Skip to content

[Security Solution] Show more alert action error info in error toasts#269592

Merged
rylnd merged 4 commits into
elastic:mainfrom
rylnd:rylnd/fix_alert_assignee_errors
May 29, 2026
Merged

[Security Solution] Show more alert action error info in error toasts#269592
rylnd merged 4 commits into
elastic:mainfrom
rylnd:rylnd/fix_alert_assignee_errors

Conversation

@rylnd
Copy link
Copy Markdown
Contributor

@rylnd rylnd commented May 15, 2026 •
edited by kibanamachine
Loading

Summary

Addresses #269533.

When a user without sufficient index write access performs alert actions in Security Solution, the error toast appeared with a blank body instead of the actual reason from Elasticsearch.

Cause

Several hooks called addError(error.message, { title }), passing a plain string instead of the error object. useAppToasts.addError runs its input through errorToErrorStackAdapter, which unpacks a Kibana HttpFetchError (including the nested Elasticsearch reason string) only when given the full error object. Passing error.message bypasses that logic, leaving the toast body blank on permission errors.

Fix

Pass error directly to addError in the following hooks:

  • useSetAlertAssignees (use_set_alert_assignees.tsx) -- assign alert
  • useSetAlertTags (use_set_alert_tags.tsx) -- bulk tag update
  • onAlertStatusUpdateFailure in useBulkActionItems, useAlertActions, and useGroupTakeActionItems -- open / close / acknowledge
  • useCasesFromAlerts (use_cases_from_alerts.tsx) -- cases fetch on flyout open (fires automatically; users without Cases read access would have seen a blank toast on every flyout open)

Steps to reproduce

  1. Create a role with view_index_metadata, write, and manage on .alerts-security.alerts-{space}, but without create_doc / index / all.
  2. Log in as a user assigned that role and navigate to Security -> Alerts.
  3. Attempt any of the following:
    • Assign an alert to a user
    • Add or remove a tag via bulk actions
    • Change workflow status (open / close / acknowledge)
    • Open an alert flyout (if the user also lacks Cases read access)
  4. Observe the error toast: the body is blank even though the browser console shows a detailed authorization error.

Expected: the toast body shows the Elasticsearch authorization reason (e.g. "action [indices:data/write/bulk[s]] is unauthorized ...").

Example:

Screenshot 2026-05-15 at 4 42 24 PM

Screenshot 2026-05-15 at 4 42 33 PM

Actual (before fix): the toast body is blank.
Example:

Screenshot 2026-05-15 at 4 44 53 PM

Screenshot 2026-05-15 at 4 44 34 PM

Release note

Error toasts for failed alert actions (assign, tag, open, close, acknowledge) now show the full error message from Elasticsearch instead of a blank body.

rylnd and others added 2 commits May 15, 2026 16:45
@rylnd
Fix display of toast error message when updating alert assignees
98ee8f1 
Passing the message string directly into `addError` bypasses all the
parsing logic we have in that method. By passing the full object
instead, we properly pull out and display all the information from the
error.
@rylnd @cursoragent
[Security Solution] Pass full error object to addError in alert actio…
71d08c0 
…n hooks

Fixes elastic#269533.

Several hooks called `addError(error.message, { title })`, passing a plain
string instead of the error object. `useAppToasts.addError` runs its input
through `errorToErrorStackAdapter`, which unpacks a Kibana `HttpFetchError`
(including the nested Elasticsearch reason string) only when given the full
error object. Passing `error.message` bypasses that logic, leaving the toast
body blank on permission errors.

Affected hooks:
- `useSetAlertAssignees` (assignees update)
- `useSetAlertTags` (tags update)
- `onAlertStatusUpdateFailure` in `useBulkActionItems`, `useAlertActions`,
  and `useGroupTakeActionItems` (open/close/acknowledge)
- `useCasesFromAlerts` (cases fetch on flyout open)

Co-authored-by: Cursor <cursoragent@cursor.com>
@rylnd rylnd self-assigned this May 15, 2026
@rylnd rylnd added release_note:fix backport:all-open Backport to all branches that could still receive a release Team:Detection Engine Security Solution Detection Engine Area labels May 15, 2026
@rylnd rylnd changed the title Rylnd/fix alert assignee errors [Security Solution] Show more alert action error info in error toast s May 15, 2026
@rylnd rylnd changed the title [Security Solution] Show more alert action error info in error toast s [Security Solution] Show more alert action error info in error toasts May 15, 2026
@rylnd rylnd marked this pull request as ready for review May 20, 2026 20:23
@rylnd rylnd requested review from a team as code owners May 20, 2026 20:23
@rylnd rylnd requested a review from dhurley14 May 20, 2026 20:23
@infra-vault-gh-plugin-prod
Copy link
Copy Markdown

infra-vault-gh-plugin-prod Bot commented May 20, 2026

Pinging @elastic/security-detection-engine (Team:Detection Engine)

agusruidiazgd
agusruidiazgd approved these changes May 27, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@agusruidiazgd agusruidiazgd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - thanks for this fix ✨

@rylnd rylnd enabled auto-merge (squash) May 29, 2026 21:49
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented May 29, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #145 / Cloud Security Posture - Group 5 (KSPM + Flyouts) Security Alerts Page - Graph visualization expanded flyout - filter by node

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 12.1MB 12.1MB -48.0B

History

cc @rylnd

@rylnd rylnd merged commit cbabddd into elastic:main May 29, 2026
31 checks passed
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented May 29, 2026

Starting backport for target branches: 8.19, 9.3, 9.4

https://github.com/elastic/kibana/actions/runs/26665012439

This was referenced May 29, 2026
Open
Open
Merged
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented May 29, 2026

💚 All backports created successfully

Status Branch Result
✅ 8.19
✅ 9.3
✅ 9.4

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request May 29, 2026
@kibanamachine @rylnd @cursoragent
[9.4] [Security Solution] Show more alert action error info in error …
3c1d461 
…toasts (#269592) (#272005)

# Backport

This will backport the following commits from `main` to `9.4`:
- [[Security Solution] Show more alert action error info in error toasts
(#269592)](#269592)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Ryland
Herrick","email":"ryalnd@gmail.com"},"sourceCommit":{"committedDate":"2026-05-29T22:16:57Z","message":"[Security
Solution] Show more alert action error info in error toasts
(#269592)\n\n## Summary\n\nAddresses #269533.\n\nWhen a user without
sufficient index write access performs alert actions\nin Security
Solution, the error toast appeared with a blank body instead\nof the
actual reason from Elasticsearch.\n\n### Cause\n\nSeveral hooks called
`addError(error.message, { title })`, passing a\nplain string instead of
the error object. `useAppToasts.addError` runs\nits input through
`errorToErrorStackAdapter`, which unpacks a Kibana\n`HttpFetchError`
(including the nested Elasticsearch reason string) only\nwhen given the
full error object. Passing `error.message` bypasses that\nlogic, leaving
the toast body blank on permission errors.\n\n### Fix\n\nPass `error`
directly to `addError` in the following hooks:\n\n-
`useSetAlertAssignees` (`use_set_alert_assignees.tsx`) -- assign
alert\n- `useSetAlertTags` (`use_set_alert_tags.tsx`) -- bulk tag
update\n- `onAlertStatusUpdateFailure` in
`useBulkActionItems`,\n`useAlertActions`, and `useGroupTakeActionItems`
-- open / close /\nacknowledge\n- `useCasesFromAlerts`
(`use_cases_from_alerts.tsx`) -- cases fetch on\nflyout open (fires
automatically; users without Cases read access would\nhave seen a blank
toast on every flyout open)\n\n## Steps to reproduce\n\n1. Create a role
with `view_index_metadata`, `write`, and `manage`
on\n`.alerts-security.alerts-{space}`, but without `create_doc` /
`index` /\n`all`.\n2. Log in as a user assigned that role and navigate
to Security ->\nAlerts.\n3. Attempt any of the following:\n - Assign an
alert to a user\n - Add or remove a tag via bulk actions\n - Change
workflow status (open / close / acknowledge)\n - Open an alert flyout
(if the user also lacks Cases read access)\n4. Observe the error toast:
the body is blank even though the browser\nconsole shows a detailed
authorization error.\n\n**Expected:** the toast body shows the
Elasticsearch authorization\nreason (e.g. \"action
[indices:data/write/bulk[s]] is unauthorized ...\").\n\nExample:
\n<kbd>\n<img width=\"655\" height=\"599\" alt=\"Screenshot 2026-05-15
at 4 42
24 PM\"\nsrc=\"https://github.com/user-attachments/assets/08fa0524-62f8-41e7-980b-25bbd1e49960\"\n/>\n\n</kbd>\n<kbd>\n<img
width=\"857\" height=\"859\" alt=\"Screenshot 2026-05-15 at 4 42
33 PM\"\nsrc=\"https://github.com/user-attachments/assets/d95635c5-f55d-44a7-8509-bb5a0960a74f\"\n/>\n\n</kbd>\n\n**Actual
(before fix):** the toast body is blank.\nExample: \n<kbd>\n<img
width=\"372\" height=\"205\" alt=\"Screenshot 2026-05-15 at 4 44
