[Security Solution][Sourcerer] - Prevent setting update from solution component #201847
Labels
bug
Fixes for quality problems that affect the customer experience
Team:Threat Hunting:Investigations
Security Solution Investigations Team
Milestone
Summary
Relevant background information: #138181
In the Kibana advanced settings, users have the ability to set a default security data view that serves a default data view that is applied across multiple views in the security solution such as the explore pages and timeline. The setting for the advanced setting is below:
From within security solution itself, users are able to make changes to this default security dataview at the security solution level, in which it'll show a
modified
label to indicate that the dataview has been changed from the default setting in the advanced settings page.Back in 8.0, a change was made to help users with 7.x saved timelines that had index patterns migrate to 8.0 and utilize the new data view service. As part of this a notification was made for users to help them identify when the index pattern in their timeline differed from the default security data view set in the Advanced Setting as seen in the image below.
The issue here presents when a user has a mismatch between the index patterns in the security solution data view and the data view in an existing timeline. Easy way to replicate:
Steps to reproduce
In short, any time there is a mismatch between a saved set of index patterns and the advanced setting (as it is would be in any timelines saved prior to the advanced setting change), then it will deem the data view to need an 'update', which when clicked, will then re-add those indices to the default index in the advanced settings.
The text was updated successfully, but these errors were encountered: