[Security Solution] With maximum allowed value 9007199254740991 under History Window Size for New Term Rule creation, it is showing error as params invalid: Failed to parse 'historyWindowStart' (400)

[arvindersingh-qasource]

Describe the bug
With maximum allowed value 9007199254740991 under History Window Size for New Term Rule creation, it is showing error as params invalid: Failed to parse 'historyWindowStart' (400)

Kibana/Elasticsearch Stack version

VERSION: 8.16.0
BUILD: 78938
COMMIT: 7b832691e8b07c67b411da95b0398a04711da864

Pre Conditions

1. Kibana v8.16.0 snapshot build be must be available

Steps

1. Navigate to Security -> Rules -> Detection rules (SIEM).
2. Click on Create New Rule option.
3. Select Rule type as New Terms
4. Add any Custom query.
5. Under Fields , select any field from dropdown.
6. Under History Window Size enter maximum allowed value as 9007199254740991
7. Click on Continue button.
8. Enter Rule Name and Description.
9. Click on either Create rule without enabling it or Create & Enable rule.
10. Observe there will be an error as params invalid: Failed to parse 'historyWindowStart' (400)

Expected Result

• User should be able to create rule for all the allowed values under History Window Size field OR User should be restricted to enter large values which are not validated by application.

Screen Recording

Detection.rules.SIEM.-.Kibana.-.Google.Chrome.2024-10-09.16-25-58.mp4

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[arvindersingh-qasource]

@muskangulati-qasource Please review this ticket.

Thanks.

[elasticmachine]

Pinging @elastic/security-detection-engine (Team:Detection Engine)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[yctercero]

@arvindersingh-qasource thanks for filing! Just to clarify:

• Value of 0 is correctly invalid and error shows
• Value between 0 and max works
• Only with max, this error is displayed?

[arvindersingh-qasource]

Hi @yctercero

We have validated this issue on Kibana v8.16.0 and the issue that with max value, the error params invalid: Failed to parse 'historyWindowStart' (400) is displayed

Please find below observations

Build Details

VERSION: 8.16.0
BUILD: 79314
COMMIT: 5575428dd3aef69366cddb4ccf07a2a26d30ce48

Observations

• Value of 0 is correctly invalid and error shows 🟢
  

• Value between 0 and max works 🟢
  

• Only with max, this error is displayed? 🔴
  

Please let us know if anything else is required from our end.

Thanks.