[🐛 Bug]: Incident Alert View Does Not Show Payload && Correlation Rule Edit Does Not Show Existing Filters

[paulboby1]

Issue 1: Incident Alert View Does Not Show Payload

When I open an incident and click "View alert," the UI does not navigate or display the alert payload. The screen stays blank and I cannot see the details of the alert. This makes it difficult to investigate incidents.

Issue 2: Correlation Rule Edit Does Not Show Existing Filters

When editing a correlation rule, the editor does not display the existing filter rows or conditions. Instead, it only shows an empty editor where I can add new filters. I am unable to view or modify the current filters for the rule.

Steps to reproduce the behavior:

Go to the Incidents page.

Open any incident and click "View alert."

Expected: The alert payload/details should be displayed.

Actual: Nothing happens or the screen stays blank.

Go to the Correlations page.

Click "Edit" on any existing correlation rule.

Expected: The editor should show the current filters/conditions for the rule.

Actual: The editor is empty; only new filters can be adde

Expected behavior

When I click "View alert" within an incident, the UI should display the full alert payload/details, allowing me to review all relevant alert information.

When editing a correlation rule, the editor should show all existing filter rows and conditions for that rule, so I can view, modify, or remove them as needed, not just add new filters.

[dosubot]

Hi @paulboby1! I'm Dosu and I’m helping the keep team.

For the Incident Alert View not showing the payload, this can happen if the URL contains an invalid alert payload fingerprint, which prevents the modal from opening and leaves the screen blank. This was addressed by showing a toast notification when an invalid fingerprint is encountered, so the modal should now display properly if the fingerprint is valid. If you still see a blank screen, double-check that the alert's fingerprint is correct and that the backend is returning the expected data. More details are in this issue.

For the Correlation Rule Edit UI not displaying existing filters, the editor relies on the selected rule's definition_cel_ast being correctly loaded and converted for the filter editor. If the rule is missing, malformed, or the data fetch fails, the editor will appear empty and only allow adding new filters. This can happen if the backend doesn't return the rule details or if there's a frontend state/prop issue. The relevant logic is in the CorrelationSidebar component, which uses the convertCelAstToQueryBuilderAst function to populate the filter editor. Ensuring the rule loads correctly and the definition_cel_ast is valid should resolve this behavior. See the implementation here.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}