Skip to content

[Security Solution][Detections] Add size param to search for previous threshold signals#90810

Merged
marshallmain merged 3 commits intoelastic:masterfrom
marshallmain:threshold-bucket-size
Feb 11, 2021
Merged

[Security Solution][Detections] Add size param to search for previous threshold signals#90810
marshallmain merged 3 commits intoelastic:masterfrom
marshallmain:threshold-bucket-size

Conversation

@marshallmain
Copy link
Copy Markdown
Contributor

Summary

Closes #90753
The default number of buckets returned is only 10, so if a threshold rule triggered with more than 10 different values then some values would not be correctly filtered out on the next rule run. This PR increases the number of buckets to 10000, matching the max number of buckets in the aggregation that finds new signals.

Checklist

Delete any items that are not applicable to this PR.

For maintainers

@marshallmain marshallmain requested a review from a team as a code owner February 9, 2021 16:31
@marshallmain marshallmain added release_note:skip Skip the PR/issue when compiling release notes Team:Detections and Resp Security Detection Response Team v7.11.0 v7.12.0 v8.0.0 labels Feb 9, 2021
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@marshallmain
Copy link
Copy Markdown
Contributor Author

@elasticmachine merge upstream

@marshallmain
Copy link
Copy Markdown
Contributor Author

@elasticmachine merge upstream

@kibanamachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@marshallmain marshallmain merged commit 0fb83bb into elastic:master Feb 11, 2021
@marshallmain marshallmain deleted the threshold-bucket-size branch February 11, 2021 23:45
marshallmain added a commit to marshallmain/kibana that referenced this pull request Feb 11, 2021
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
marshallmain added a commit that referenced this pull request Feb 12, 2021
)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
marshallmain added a commit that referenced this pull request Feb 12, 2021
)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release_note:skip Skip the PR/issue when compiling release notes Team:Detections and Resp Security Detection Response Team v7.11.2 v7.12.0 v8.0.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security Solution] Duplicated detections are generated by threshold rules once more than 11 detections occur

5 participants