# Rule Preview not Working

**URL:** <https://discuss.elastic.co/t/rule-preview-not-working/327737>\
**Category:** Elastic Security\
**Created:** [March 15, 2023, 8:33am UTC](https://discuss.elastic.co/t/rule-preview-not-working/327737 "2023-03-15T08:33:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![j91321](https://avatars.discourse-cdn.com/v4/letter/j/7ea924/32.png) [@j91321](https://discuss.elastic.co/u/j91321)\
**Post date:** [March 15, 2023, 8:33am UTC](https://discuss.elastic.co/t/rule-preview-not-working/327737/1 "2023-03-15T08:33:14Z")

</div>

I have this weird problem where detection engine rules preview is not working for users.

Now the users have roles that grant them **read** access to `.preview.alerts-security.alerts-<space-id>` and All Kibana pirvileges on Kibana Security App as mentioned in documentation. Still the preview fails with:

```auto
Missing "read" privileges for the ".preview.alerts-security.alerts" or ".internal.preview.alerts-security.alerts" indices. Without these privileges you cannot use the Rule Preview feature.

```

Now I've tried to debug this by creating a data view to that system index. The admin user can create data view on that index and read the data in it no problem. The affected user says no indices matched. When I try to view or edit the data view with the affected user it says that the pattern in not matching any indices.

However when I go to the Index Management with the affected user (he has monitor privileges) I can list system indices and see that the index ` .internal.preview.alerts-security.alerts-...` exists but trying to read the settings just gives me toast with word Forbidden.

When I try to see the settings for `.internal.preview.alerts-security.alerts-...` through dev console I get:

```auto
action [indices:monitor/settings/get] is unauthorized for user [j91321] with effective roles [...]
on indices [.internal.preview.alerts-security.alerts-something-dev-000001], this action is granted by the index privileges [monitor,view_index_metadata,manage,all]

```

Seems like the privilege does not get applied for the index. I've tried all of the listed privileges (all, read+view\_index\_metadata, or read+monitor)

Elasticsearch version is 8.6.1

---

<div class="post-metadata">

**Author:** ![georgii](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/georgii/32/78076_2.png) [@georgii](https://discuss.elastic.co/u/georgii)\
**Post date:** [March 22, 2023, 12:58pm UTC](https://discuss.elastic.co/t/rule-preview-not-working/327737/2 "2023-03-22T12:58:38Z")

</div>

Hey @j91321, thanks for your question!

I'm looking at the code that returns this error and seeing this:

> <https://github.com/elastic/kibana/blob/1980e2b92a174bce6df74e9c0769597cd9997961/x-pack/plugins/security_solution/server/lib/detection_engine/rule_preview/api/preview_rules/route.ts#L134-L160>

I'm not sure why access to both the index alias (`.preview.alerts-security.alerts`) and concrete internal index name (`.internal.preview.alerts-security.alerts`) are required here, but looks like this check was added in this PR:

> <https://github.com/elastic/kibana/pull/129951>
>
> \## Summary
> 
> Addresses https://github.com/elastic/kibana/issues/128284
> 
> Adds …an error message for when a user attempts to use the rule preview feature without the necessary \`read\` privilege for the \`.preview.alerts-security.alerts\` index.
> 
> To test:
> 
> \- Create a role with the usual detection alerts index permissions, but \_without\_ \`.preview.alerts-security.alerts\` and/or \`.internal.preview.alerts-security.alerts\`
> \- Attempt to use the rule preview feature within rule creation
> \- See that no histogram shows up
> 
> \#### Screenshots
> !\[Screen Shot 2022-04-11 at 5 34 19 PM\](https://user-images.githubusercontent.com/56367316/162837224-19ebbf25-ce35-4a62-b2c6-a69d41eef447.png)
> 
> 
> \### Checklist
> 
> Delete any items that are not applicable to this PR.
> 
> \- \[x\] Any text added follows \[EUI's writing guidelines\](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes \[i18n support\](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
> \- \[x\] \[Unit or functional tests\](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
> 
> 
> \### For maintainers
> 
> \- \[\] This was checked for breaking API changes and was \[labeled appropriately\](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

I'll reach out to the PR author and the team and we'll figure out if the implementation is wrong or the [docs](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html) are out-of-date.

 ![Screenshot 2023-03-22 at 13.57.34](https://us1.discourse-cdn.com/elastic/original/3X/1/5/1500b7a38ed862a4e5786ad041b22856efe0932e.png)

Meanwhile, could you please try adding a `read` privilege to `.preview.alerts-security.alerts-<space-id>` and `.internal.preview.alerts-security.alerts-<space-id>` to the user's role and see if it fixes the issue?

---

<div class="post-metadata">

**Author:** ![j91321](https://avatars.discourse-cdn.com/v4/letter/j/7ea924/32.png) [@j91321](https://discuss.elastic.co/u/j91321)\
**Post date:** [March 23, 2023, 10:38am UTC](https://discuss.elastic.co/t/rule-preview-not-working/327737/3 "2023-03-23T10:38:02Z")

</div>

Hi the user has read privileges to both, yet the issue persists.

```auto
    {
      "names": [
        ".preview.alerts-security.alerts-something-dev"
      ],
      "privileges": [
        "monitor",
        "read",
        "view_index_metadata"
      ],
      "allow_restricted_indices": false
    },
    {
      "names": [
        ".internal.preview.alerts-security.alerts-something-dev"
      ],
      "privileges": [
        "monitor",
        "read",
        "view_index_metadata"
      ],
      "allow_restricted_indices": false
    },

```

---

<div class="post-metadata">

**Author:** ![georgii](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/georgii/32/78076_2.png) [@georgii](https://discuss.elastic.co/u/georgii)\
**Post date:** [March 24, 2023, 9:55am UTC](https://discuss.elastic.co/t/rule-preview-not-working/327737/4 "2023-03-24T09:55:36Z")

</div>

@j91321 Thank you for checking this. Folks on our team confirmed that this is a bug and opened a PR with a fix for it:

> <https://github.com/elastic/kibana/pull/153590>
>
> \## Summary
> 
> Addresses a \[problem found via the community slack\](https://discus…s.elastic.co/t/rule-preview-not-working/327737/2) where rule preview doesn't properly recognize permissions granted to it when using a kibana \`space-id\` which is correctly documented \[here\](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui) as something to include in the permissions.
> 
> To test:
> 
> \- Create a role with the usual detection alerts index permissions in the \`default\` space, using \`.preview.alerts-security.alerts-default\` and/or \`.internal.preview.alerts-security.alerts-default-\*\` instead of the normal preview indices.
> \- Attempt to use the rule preview feature within rule creation
> \- You are now able to use the rule preview without index permission error (this won't currently work in \`main\`/kibana dev)
> 
> 
> \### Checklist
> 
> Delete any items that are not applicable to this PR.
> 
> \- \[x\] \[Documentation\](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
> \- \[\] \[Unit or functional tests\](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
> 
> \### For maintainers
> 
> \- \[\] This was checked for breaking API changes and was \[labeled appropriately\](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2023, 9:56am UTC](https://discuss.elastic.co/t/rule-preview-not-working/327737/5 "2023-04-21T09:56:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.