elastic/kibana

[Security Solution][Alerts] Warn users when rule interval is larger than time range searched

Open

#154,963 opened on Apr 13, 2023

View on GitHub
 (1 comment) (1 reaction) (0 assignees)TypeScript (8,021 forks)batch import
Feature:DE O11yFeature:Detection AlertsTeam:Detection EngineTeam:Detection Engineeringconsider-nexteffort:lowenhancementgood first issuesdh-linkedv8.8.0value:high

Repository metrics

Stars
 (19,065 stars)
PR merge metrics
 (Avg merge 1d 16h) (999 merged PRs in 30d)

Description

Currently it's possible to specify arbitrary values for to, from, and interval in the detection rules APIs. This can lead to scenarios where the difference between to and from is smaller than the rule interval and some time periods will not be searched by the rule. For example, if we have

to: 'now-5m',
from: 'now-7m',
interval: '5m',

then the rule searches a 2 minute time period every 5 minutes. This leaves 3 out of every 5 minutes un-searched. We should add additional validation in rule APIs and/or runtime checks at rule execution time to prevent/warn users about misconfigurations like this.

Related Issues

Contributor guide

Research direction
Examine the detection rule API endpoints in the Security Solution plugin to identify where interval and time range parameters are validated, then add a check that warns when the interval exceeds the time range.
Tech stack
typescript
Domain
backendsecurity
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Elastic SecurityGit
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30