[Defend Workflows] [Question]Why is the "Isolate/release" option missing for the Windows OS alert from the alerts flyout when the observer.serial_number field has a value for the sentinel alert

[sukhwindersingh-qasource]

[Defend Workflows] [Question]Why is the "Isolate/release" option missing for the Windows OS alert from the alerts flyout when the observer.serial_number field has a value for the sentinel alert

[paul-tavares]

Ok. I think this is fixed with #182158 , which was just merged yesterday so you are not running with it.

@sukhwindersingh-qasource ,
I would like to confirm. In cases like this it would be very helpful if going forward you can include the JSON of the alert so I can see the detailed data. can you provide that?

---

Also - note that the fix I did would disable the Respond option in the menu and provide the user with a hover popup that indicates why its disabled (likely because there is no observer.serial_number) - you can see a screen capture of this bahaviour in the PR that was linked above.

The isolate/release dedicated menu item works a bit different in that if its checks determine isoalte can't be supported, the option is actually hidden from the menu (something we have been meaning to fix for a while now), rather than to be displayed in disabled mode.

[sukhwindersingh-qasource]

Hi @paul-tavares

Thank you for the update. Moving forward, we will be attaching the JSON of the alerts. Attached the JSON file for a similar kind of alert with the same observation as 'observer.serial_number:*' existing, but without the 'isolate' option.

Detailed Observation

Build Details:
VERSION: 8.14.0
BUILD: 73762
COMMIT: 2a492e1

Screencast

Alerts.-.Kibana.Mozilla.Firefox.2024-05-08.14-28-14.mp4

JSON of the alert
Json.txt

Please let us know if anything else is required from our side.

Thanks.

[elasticmachine]

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[sukhwindersingh-qasource]

@muskangulati-qasource kindly review this

[dasansol92]

@paul-tavares can this be related to these recent changes? #182158
or maybe related to this recent issue: #182330
cc: @ashokaditya

[muskangulati-qasource]

Secondary review is done for the ticket.

Assigned to @ashokaditya
cc: @dasansol92

[paul-tavares]

Ok. I was able to debug this and the problem seems to be the same that @ashokaditya fixed just yesterday via this PR: #183280 . So next time you pull in a new BC this should be fixed.

The problem here is due to the fact that an API call to get the agent status is failing with:

{
    "statusCode": 500,
    "error": "Internal Server Error",
    "message": "Attempt retrieve agent information from to SentinelOne failed: Response validation failed (Error: [data.0.osUsername]: expected value of type [string] but got [null])"
}

This can be seen in the browser's developer tools console tab

[sukhwindersingh-qasource]

Hi @paul-tavares,

Thanks for looking into this and providing the update. We will validate this ticket once the next BC arrives.

Thanks!