[FR] Add Kibana Action Connector Error to Exception List Workaround

[eric-forte-elastic]

Pull Request

Issue link(s):

Resolves #4577

Summary - What I changed

This PR a similar form of error handling to catch a customer issue where importing rules with action connectors, it triggers what amounts to a race condition where Kibana is still creating the underlying connector and also tries to import the rule before the connector has finished being created. In these cases, simply re-trying the import command will address the issue as the creation time for the connector is seconds and by the time the error message prints, the connector is likely finished being created. As such, this error is non-deterministic.

We have existing logic to catch a known Kibana issue when importing rules dealing with Exception Lists, this logic instructs the user to re-run the command with specific parameters. The current action connectors case is a simpler situation where one can simply re-run the last command; however, we can utilize the existing logic to detect the issue and print out a recommendation of re-running the command to address the issues.

Note: This PR should not be merged until the Kibana team is notified of the issue so it can be documented there as well.

This PR exists to explicitly to supply a workaround for Kibana rules data ingestion. This will occur in an ndjson import as well.

How To Test

Testing may be difficult due to the nature of the issue, but the following command to import rules to Kibana can be used as an example to trigger the issue. Additionally, make sure the rules used have action connectors that reference connectors that do not exist in Kibana (or at least in the given space).

python -m detection_rules kibana import-rules -d new_dac_demo/rules -o -e -ac

Error example:

1 rule(s) failed to import!
 - 4384ef25-1ead-4771-9c5d-7746ea1bff2a: (400) Error validating update data - [actions.0.id]: expected value of type [string] but got [undefined]

Checklist

• Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
• Added the meta:rapid-merge label if planning to merge within 24 hours
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[github-actions]

Enhancement - Guidelines

These guidelines serve as a reminder set of considerations when addressing adding a feature to the code.

Documentation and Context

• Describe the feature enhancement in detail (alternative solutions, description of the solution, etc.) if not already documented in an issue.
• Include additional context or screenshots.
• Ensure the enhancement includes necessary updates to the documentation and versioning.

Code Standards and Practices

• Code follows established design patterns within the repo and avoids duplication.
• Code changes do not introduce new warnings or errors.
• Variables and functions are well-named and descriptive.
• Any unnecessary / commented-out code is removed.
• Ensure that the code is modular and reusable where applicable.
• Check for proper exception handling and messaging.

Testing

• New unit tests have been added to cover the enhancement.
• Existing unit tests have been updated to reflect the changes.
• Provide evidence of testing and validating the enhancement (e.g., test logs, screenshots).
• Validate that any rules affected by the enhancement are correctly updated.
• Ensure that performance is not negatively impacted by the changes.
• Verify that any release artifacts are properly generated and tested.

Additional Checks

• Ensure that the enhancement does not break existing functionality.
• Review the enhancement with a peer or team member for additional insights.
• Verify that the enhancement works across all relevant environments (e.g., different OS versions).
• Confirm that all dependencies are up-to-date and compatible with the changes.
• Confirm that the proper version label is applied to the PR patch, minor, major.

[Mikaayenson]

lgtm

[eric-forte-elastic]

This Kibana PR elastic/kibana#216380 may address this issues as well.