Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SIEM "Additional look-back time" UI logic clobbers partial hours: e.g. 73 minutes becomes 1h in the UI #74767

Closed
bczifra opened this issue Aug 11, 2020 · 3 comments
Assignees
Labels
bug Fixes for quality problems that affect the customer experience Feature:Detection Rules Anything related to Security Solution's Detection Rules fixed impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM

Comments

@bczifra
Copy link
Member

bczifra commented Aug 11, 2020

Kibana version: 7.8.0

Elasticsearch version: 7.8.0

Describe the bug:
If a detection rule sets an "Additional look-back time" using minutes or seconds to what equates to a fractional hour, the rule is persisted correctly, and the API returns the response correctly. However, that UI clobbers response, taking the floor of the fractional hour. So, 67 minutes gets displayed as 1h, 139 minutes gets rendered as 2h. I think I've been able to track down the responsible UI code that clobbers it:

export const getHumanizedDuration = (from: string, interval: string): string => {
  const fromValue = dateMath.parse(from) ?? moment();
  const intervalValue = dateMath.parse(`now-${interval}`) ?? moment();

  const fromDuration = moment.duration(intervalValue.diff(fromValue));
  const fromHumanize = `${Math.floor(fromDuration.asHours())}h`;

  if (fromDuration.asSeconds() < 60) {
    return `${Math.floor(fromDuration.asSeconds())}s`;
  } else if (fromDuration.asMinutes() < 60) {
    return `${Math.floor(fromDuration.asMinutes())}m`;
  }

  return fromHumanize;
};

If I read this right, a duration as seconds of greater than or equal to 60 will be set to:

const fromHumanize = `${Math.floor(fromDuration.asHours())}h`;

which will round down to the nearest whole hour.

Steps to reproduce:

  1. Create a new rule, or edit an existing rule, and set the "Additional look-back time" to 137 minutes
  2. Save the rule
  3. View the rule and you'll see 2h displayed.

Expected behavior: Either see the time in the original units entered, or as some fractional value of a larger order of magnitude unit.

@bczifra bczifra added bug Fixes for quality problems that affect the customer experience Team:SIEM Feature:Detection Rules Anything related to Security Solution's Detection Rules labels Aug 11, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/siem (Team:SIEM)

@MadameSheema MadameSheema added the Team:Detections and Resp Security Detection Response Team label Oct 1, 2020
@MindyRS MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Oct 15, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-security (Team:Security Solution)

@peluja1012 peluja1012 added fixed impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. labels Oct 26, 2020
@MadameSheema
Copy link
Member

Fixed on 7.10BC4

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Feature:Detection Rules Anything related to Security Solution's Detection Rules fixed impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:SIEM
Projects
None yet
Development

No branches or pull requests

6 participants