[7.x] [SIEM] Fix: Empty Source / Destination shown when only ports are populated (#50843)
#50971
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…populated (elastic#50843) Fixes an issue where an empty `Source` or `Destination` container is rendered by the Timeline row renderer when events have `source.port` or `destination.port` populated, but the corresponding `source.ip` or `destination.ip` is not.   The following JSON is from the event shown in the screenshots above: ``` "destination": { "port": 53 }, ``` In the JSON above, the `destination.port` field is populated, but the `destination.ip` field is **not** populated. The `destination.port` in the event is expected to be rendered in the "before" screenshot above, but an empty `Destination` label is rendered instead. 1. Create a new timeline with the following KQL: ``` destination.port: * and NOT destination.ip: * ``` **Expected Result** - The `destination.port` contained in the event is rendered in the `Destination` container **Actual result** - An empty `Destination` is rendered, per the "before" screenshot above An analysis of real data performed while desk testing this PR revealed other corner cases in real-world data, including port arrays with `null` values. The types and implementaion were updated to reflect the reality of the data found during desk testing. Unit tests were added to cover these cases.   Note: This PR was NOT tested in IE 11, due to unrelated IE 11 issues with dependencies in `master` * elastic/siem-team#476
💚 Build Succeeded |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backports the following commits to 7.x:
Source/Destinationshown when only ports are populated ([SIEM] Fix: EmptySource/Destinationshown when only ports are populated #50843)