[Defend Workflows] [Trusted Devices multiple Conditions] "At least one condition must be specified" error appears immediately upon opening the "Add trusted device" flyout.

[sukhwindersingh-qasource]

Description:

• When a user clicks "Add trusted device", the flyout opens with a default empty condition row (Device ID > is > [Empty]). However, a validation error reading "At least one condition must be specified" is displayed immediately below the condition builder before the user has interacted with the form or attempted to save.

Login Credentials:

• https://p.elstc.co/?aa20950420d51ffc#5XwMJZBfqP6HmgF3fVUPvzAdfXjbt7NeHK3npxFB3mJt - PR Created by @parkiino

Testing Details:

Build Details:

VERSION: 9.5.0
BUILD: 103869
COMMIT: cdb82b477d01c50e8c16b3a876d56476176c54b5

Precondition :

• Kibana PR should be accessible - [EDR Workflows][Trusted Devices] Allow user to add multiple conditions in trusted devices form #268011

Steps to Reproduce:

1. Navigate to Security > Manage > Artifacts.
2. Select the Trusted devices tab.
3. Click the Add trusted device button.
4. Scroll down to the Conditions section in the right-hand flyout.
5. Observe the validation state below the condition builder.

Actual Result:

• The red error message "At least one condition must be specified" is present by default upon opening the flyout.

Expected Result:

• The form should load in a clean state. Validation errors should only appear after the user interacts with the fields and leaves them invalid (on blur), or when the user attempts to submit the form (on submit).

Screen Capture:

20260528-0732-06.7665055.mp4

Additional Notes (from video recording):

• If the user enters text into the "Value" field, the initial error disappears.
• If the user subsequently clears that text, a new, more accurate error message appears: "Condition value cannot be empty".
• This suggests the initial state validation is improperly evaluating the default empty row as having zero conditions, rather than treating it as an incomplete condition that hasn't been touched yet.

Regression

• No ❌

Logs:

• N/A

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-solution (Team: SecuritySolution)

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

[sukhwindersingh-qasource]

@muskangulati-qasource Please review this

[muskangulati-qasource]

Reviewed and assigned to @dasansol92