elastic/kibana

[Security Solution][Alerts] Warn users when rule interval is larger than time range searched

Open

#154963 opened on Apr 13, 2023

View on GitHub
 (0 comments) (1 reaction) (0 assignees)TypeScript (19,065 stars) (8,021 forks)batch import
Feature:DE O11yFeature:Detection AlertsTeam:Detection Engineconsider-nexteffort:lowenhancementgood first issuesdh-linkedv8.8.0value:high

Description

Currently it's possible to specify arbitrary values for to, from, and interval in the detection rules APIs. This can lead to scenarios where the difference between to and from is smaller than the rule interval and some time periods will not be searched by the rule. For example, if we have

to: 'now-5m',
from: 'now-7m',
interval: '5m',

then the rule searches a 2 minute time period every 5 minutes. This leaves 3 out of every 5 minutes un-searched. We should add additional validation in rule APIs and/or runtime checks at rule execution time to prevent/warn users about misconfigurations like this.

Related Issues

Contributor guide

Tech stack
typescriptnodejs
Domain
backendapisecurity
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
Understanding of detection rules APIBasic knowledge of Kibana security solution
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
Investigate the existing rule API validation in the Kibana security solution. Examine the related issue #154967 for context. The implementation could involve adding validation in the rule creation/update API to check that the time range (difference between 'to' and 'from') is not smaller than the interval, and possibly adding runtime warnings. Consider where to add the warning: in the API response, in the rule execution log, or in the UI. Review the server side code in the alerting plugin and the security solution plugin.