Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] exclude_export_details export flag also excludes exceptions and exception lists #4219

Open
Vexil-Derivative opened this issue Oct 30, 2024 · 0 comments
Labels
bug Something isn't working community Team: TRADE

Comments

@Vexil-Derivative
Copy link

Describe the Bug

When exporting detection rules via the API, setting exclude_export_details to true will only output the rule objects, excluding the exceptions and exception lists. Setting it to false exports the rules, exceptions, exception lists, and a summary line at the end of the file. The documentation states this flag should only exclude the summary line, so this behavior is unexpected.

To Reproduce

  1. Create at least 1 custom rule and add an exception
  2. Run the following 2 POST requests:
    POST <kibana host>:<port>/api/detection_engine/rules/_export
    POST <kibana host>:<port>/api/detection_engine/rules/_export?exclude_export_details
  3. Compare the two responses, note the second one does not include the exception logic.

Expected Behavior

The exclude_export_details flag should only exclude the final summary line. All rules and exception objects should be output regardless as to how this flag is set.

Screenshots

No response

Desktop - OS

None

Desktop - Version

No response

Additional Context

Tested on 8.15.1, but we also noticed the issue on 8.13 previously.

@Vexil-Derivative Vexil-Derivative added bug Something isn't working Team: TRADE labels Oct 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working community Team: TRADE
Projects
None yet
Development

No branches or pull requests

1 participant