Issue with Scheduled job for detectors

[florent]

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

Opensearch version 2.7.0

Describe the issue:

I tried to implement a Detector in the security analytics module.
After choosing the windows security rules I wanted to test, for simplicity I used the whoami rules, it asked me to map the fiels, but there was a field a I could not map (server-user-hash) because we do not have it. Mapped the others and click on next, defined my trigger and channel and when I clicked on “create” the creation failed (see screenshot attached) but it nonetheless created the scheduled job linked to the detector that was not created and it is spamming my slack channel despite not the fact that there is nothing in the logs to trigger it ( and as is said the detector was not created)
I can’t find a way to disable or delete the scheduled job:

Scheduling jobId : gPwYdogBdZE5aO3DTZsm, name: whoami

Configuration:

Relevant Logs or Screenshots:

Thank you in advance for your hlep

[florent]

Turns out I just could not see the detector with the user that created it (despite having admin rights) but I could find using the security admin with the request :

https://localhost:9200/.opendistro-alerting-config/_search

The only issue left is the field that I cannot map and that is responsible for the failed creation of the detector.

[florent]

Apparently when I select some sigma rules, the detector configuration thinks that CommandLine refers to “server-user-hash” any idea why ?

[Gsmitt]

Hey @florent

@florent

“server-user-hash”

Probably from here.

I found this, not sure if it will help with this issue.

https://github.com/opensearch-project/security-analytics/blob/main/src/main/resources/OSMapping/windows/fieldmappings.yml

[florent]

I also found it, but still I don’t understand why they are mapped together, that’s weird, there is an issue regarding this on the github, I also tried to do pull request to fix it.