[Security Solution][Alerts] Show invocation count explicitly in rule preview
#146.933 aperta il 2 dic 2022
Metriche repository
- Star
- (19.065 star)
- Metriche merge PR
- (Merge medio 1g 16h) (999 PR mergiate in 30 g)
Descrizione
With the default rule preview timeframe (last hour) and rule interval (5 minutes), the rule preview will run 12 simulated rule executions in order to cover the last hour. This can be confusing if a user runs the preview with these default settings, then creates the rule and enables it but sees no results because a single rule execution only covers the last rule interval. It could be easy to miss or forget as a user that the preview functionality is covering the larger timeframe by simulating multiple rule executions.
We should consider adding a UX element to call out the number of simulated rule executions that will be executed when the user initiates the preview, e.g. text like "The current preview settings will simulate running the rule X times to cover the selected timeframe", where X is the invocationCount passed to the preview API.