[Security Solution][Detections] Add size param to search for previous threshold signals#90810
Merged
marshallmain merged 3 commits intoelastic:masterfrom Feb 11, 2021
Merged
Conversation
Contributor
|
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
Contributor
Author
|
@elasticmachine merge upstream |
Contributor
Author
|
@elasticmachine merge upstream |
Contributor
💚 Build SucceededMetrics [docs]
History
To update your PR or re-run it, just comment with: |
spong
approved these changes
Feb 11, 2021
This was referenced Feb 11, 2021
marshallmain
added a commit
to marshallmain/kibana
that referenced
this pull request
Feb 11, 2021
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #90753
The default number of buckets returned is only 10, so if a threshold rule triggered with more than 10 different values then some values would not be correctly filtered out on the next rule run. This PR increases the number of buckets to 10000, matching the max number of buckets in the aggregation that finds new signals.
Checklist
Delete any items that are not applicable to this PR.
For maintainers