elastic/kibana

[Security Solution][Alerts] Warn users when rule interval is larger than time range searched

オープン

#154,963 opened on 2023/04/13

 (2 件のコメント) (1 件のリアクション) (0 人の担当者)TypeScript (8,021 件のフォーク)batch import
Feature:DE O11yFeature:Detection AlertsTeam:Detection Engineeringconsider-nexteffort:lowenhancementgood first issuesdh-linkedv8.8.0value:high

Repository metrics

Stars
 (19,065 個のスター)
PR merge metrics
 (PR metrics pending)

説明

Currently it's possible to specify arbitrary values for to, from, and interval in the detection rules APIs. This can lead to scenarios where the difference between to and from is smaller than the rule interval and some time periods will not be searched by the rule. For example, if we have

to: 'now-5m',
from: 'now-7m',
interval: '5m',

then the rule searches a 2 minute time period every 5 minutes. This leaves 3 out of every 5 minutes un-searched. We should add additional validation in rule APIs and/or runtime checks at rule execution time to prevent/warn users about misconfigurations like this.

Related Issues

コントリビューターガイド