elastic/kibana

[Security Solution][Alerts] Show invocation count explicitly in rule preview

Open

#146,933 建立於 2022年12月2日

在 GitHub 查看
 (2 留言) (0 反應) (0 負責人)TypeScript (8,021 fork)batch import
Feature:Detection Rule PreviewTeam: SecuritySolutionTeam:Detection EngineTeam:Detection Engineeringeffort:lowenhancementgood first issuevalue:low

倉庫指標

Star
 (19,065 star)
PR 合併指標
 (平均合併 1天 16小時) (30 天內合併 999 個 PR)

描述

With the default rule preview timeframe (last hour) and rule interval (5 minutes), the rule preview will run 12 simulated rule executions in order to cover the last hour. This can be confusing if a user runs the preview with these default settings, then creates the rule and enables it but sees no results because a single rule execution only covers the last rule interval. It could be easy to miss or forget as a user that the preview functionality is covering the larger timeframe by simulating multiple rule executions.

We should consider adding a UX element to call out the number of simulated rule executions that will be executed when the user initiates the preview, e.g. text like "The current preview settings will simulate running the rule X times to cover the selected timeframe", where X is the invocationCount passed to the preview API.

貢獻者指南