-
Notifications
You must be signed in to change notification settings - Fork 8.6k
[ResponseOps] Add revision field support to Alerting framework rules #137164
Copy link
Copy link
Closed
Labels
8.8 candidateFeature:Alerting/RulesFrameworkIssues related to the Alerting Rules FrameworkIssues related to the Alerting Rules FrameworkFeature:Detection RulesSecurity Solution rules and Detection EngineSecurity Solution rules and Detection EngineTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeamSecurity Detection Response TeamTeam:ResponseOpsPlatform ResponseOps team (formerly the Cases and Alerting teams) t//Platform ResponseOps team (formerly the Cases and Alerting teams) t//v8.8.0
Metadata
Metadata
Assignees
Labels
8.8 candidateFeature:Alerting/RulesFrameworkIssues related to the Alerting Rules FrameworkIssues related to the Alerting Rules FrameworkFeature:Detection RulesSecurity Solution rules and Detection EngineSecurity Solution rules and Detection EngineTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeamSecurity Detection Response TeamTeam:ResponseOpsPlatform ResponseOps team (formerly the Cases and Alerting teams) t//Platform ResponseOps team (formerly the Cases and Alerting teams) t//v8.8.0
Type
Fields
Give feedbackNo fields configured for issues without a type.
Parent ticket: #136213
Summary
Implement a new rule attribute
revisionof typelong:executionStatus, ormonitoringshould not lead to revision increase. Seex-pack/plugins/alerting/server/saved_objects/mappings.tsfor more examples.Migrate all existing rules to the new
revisionfield:revisionto 0