Skip to content

Commit a72fa85

Browse files
rylndcursoragent
andcommitted
[Security Solution] Show more alert action error info in error toasts (#269592)
## Summary Addresses #269533. When a user without sufficient index write access performs alert actions in Security Solution, the error toast appeared with a blank body instead of the actual reason from Elasticsearch. ### Cause Several hooks called `addError(error.message, { title })`, passing a plain string instead of the error object. `useAppToasts.addError` runs its input through `errorToErrorStackAdapter`, which unpacks a Kibana `HttpFetchError` (including the nested Elasticsearch reason string) only when given the full error object. Passing `error.message` bypasses that logic, leaving the toast body blank on permission errors. ### Fix Pass `error` directly to `addError` in the following hooks: - `useSetAlertAssignees` (`use_set_alert_assignees.tsx`) -- assign alert - `useSetAlertTags` (`use_set_alert_tags.tsx`) -- bulk tag update - `onAlertStatusUpdateFailure` in `useBulkActionItems`, `useAlertActions`, and `useGroupTakeActionItems` -- open / close / acknowledge - `useCasesFromAlerts` (`use_cases_from_alerts.tsx`) -- cases fetch on flyout open (fires automatically; users without Cases read access would have seen a blank toast on every flyout open) ## Steps to reproduce 1. Create a role with `view_index_metadata`, `write`, and `manage` on `.alerts-security.alerts-{space}`, but without `create_doc` / `index` / `all`. 2. Log in as a user assigned that role and navigate to Security -> Alerts. 3. Attempt any of the following: - Assign an alert to a user - Add or remove a tag via bulk actions - Change workflow status (open / close / acknowledge) - Open an alert flyout (if the user also lacks Cases read access) 4. Observe the error toast: the body is blank even though the browser console shows a detailed authorization error. **Expected:** the toast body shows the Elasticsearch authorization reason (e.g. "action [indices:data/write/bulk[s]] is unauthorized ..."). Example: <kbd> <img width="655" height="599" alt="Screenshot 2026-05-15 at 4 42 24 PM" src="https://github.com/user-attachments/assets/08fa0524-62f8-41e7-980b-25bbd1e49960" /> </kbd> <kbd> <img width="857" height="859" alt="Screenshot 2026-05-15 at 4 42 33 PM" src="https://github.com/user-attachments/assets/d95635c5-f55d-44a7-8509-bb5a0960a74f" /> </kbd> **Actual (before fix):** the toast body is blank. Example: <kbd> <img width="372" height="205" alt="Screenshot 2026-05-15 at 4 44 53 PM" src="https://github.com/user-attachments/assets/95ba3628-78a8-424c-9af4-0f61e9a2330e" /> </kbd> <kbd> <img width="857" height="859" alt="Screenshot 2026-05-15 at 4 44 34 PM" src="https://github.com/user-attachments/assets/74f0e932-92a0-4188-9a43-e69ed28636bb" /> </kbd> ## Release note Error toasts for failed alert actions (assign, tag, open, close, acknowledge) now show the full error message from Elasticsearch instead of a blank body. --------- Co-authored-by: Cursor <cursoragent@cursor.com> (cherry picked from commit cbabddd)
1 parent c5435af commit a72fa85

6 files changed

Lines changed: 8 additions & 8 deletions

File tree

x-pack/solutions/security/plugins/security_solution/public/common/components/toolbar/bulk_actions/use_bulk_action_items.tsx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ export const useBulkActionItems = ({
9494
case 'acknowledged':
9595
title = i18n.ACKNOWLEDGED_ALERT_FAILED_TOAST;
9696
}
97-
addError(error.message, { title });
97+
addError(error, { title });
9898
if (onUpdateFailure) {
9999
onUpdateFailure(newStatus, error);
100100
}

x-pack/solutions/security/plugins/security_solution/public/common/components/toolbar/bulk_actions/use_set_alert_assignees.tsx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ export const useSetAlertAssignees = (): ReturnSetAlertAssignees => {
4040
);
4141

4242
const onUpdateFailure = useCallback(
43-
(error: Error) => {
44-
addError(error.message, { title: i18n.UPDATE_ALERT_ASSIGNEES_FAILURE });
43+
(error: unknown) => {
44+
addError(error, { title: i18n.UPDATE_ALERT_ASSIGNEES_FAILURE });
4545
},
4646
[addError]
4747
);

x-pack/solutions/security/plugins/security_solution/public/common/components/toolbar/bulk_actions/use_set_alert_tags.tsx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,8 @@ export const useSetAlertTags = (): ReturnSetAlertTags => {
4141
);
4242

4343
const onUpdateFailure = useCallback(
44-
(error: Error) => {
45-
addError(error.message, { title: i18n.UPDATE_ALERT_TAGS_FAILURE });
44+
(error: unknown) => {
45+
addError(error, { title: i18n.UPDATE_ALERT_TAGS_FAILURE });
4646
},
4747
[addError]
4848
);

x-pack/solutions/security/plugins/security_solution/public/detections/containers/detection_engine/alerts/use_cases_from_alerts.tsx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ export const useCasesFromAlerts = ({ alertId }: { alertId: string }): CasesFromA
3434
setCases(casesResponse);
3535
}
3636
} catch (error) {
37-
addError(error.message, { title: CASES_FROM_ALERTS_FAILURE });
37+
addError(error, { title: CASES_FROM_ALERTS_FAILURE });
3838
}
3939
if (isMounted) {
4040
setLoading(false);

x-pack/solutions/security/plugins/security_solution/public/detections/hooks/alerts_table/use_group_take_action_items.tsx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ export const useGroupTakeActionsItems = ({
134134
case 'acknowledged':
135135
title = i18n.ACKNOWLEDGED_ALERT_FAILED_TOAST;
136136
}
137-
addError(error.message, { title });
137+
addError(error, { title });
138138
refetchQuery();
139139
},
140140
[addError, refetchQuery]

x-pack/solutions/security/plugins/security_solution/public/detections/hooks/trigger_actions_alert_table/use_alert_actions.tsx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ export const useBulkAlertActionItems = ({
9090
case 'acknowledged':
9191
title = i18n.ACKNOWLEDGED_ALERT_FAILED_TOAST;
9292
}
93-
addError(error.message, { title });
93+
addError(error, { title });
9494
},
9595
[addError]
9696
);

0 commit comments

Comments
 (0)