[Security Solution][Alerts] Warn users when rule interval is larger than time range searched · elastic/kibana#154963

(0 comments) (1 reaction) (0 assignees)TypeScript (19,065 stars) (8,021 forks)batch import

Feature:DE O11yFeature:Detection AlertsTeam:Detection Engineconsider-nexteffort:lowenhancementgood first issuesdh-linkedv8.8.0value:high

説明

Currently it's possible to specify arbitrary values for to, from, and interval in the detection rules APIs. This can lead to scenarios where the difference between to and from is smaller than the rule interval and some time periods will not be searched by the rule. For example, if we have

to: 'now-5m',
from: 'now-7m',
interval: '5m',

then the rule searches a 2 minute time period every 5 minutes. This leaves 3 out of every 5 minutes un-searched. We should add additional validation in rule APIs and/or runtime checks at rule execution time to prevent/warn users about misconfigurations like this.

Related Issues

https://github.com/elastic/kibana/issues/154967

コントリビューターガイド

技術スタック: typescriptnodejs
領域: backendapisecurity
Issue 種別: feature
難度: 3
推定時間: 1-2 days
活動状況: fresh
明確さ: mostly clear
前提条件: Understanding of detection rules APIBasic knowledge of Kibana security solution
初心者向け度: 40
調査方針: Investigate the existing rule API validation in the Kibana security solution. Examine the related issue #154967 for context. The implementation could involve adding validation in the rule creation/update API to check that the time range (difference between 'to' and 'from') is not smaller than the interval, and possibly adding runtime warnings. Consider where to add the warning: in the API response, in the rule execution log, or in the UI. Review the server side code in the alerting plugin and the security solution plugin.