kibana
kibana copied to clipboard
[Security Solution] Add validation error description on prebuilt rule editing
While working on https://github.com/elastic/kibana/issues/180407 and adding this PR https://github.com/elastic/kibana/pull/191487, @vitaliidm brought up the confusion with rule validation errors while editing prebuilt rules:
Right now, we show only a short message at the top of the page about the existing error on some tabs without any clarification about the source of the error. In the example below we show You have an invalid input in this tab: Definition
:
Since users still cannot edit prebuilt rules, they cannot navigate to the mentioned tabs and see the reason of the error. We believe this may confuse our users and not the best UX.
Possible solutions:
- We can show actual error description in the error panel
Sorry
You have an invalid input in this tab: Definition
Query bar: "Found 2 problems\nline 39:11: Unknown column [destination.ip]\nline 45:9: Unknown column [dns.question.name]"
- After these changes https://github.com/elastic/kibana/pull/191487 we show confirmation modal to the user where we could add error description. We decided to avoid it here, but maybe we could re-evaluate this.
cc @approksiu @banderror @yctercero