[Security Solution] [Inconsistent] [Bug] The 'Enable' button should be disabled if no changes are made to the confirmation modal

[muskangulati-qasource]

Describe the bug
The 'Enable' button should be disabled if no changes are made to the confirmation modal

Kibana/Elasticsearch Stack version

VERSION: 8.18.0
BUILD: 82206
COMMIT: 33e6754d67870b0e403266b752c3973539506cc6

Steps

1. Kibana version 8.16.0 or above should exist
2. Navigate to the Dashboards tab under Security
3. Select Entity Analytics dashboard
4. Click on the enable button and enable risk score
5. Disable the options for Entity store
6. Then again select the enable button for Entity store
7. Disable the enable button
8. Observe the Enable button is still enabled

Expected Result
The Enable button should be disabled when no changes are made

Screen Recording

Entity.Analytics.-.Kibana.-.Google.Chrome.2025-02-03.15-01-06.mp4

NOTE
This issue is inconsistent and hence marked it as priority low.

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[muskangulati-qasource]

@amolnater-qasource please review!

[amolnater-qasource]

Reviewed & assigned to @MadameSheema

[elasticmachine]

Pinging @elastic/security-entity-analytics (Team:Entity Analytics)

[jaredburgettelastic]

Exploration path: @abhishekbhatia1710 mentioned this could be due to the fact that the Entity store creates some Risk scoring components, need to investigate if that is the cause

[jaredburgettelastic]

Another path: make sure this fix is actually in the 8.18 branch (and if not, make sure it's in 8.x as well)

[CAWilson94]

@jaredburgettelastic Looks like the fix is in 8.18—both the confirmation modal message and logic to check state/hide/message are here, under enablementOptions and ENABLEMENT_WARNING_SELECT_TO_PROCEED.

I think @abhishekbhatia1710's suggestion is the way to go 🚀

[abhishekbhatia1710]

This issue seems to be specific to version 8.16. I created a cluster with 8.16 and was able to reproduce it, but I couldn’t reproduce it on 8.17 or 8.18.

I checked in 8.x, the changes are there.

Additionally, if the Enable button is clicked while the Enable Entity Store toggle is off, only the init API for the Risk Engine is triggered. This is likely because the UI detects that it should be switched on, given that its state remains ON if it was previously installed. However, nothing gets installed for the Entity Store.

For 8.16 :

Screen.Recording.2025-02-14.at.2.51.20.PM.mov

For 8.17 onwards:

Screen.Recording.2025-02-14.at.3.33.27.PM.mov

I recall an issue in the past where the Entity Store wasn’t enabled because certain Risk Score components weren’t available beforehand. It was a "sequence issue" where both the Risk Score Engine and Entity Store Engine were enabled in parallel using the Enablement modal. If the Risk Score Engine failed to run, the Entity Store wouldn’t get enabled.

However, this seems like the UI changes are not reflecting in 8.16 version at all.

[CAWilson94]

Thanks all for the collab on above! I added a final fix here. Previous fix looked only at the state of the toggle buttons only and did not account for riskScore or EntityStore enablement specifically.

[jaredburgettelastic]

The first fix is in for this, however, not adding the "fixed" label until @machadoum adds a couple more bug fixes.

[machadoum]

Linking PR

[muskangulati-qasource]

Thank you for the update @machadoum,

We will validate this issue once we receive a new BC build for 8.18.0.

Thank you!