[Defend Workflows] `Hash` & `Signature` Field Does Not Support Matches Operator but Wildcard Warning; Suggest Switching to Matches Operator about kibana HOT 12 CLOSED

Can we display a different error that says MATCHES is not available for these fields if ? or * is used?

from kibana.

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

from kibana.

Pinging @elastic/security-solution (Team: SecuritySolution)

from kibana.

@muskangulati-qasource kindly review this
Thanks!

from kibana.

Reviewed and assigned to @dasansol92

from kibana.

@parkiino We should check if the field type supports the matches operator before showing the warning message.
cc: @caitlinbetz

from kibana.

Yeah we should probably just have a message stating that wildcards aren't supported for Signature / Hash (since "IS" is the only operator available) - ?

from kibana.

#178688

from kibana.

Hi @parkiino

We have validated this ticket on the 8.13.1 BC1 build and found the issue is NOT FIXED. ❌

Please find below the testing details

Build Details:

VERSION: 8.13.1
BUILD: 72107
COMMIT: 091f486

Screen recording

Please let us know if anything else is required from our end .

Thanks!

cc: @dasansol92

from kibana.

HI @sukhwindersingh-qasource I also built a 8.13.1 cloud instance and saw that the fix wasn't in. I believe it's because the pr got merge in the afternoon on Monday so it probably didn't make the quick release. The fix should be in for 8.13.2 at least and I'll talk to kibana-dev-ops to have it backported to 8.13.1

from kibana.

Hi @parkiino ,

Thank you for the update. We will validate this once 8.13.2 BC1 becomes available on cloud production. Additionally, we are updating the labels according to the requirements by adding the "QA ready for testing" and "8.13.2" label.

Thanks.

from kibana.

Hi @parkiino

We have validated this ticket on the 8.13.2 BC1 build and found the issue is FIXED. ✔️

Please find below the testing details

Build Details:

VERSION: 8.13.2 BC1
BUILD: 72154
COMMIT: d4d06bd

Screen recording

Hence, We are closing this issue and marking as QA Validated!!

Thanks!!

cc: @dasansol92

from kibana.