[9.3] [Security Solution] Show more alert action error info in error toasts (#269592)#272004
Open
kibanamachine wants to merge 1 commit into
Open
[9.3] [Security Solution] Show more alert action error info in error toasts (#269592)#272004kibanamachine wants to merge 1 commit into
kibanamachine wants to merge 1 commit into
Conversation
…elastic#269592) ## Summary Addresses elastic#269533. When a user without sufficient index write access performs alert actions in Security Solution, the error toast appeared with a blank body instead of the actual reason from Elasticsearch. ### Cause Several hooks called `addError(error.message, { title })`, passing a plain string instead of the error object. `useAppToasts.addError` runs its input through `errorToErrorStackAdapter`, which unpacks a Kibana `HttpFetchError` (including the nested Elasticsearch reason string) only when given the full error object. Passing `error.message` bypasses that logic, leaving the toast body blank on permission errors. ### Fix Pass `error` directly to `addError` in the following hooks: - `useSetAlertAssignees` (`use_set_alert_assignees.tsx`) -- assign alert - `useSetAlertTags` (`use_set_alert_tags.tsx`) -- bulk tag update - `onAlertStatusUpdateFailure` in `useBulkActionItems`, `useAlertActions`, and `useGroupTakeActionItems` -- open / close / acknowledge - `useCasesFromAlerts` (`use_cases_from_alerts.tsx`) -- cases fetch on flyout open (fires automatically; users without Cases read access would have seen a blank toast on every flyout open) ## Steps to reproduce 1. Create a role with `view_index_metadata`, `write`, and `manage` on `.alerts-security.alerts-{space}`, but without `create_doc` / `index` / `all`. 2. Log in as a user assigned that role and navigate to Security -> Alerts. 3. Attempt any of the following: - Assign an alert to a user - Add or remove a tag via bulk actions - Change workflow status (open / close / acknowledge) - Open an alert flyout (if the user also lacks Cases read access) 4. Observe the error toast: the body is blank even though the browser console shows a detailed authorization error. **Expected:** the toast body shows the Elasticsearch authorization reason (e.g. "action [indices:data/write/bulk[s]] is unauthorized ..."). Example: <kbd> <img width="655" height="599" alt="Screenshot 2026-05-15 at 4 42 24 PM" src="https://github.com/user-attachments/assets/08fa0524-62f8-41e7-980b-25bbd1e49960" /> </kbd> <kbd> <img width="857" height="859" alt="Screenshot 2026-05-15 at 4 42 33 PM" src="https://github.com/user-attachments/assets/d95635c5-f55d-44a7-8509-bb5a0960a74f" /> </kbd> **Actual (before fix):** the toast body is blank. Example: <kbd> <img width="372" height="205" alt="Screenshot 2026-05-15 at 4 44 53 PM" src="https://github.com/user-attachments/assets/95ba3628-78a8-424c-9af4-0f61e9a2330e" /> </kbd> <kbd> <img width="857" height="859" alt="Screenshot 2026-05-15 at 4 44 34 PM" src="https://github.com/user-attachments/assets/74f0e932-92a0-4188-9a43-e69ed28636bb" /> </kbd> ## Release note Error toasts for failed alert actions (assign, tag, open, close, acknowledge) now show the full error message from Elasticsearch instead of a blank body. --------- Co-authored-by: Cursor <cursoragent@cursor.com> (cherry picked from commit cbabddd)
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
Author
💔 Build Failed
Failed CI Steps
Test Failures
Metrics [docs]Async chunks
Historycc @rylnd |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport
This will backport the following commits from
mainto9.3:Questions ?
Please refer to the Backport tool documentation