version: 7.12.0-BC3
Platform: Production
Commit:08417cbd6c15e4c866651a7dcdfeded58845206d
Build:39134
https://staging.elastic.co/7.12.0-96914cb5/summary-7.12.0.html

Screenshot:

• Alerts are not triggered after added the signed mimikatz alert.
  
  

• Alerts are not triggerd after added only "file.path.caseless" field.
  

Moreover, We have reported the issue for when clicking on the "file.Ext.code_signature" field delete icon, "trusted" field becomes the nested field of file.path.caseless under endpoint exception modal. [#93559]

Hence, we are closing this issue and will track the issue here

[ghost]

Bug Conversion :

Test case already exist for ticket:
https://elastic.testrail.io/index.php?/cases/view/20386

Thanks!!