Skip to content

[SIEM][Detections] Rule Import performs unnecessary work when signals index DNE #65565

@rylnd

Description

@rylnd

This code verifies that the signal index exists (and sets an error if not), but that happens once for each rule being imported.

Additionally, if the index does not exist, we still try to upsert the rule, which seems like it may actually succeed.

There may be a few bugs here, but I think that the solution is to move the indexExists check outside of the loop and exit early, similar to how we handle a parsing error

Metadata

Metadata

Labels

Team: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:SIEMbugFixes for quality problems that affect the customer experiencev7.7.0

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions