[Security Solution][Alerts] Show invocation count explicitly in rule preview
#146,933 建立於 2022年12月2日
倉庫指標
- Star
- (19,065 star)
- PR 合併指標
- (平均合併 1天 16小時) (30 天內合併 999 個 PR)
描述
With the default rule preview timeframe (last hour) and rule interval (5 minutes), the rule preview will run 12 simulated rule executions in order to cover the last hour. This can be confusing if a user runs the preview with these default settings, then creates the rule and enables it but sees no results because a single rule execution only covers the last rule interval. It could be easy to miss or forget as a user that the preview functionality is covering the larger timeframe by simulating multiple rule executions.
We should consider adding a UX element to call out the number of simulated rule executions that will be executed when the user initiates the preview, e.g. text like "The current preview settings will simulate running the rule X times to cover the selected timeframe", where X is the invocationCount passed to the preview API.