elastic/kibana
[Security Solution][Alerts] Warn users when rule interval is larger than time range searched
開放
#154,963 建立於 2023年4月13日
Feature:DE O11yFeature:Detection AlertsTeam:Detection Engineeringconsider-nexteffort:lowenhancementgood first issuesdh-linkedv8.8.0value:high
倉庫指標
- 星標
- (19,065 顆星)
- PR 合併指標
- (平均合併 1天 16小時) (30 天內合併 999 個 PR)
描述
Currently it's possible to specify arbitrary values for to, from, and interval in the detection rules APIs. This can lead to scenarios where the difference between to and from is smaller than the rule interval and some time periods will not be searched by the rule. For example, if we have
to: 'now-5m',
from: 'now-7m',
interval: '5m',
then the rule searches a 2 minute time period every 5 minutes. This leaves 3 out of every 5 minutes un-searched. We should add additional validation in rule APIs and/or runtime checks at rule execution time to prevent/warn users about misconfigurations like this.
Related Issues