[Security Solution] [ENHANCEMENT] Unassigned impact is not allowed while adding in the asset criticality via bulk upload

[muskangulati-qasource]

Describe the bug Unassigned impact is not allowed while adding in the asset criticality via bulk upload

Kibana/Elasticsearch Stack version

VERSION: 8.16.0
BUILD: 78825
COMMIT: a805375758e4bc931cf13dfdcac89b8d877a15d2

Steps

1. Kibana version 8.16.0 or above should exist without endpoints
2. securitySolution:enableAssetCriticality flag should be enabled for Asset Criticality
3. Navigate to Security >> Manage >> Asset criticality
4. Create a file according to the example given
5. Click on ‘select or drag and drop a file’
6. Add the file created
7. Click on assign and observe for the output message: with error for unassigned value

Screenshot

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[muskangulati-qasource]

@amolnater-qasource please review!

[amolnater-qasource]

Reviewed & assigned to @MadameSheema

[elasticmachine]

Pinging @elastic/security-entity-analytics (Team:Entity Analytics)

[jaredburgettelastic]

👀

[jaredburgettelastic]

@hop-dev what is the new string value for unassignment, now that the /delete API is a soft delete?

[machadoum]

This is a great feature request, but it isn't a bug.

[muskangulati-qasource]

Thank you for the update @machadoum,

Please let us know if we need to change this ticket type from Query to Enhancement

Thanks!

[jaredburgettelastic]

Please let us know if we need to change this ticket type from Query to Enhancement

@muskangulati-qasource that works, thank you! We've gone ahead and added to our prioritized backlog

[muskangulati-qasource]

Hi @jaredburgettelastic,

We have updated the ticket and labels for the same.

Thanks!

[abhishekbhatia1710]

PR : https://github.com/elastic/kibana/pull/208884

[hop-dev]

Implementation plan as discussed in standup:

• Add the new unassigned status to bulk upload only
• All other asset criticality routes and UIs should be unaffected
• We can see here where the bulk upload assignment logic happens, I would expect us to copy the soft delete logic here

[jaredburgettelastic]

👋 Hey @muskangulati-qasource!

Apologies, I closed this issue without a proper update in comments.

As this was an enhancement and not a bug, it was only merged into the 9.1 branch.

So from our team's perspective, this issue is "Done". However, as you all raised the issue, would you like it to remain open until validated on your end? We've done sufficient validation/testing from our end, so the feature has already applied to Serverless.

Thanks!

[muskangulati-qasource]

Hi @jaredburgettelastic,

Thank you for looking into our ticket.

It would be helpful to keep the fixed ticket open so we can verify the bug resolution and gain a better understanding of the feature, especially in case any other related changes were included in the fix.

If you believe otherwise, please let us know.

cc: @MadameSheema Thank you!

[muskangulati-qasource]

Hi @MadameSheema,

We have validated this ticket against both 8.18.0 & 9.0 rc1 builds and found the fix is not available on any of them.

Please find below the testing details:

Build details

VERSION: 8.18.0
BUILD: 82557
COMMIT: b1da764d7db918082e4b9b82a8df5007f555e9b0

VERSION: 9.0.0-rc1
BUILD: 83822
COMMIT: 07dc0afa460bddff658ee6d5342ad1f087fc766b

Screenshots

• 8.18.0:

• 9.0.0:

File used:

user.txt

Please let us know if anything else is required from our end.

Thanks!

[MadameSheema]

@abhishekbhatia1710 can you please take a look at the above?

[machadoum]

Jared mentioned that it is only available on 9.1, but the feature was tested for 8.18.0 & 9.0. It is also hard to understand the prints because they don't mention the unassigned impact and try to set criticality many times for the same user and host, which generates the warning.

As this was an enhancement and not a bug, it was only merged into the 9.1 branch.

[muskangulati-qasource]

Hi @machadoum,

Thank you for looking into the same!

We did validate this ticket on 8.18 and 9.0 as per update from @MadameSheema.

Please refer to the updated screenshots below:

• 9.0.0:

• 8.18.0

We will validate this ticket on the mentioned 9.1 version and will close out this ticket afterwards.

Thank you!

[muskangulati-qasource]

Hi Team,

I have updates the labels to add labels for builds where the fix was merged.

Please update if required!

Thanks!

[jaredburgettelastic]

@muskangulati-qasource yes, the labels look appropriate.

If you'd like to test the functionality, you should be able to do so in Serverless!

[arvindersingh-qasource]

Hi @jaredburgettelastic

Thanks for the update.

We have validated this ticket on Serverless 9.1.0 and found that issue is still reproducible.

Please find the below observations

Build Details

VERSION: 9.1.0
BUILD: 84688
COMMIT: a9352bb57287cc6a06da99067b5dea694786e212

Observations

• Error shown for unknow_impact

Thanks.

[jaredburgettelastic]

👋 Hi @arvindersingh-qasource !

The above functionality is expected, as unknown_impact is indeed an invalid assignment.

What is now available in Serverless is unassigned_impact. See below screenshot for an example:

[arvindersingh-qasource]

Hi @jaredburgettelastic

Thanks for the update.

We have Validated this ticket on Serverless 9.1.0 build and at our end issue is still reproducible.

Please find the below observations

Build Details

VERSION: 9.1.0
BUILD: 84688
COMMIT: a9352bb57287cc6a06da99067b5dea694786e212

Observations

• Entry with unassigned_impact still shows the error.

• [ ] **Query ** : can you please share your build commits so that we can validate this issue on the same build version?

Thanks.

[jaredburgettelastic]

@abhishekbhatia1710 can you please have a look at the above, to see if this new unassigned_impact functionality should be available in Serverless?

[abhishekbhatia1710]

@arvindersingh-qasource : The new level is unassigned, rather than unassigned_impact or unknown_impact.

Screenshots for ref:

Serverless :

ESS:

[arvindersingh-qasource]

Hey @abhishekbhatia1710

Thanks for the clarification.

We have validated this issue on latest kibana v9.1.0 Snapshot build and found that issue is now fixed

Please find the below observations

Build Details

VERSION: 9.1.0
BUILD: 86565
COMMIT: b6c788655a044c70d9bce8545823669d3471361b

Observations

• unassigned impact as assignment

Hence, we are closing this ticket as QA Validated.

Thanks.