Malformed table row, a cell is undefined error while generating PDF report for Rule ID 11

[sakib789]

Wazuh version	Component	Install type	Install method	Platform
4.7.2	PDF Report	-	-	-

Hello Team,

I've identified an issue while working on this community . It appears that whenever the number of events surpasses the average alerts by a significant margin, an alert with Rule ID 11 at level 4 is triggered. Strangely, this alert lacks any description, and it doesn't seem to be generated by any specific rule.

Upon investigation, it seems that the Check_Hour() function, responsible for this alert, can be found here. This function is called by w_process_event_thread (source) and triggers an alert whenever the number of events exceeds the average by a considerable margin.

However, due to the missing alert description, attempts to generate a PDF report including the alert (Rule ID: 11) result in an error: 'Malformed table row; a cell is undefined.'

Please refer to the attached screenshots for visual details.

A potential workaround is to deselect or filter out Rule ID 11 before generating the report.

I look forward to further investigation on this issue, aiming to ensure smoother generation of PDF reports.

[sakib789]

Another user also reported this https://github.com/wazuh/community/issues/24072

[Desvelao]

Research

The Summary table included in the module reports, aggregates data using some fields as rule.description. If the response matches with results without this field, the current algorithm transforms the API response to a table row and causes it does not add the values for the missing columns.

For example, the summary table on Modules > Security events > Dashboard (or Threat Hunting > Dashboard on 4.9.0) has the following columns:

• Rule ID: aggregation by rule.id
• Description: aggregation by rule.description
• Level: aggregation by rule.level
• Count: doc_count of rule.level aggregation

If the query matches with results without rule.description field, the aggregation of rule.id the algorithm to transform the API response to the table row, generates a row with the rule.id and the count. The values for the rule.description and rule.level are missing.

I solved in: https://github.com/wazuh/wazuh-dashboard-plugins/pull/6558/commits/3c742c09a7d19b3aa906a333ac6ade56b6e0d497