Skip to content

[7.9] [SIEM] [Detections] Fixes filtering with large value lists to use "ands" between lists (#72304)#72909

Merged
dhurley14 merged 1 commit intoelastic:7.9from
dhurley14:backport/7.9/pr-72304
Jul 22, 2020
Merged

[7.9] [SIEM] [Detections] Fixes filtering with large value lists to use "ands" between lists (#72304)#72909
dhurley14 merged 1 commit intoelastic:7.9from
dhurley14:backport/7.9/pr-72304

Conversation

@dhurley14
Copy link
Copy Markdown
Contributor

Backports the following commits to 7.9:

…ds" between lists (elastic#72304)

* wip - comment and sample json for exceptions

* promise.all for OR-ing exception items and quick-start script

* logging, added/updated json sample scripts, fixed  missing await on filter with lists

* WIP

* bug fix where two lists when 'anded' together were not filtering down result set

* undo changes from testing

* fix changes to example json and fixes missed conflict with master

* update log message and fix type errors

* change log statement and add unit test for when exception items without a value list are passed in to the filter function

* fix failing test

* update expect on one test and adds a new test to ensure anding of value lists when appearing in different exception items

* update test after rebasing with master

* properly ands exception item entries together with proper test cases

* fix test (log statement tests - need to come up with a better way to cover these)

* cleans up json examples

* rename test and use 'every' in lieu of 'some' when determining if the filter logic should execute
@dhurley14 dhurley14 added the backport This PR is a backport of another PR label Jul 22, 2020
@kibanamachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Build metrics

✅ unchanged

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@dhurley14 dhurley14 merged commit b0053b6 into elastic:7.9 Jul 22, 2020
@dhurley14 dhurley14 deleted the backport/7.9/pr-72304 branch July 22, 2020 18:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants