kibana icon indicating copy to clipboard operation
kibana copied to clipboard

[Security Solution] Add validation error description on prebuilt rule editing

Open e40pud opened this issue 5 months ago • 4 comments

While working on https://github.com/elastic/kibana/issues/180407 and adding this PR https://github.com/elastic/kibana/pull/191487, @vitaliidm brought up the confusion with rule validation errors while editing prebuilt rules:

Right now, we show only a short message at the top of the page about the existing error on some tabs without any clarification about the source of the error. In the example below we show You have an invalid input in this tab: Definition:

Image

Since users still cannot edit prebuilt rules, they cannot navigate to the mentioned tabs and see the reason of the error. We believe this may confuse our users and not the best UX.

Possible solutions:

  1. We can show actual error description in the error panel
Sorry

You have an invalid input in this tab: Definition

Query bar: "Found 2 problems\nline 39:11: Unknown column [destination.ip]\nline 45:9: Unknown column [dns.question.name]"
  1. After these changes https://github.com/elastic/kibana/pull/191487 we show confirmation modal to the user where we could add error description. We decided to avoid it here, but maybe we could re-evaluate this.

Image

cc @approksiu @banderror @yctercero

e40pud avatar Aug 30 '24 12:08 e40pud