Hi, We are on 7.10 and trying to use EQL signal but hit with error, although when we execute the same EQL query from console it successfully return results. please note in detection module we hit with error whenever we try EQL signal. following is the query.
sequence by source.ip with maxspan=5m
[network where destination.port== 445]
[network where observer.name == "observerName"]
following is the error when try to use as signal in detection module
Error
at Fetch._callee3$ (https://elastic..pk/35949/bundles/core/core.entry.js:6:59535)
at l (https://elastic..pk/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740519)
at Generator._invoke (https://elastic..pk/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740272)
at Generator.forEach.e. [as next] (https://elastic..pk/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740876)
at fetch_asyncGeneratorStep (https://elastic..pk/35949/bundles/core/core.entry.js:6:52652)
at _next (https://elastic..pk/35949/bundles/core/core.entry.js:6:52968)
Hi @qiratnahraf thanks for posting. Did you get this error when you hit preview? If yes, this is a known bug in 7.10.0 that has since been fixed in 7.10.1. Could you please bump your patch version and see if that fixes the issue?
Thanks, Steph
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.