53 PM\"\nsrc=\"https://github.com/user-attachments/assets/95ba3628-78a8-424c-9af4-0f61e9a2330e\"\n/>\n\n</kbd>\n<kbd>\n<img
width=\"857\" height=\"859\" alt=\"Screenshot 2026-05-15 at 4 44
34 PM\"\nsrc=\"https://github.com/user-attachments/assets/74f0e932-92a0-4188-9a43-e69ed28636bb\"\n/>\n\n</kbd>\n\n##
Release note\n\nError toasts for failed alert actions (assign, tag,
open, close,\nacknowledge) now show the full error message from
Elasticsearch instead\nof a blank body.\n\n---------\n\nCo-authored-by:
Cursor
<cursoragent@cursor.com>","sha":"cbabddd93c9093dc18077b044e6cac6d2e82232f","branchLabelMapping":{"^v9.5.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","backport:all-open","Team:Detection
Engine","v9.5.0"],"title":"[Security Solution] Show more alert action
error info in error
toasts","number":269592,"url":"https://github.com/elastic/kibana/pull/269592","mergeCommit":{"message":"[Security
Solution] Show more alert action error info in error toasts
(#269592)\n\n## Summary\n\nAddresses #269533.\n\nWhen a user without
sufficient index write access performs alert actions\nin Security
Solution, the error toast appeared with a blank body instead\nof the
actual reason from Elasticsearch.\n\n### Cause\n\nSeveral hooks called
`addError(error.message, { title })`, passing a\nplain string instead of
the error object. `useAppToasts.addError` runs\nits input through
`errorToErrorStackAdapter`, which unpacks a Kibana\n`HttpFetchError`
(including the nested Elasticsearch reason string) only\nwhen given the
full error object. Passing `error.message` bypasses that\nlogic, leaving
the toast body blank on permission errors.\n\n### Fix\n\nPass `error`
directly to `addError` in the following hooks:\n\n-
`useSetAlertAssignees` (`use_set_alert_assignees.tsx`) -- assign
alert\n- `useSetAlertTags` (`use_set_alert_tags.tsx`) -- bulk tag
update\n- `onAlertStatusUpdateFailure` in
`useBulkActionItems`,\n`useAlertActions`, and `useGroupTakeActionItems`
-- open / close /\nacknowledge\n- `useCasesFromAlerts`
(`use_cases_from_alerts.tsx`) -- cases fetch on\nflyout open (fires
automatically; users without Cases read access would\nhave seen a blank
toast on every flyout open)\n\n## Steps to reproduce\n\n1. Create a role
with `view_index_metadata`, `write`, and `manage`
on\n`.alerts-security.alerts-{space}`, but without `create_doc` /
`index` /\n`all`.\n2. Log in as a user assigned that role and navigate
to Security ->\nAlerts.\n3. Attempt any of the following:\n - Assign an
alert to a user\n - Add or remove a tag via bulk actions\n - Change
workflow status (open / close / acknowledge)\n - Open an alert flyout
(if the user also lacks Cases read access)\n4. Observe the error toast:
the body is blank even though the browser\nconsole shows a detailed
authorization error.\n\n**Expected:** the toast body shows the
Elasticsearch authorization\nreason (e.g. \"action
[indices:data/write/bulk[s]] is unauthorized ...\").\n\nExample:
\n<kbd>\n<img width=\"655\" height=\"599\" alt=\"Screenshot 2026-05-15
at 4 42
24 PM\"\nsrc=\"https://github.com/user-attachments/assets/08fa0524-62f8-41e7-980b-25bbd1e49960\"\n/>\n\n</kbd>\n<kbd>\n<img
width=\"857\" height=\"859\" alt=\"Screenshot 2026-05-15 at 4 42
33 PM\"\nsrc=\"https://github.com/user-attachments/assets/d95635c5-f55d-44a7-8509-bb5a0960a74f\"\n/>\n\n</kbd>\n\n**Actual
(before fix):** the toast body is blank.\nExample: \n<kbd>\n<img
width=\"372\" height=\"205\" alt=\"Screenshot 2026-05-15 at 4 44
53 PM\"\nsrc=\"https://github.com/user-attachments/assets/95ba3628-78a8-424c-9af4-0f61e9a2330e\"\n/>\n\n</kbd>\n<kbd>\n<img
width=\"857\" height=\"859\" alt=\"Screenshot 2026-05-15 at 4 44
34 PM\"\nsrc=\"https://github.com/user-attachments/assets/74f0e932-92a0-4188-9a43-e69ed28636bb\"\n/>\n\n</kbd>\n\n##
Release note\n\nError toasts for failed alert actions (assign, tag,
open, close,\nacknowledge) now show the full error message from
Elasticsearch instead\nof a blank body.\n\n---------\n\nCo-authored-by:
Cursor
<cursoragent@cursor.com>","sha":"cbabddd93c9093dc18077b044e6cac6d2e82232f"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.5.0","branchLabelMappingKey":"^v9.5.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/269592","number":269592,"mergeCommit":{"message":"[Security
Solution] Show more alert action error info in error toasts
(#269592)\n\n## Summary\n\nAddresses #269533.\n\nWhen a user without
sufficient index write access performs alert actions\nin Security
Solution, the error toast appeared with a blank body instead\nof the
actual reason from Elasticsearch.\n\n### Cause\n\nSeveral hooks called
`addError(error.message, { title })`, passing a\nplain string instead of
the error object. `useAppToasts.addError` runs\nits input through
`errorToErrorStackAdapter`, which unpacks a Kibana\n`HttpFetchError`
(including the nested Elasticsearch reason string) only\nwhen given the
full error object. Passing `error.message` bypasses that\nlogic, leaving
the toast body blank on permission errors.\n\n### Fix\n\nPass `error`
directly to `addError` in the following hooks:\n\n-
`useSetAlertAssignees` (`use_set_alert_assignees.tsx`) -- assign
alert\n- `useSetAlertTags` (`use_set_alert_tags.tsx`) -- bulk tag
update\n- `onAlertStatusUpdateFailure` in
`useBulkActionItems`,\n`useAlertActions`, and `useGroupTakeActionItems`
-- open / close /\nacknowledge\n- `useCasesFromAlerts`
(`use_cases_from_alerts.tsx`) -- cases fetch on\nflyout open (fires
automatically; users without Cases read access would\nhave seen a blank
toast on every flyout open)\n\n## Steps to reproduce\n\n1. Create a role
with `view_index_metadata`, `write`, and `manage`
on\n`.alerts-security.alerts-{space}`, but without `create_doc` /
`index` /\n`all`.\n2. Log in as a user assigned that role and navigate
to Security ->\nAlerts.\n3. Attempt any of the following:\n - Assign an
alert to a user\n - Add or remove a tag via bulk actions\n - Change
workflow status (open / close / acknowledge)\n - Open an alert flyout
(if the user also lacks Cases read access)\n4. Observe the error toast:
the body is blank even though the browser\nconsole shows a detailed
authorization error.\n\n**Expected:** the toast body shows the
Elasticsearch authorization\nreason (e.g. \"action
[indices:data/write/bulk[s]] is unauthorized ...\").\n\nExample:
\n<kbd>\n<img width=\"655\" height=\"599\" alt=\"Screenshot 2026-05-15
at 4 42
24 PM\"\nsrc=\"https://github.com/user-attachments/assets/08fa0524-62f8-41e7-980b-25bbd1e49960\"\n/>\n\n</kbd>\n<kbd>\n<img
width=\"857\" height=\"859\" alt=\"Screenshot 2026-05-15 at 4 42
33 PM\"\nsrc=\"https://github.com/user-attachments/assets/d95635c5-f55d-44a7-8509-bb5a0960a74f\"\n/>\n\n</kbd>\n\n**Actual
(before fix):** the toast body is blank.\nExample: \n<kbd>\n<img
width=\"372\" height=\"205\" alt=\"Screenshot 2026-05-15 at 4 44
53 PM\"\nsrc=\"https://github.com/user-attachments/assets/95ba3628-78a8-424c-9af4-0f61e9a2330e\"\n/>\n\n</kbd>\n<kbd>\n<img
width=\"857\" height=\"859\" alt=\"Screenshot 2026-05-15 at 4 44
34 PM\"\nsrc=\"https://github.com/user-attachments/assets/74f0e932-92a0-4188-9a43-e69ed28636bb\"\n/>\n\n</kbd>\n\n##
Release note\n\nError toasts for failed alert actions (assign, tag,
open, close,\nacknowledge) now show the full error message from
Elasticsearch instead\nof a blank body.\n\n---------\n\nCo-authored-by:
Cursor
<cursoragent@cursor.com>","sha":"cbabddd93c9093dc18077b044e6cac6d2e82232f"}}]}]
BACKPORT-->

Co-authored-by: Ryland Herrick <ryalnd@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dhurley14 dhurley14 dhurley14 approved these changes

@agusruidiazgd agusruidiazgd agusruidiazgd approved these changes

Assignees

@rylnd rylnd

Labels

backport:all-open Backport to all branches that could still receive a release release_note:fix Team:Detection Engine Security Solution Detection Engine Area v9.4.2 v9.5.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@rylnd @kibanamachine @dhurley14 @agusruidiazgd