[Security Solution][Detections][Threshold Rules] Threshold rule exceptions #85103
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
madirey
added
release_note:enhancement
v8.0.0
v7.11.0
Team:Detections and Resp
madirey
commented
Dec 7, 2020
| @@ -337,7 +337,7 @@ export const signalRulesAlertType = ({ | |||
| must: [ | |||
| { | |||
| term: { | |||
| [threshold.field ?? 'signal.rule.rule_id']: bucket.key, | |||
| [threshold.field || 'signal.rule.rule_id']: bucket.key, | |||
There was a problem hiding this comment.
This is unrelated to exceptions, but fixes a bug which would break the query if threshold.field is an empty string.
|
@elasticmachine merge upstream |
dplumlee
approved these changes
Dec 8, 2020
peluja1012
added
the
Team: SecuritySolution
… threshold-exceptions
… threshold-exceptions
|
@elasticmachine merge upstream |
💚 Build SucceededMetrics [docs]Async chunks
Distributable file count
History
To update your PR or re-run it, just comment with: |
madirey
added a commit
to madirey/kibana
that referenced
this pull request
Dec 13, 2020
…tions (elastic#85103) * Threshold rule exceptions * Clean up * Disable value lists for threshold rule exceptions * lint Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
gmmorris
added a commit
to gmmorris/kibana
that referenced
this pull request
Dec 14, 2020
* master: (116 commits) Fix UX E2E tests (elastic#85722) Increasing default api key removalDelay to 1h (elastic#85576) align cors settings names with elasticsearch (elastic#85738) unskip tests and make sure submit is not triggered too quickly (elastic#85567) Row trigger 2 (elastic#83167) Add session id to audit log (elastic#85451) [TSVB] Fields lists do not populate all the times (elastic#85530) [Visualize] Removes the external link icon from OSS badges (elastic#85580) fixes EQL tests (elastic#85712) [APM] enable 'log_level' for Go (elastic#85511) ini `1.3.5` -> `1.3.7` (elastic#85707) Fix fleet route protections (elastic#85626) [Monitoring] Some progress on making alerts better in the UI (elastic#81569) [Security Solution] Refactor Timeline Notes to use EuiCommentList (elastic#85256) [Security Solution][Detections][Threshold Rules] Threshold rule exceptions (elastic#85103) [Security Solution] Alerts details (elastic#83963) skip flaky suite (elastic#62060) skip flaky suite (elastic#85098) skip flaky suite (elastic#84020) skip flaky suite (elastic#85671) ...
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Addresses: #76631
Adds the ability for creating exceptions against threshold rules.
Does NOT currently include value list processing, as this will be a complex task for threshold rules...
Checklist
Delete any items that are not applicable to this PR.
For maintainers