Skip to content

[Security Solution] Improve time filter efficiency for Detection Rules #86874

@kostasb

Description

@kostasb

Description:
The detection engine's time filter should narrow down the search request's timerange as much as possible, in order to keep scope to just the relevant shards. There can be performance impact when timerange is unnecessarily wide, particularly when involving nodes with slower response profile (warm/cold).

Current behavior:
Detection rules may use open-ended time ranges (relevant section here)
This allows for filters like the following:


"filter": [
            {
              "bool": {
                "should": [
                  {
                    "range": {
                      "@timestamp": {
                        "from": "2020-12-04T15:19:07.456Z",
                        "to": null,
                        "include_lower": true,
                        "include_upper": true,
                        "boost": 1
                      }
                    }
                  }
                ],
                "adjust_pure_negative": true,
                "minimum_should_match": "1",
                "boost": 1
              }
            },
            {
              "bool": {
                "should": [
                  {
                    "range": {
                      "@timestamp": {
                        "from": null,
                        "to": "2020-12-04T15:25:07.456Z",
                        "include_lower": true,
                        "include_upper": true,
                        "boost": 1
                      }
                    }
                  }
                ],
                "adjust_pure_negative": true,
                "minimum_should_match": "1",
                "boost": 1
              }
            }
          ]

Expected behavior:
Apply a more precise time filter, binding from and to based on the configured interval/lookback period, in order to avoid searching open-ended time ranges.

Metadata

Metadata

Assignees

Labels

Team: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detections and RespSecurity Detection Response TeambugFixes for quality problems that affect the customer experience

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions