[CTI] Adds indicator match rule improvements#97310
Merged
ecezalp merged 2 commits intoelastic:masterfrom Jul 19, 2021
Merged
Conversation
I rescind my hasty approval; this is not the correct approach.
Contributor
|
Closing this for now as the change is not as straightforward as we'd hoped, and too risky to be a candidate for 7.13.0. |
Contributor
Author
|
@elasticmachine merge upstream |
Contributor
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
Contributor
💚 Build SucceededMetrics [docs]
History
To update your PR or re-run it, just comment with: cc @ecezalp |
rylnd
approved these changes
Jul 19, 2021
Contributor
rylnd
left a comment
There was a problem hiding this comment.
Approved. This does not address/affect the events query, but in certain circumstances it should improve performance of the indicator query 👍
kibanamachine
added a commit
to kibanamachine/kibana
that referenced
this pull request
Jul 19, 2021
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Contributor
💚 Backport successful
This backport PR will be merged automatically after passing CI. |
kibanamachine
added a commit
that referenced
this pull request
Jul 19, 2021
jloleysens
added a commit
to jloleysens/kibana
that referenced
this pull request
Jul 20, 2021
…y-show-migrate-to-authzd-users * 'master' of github.com:elastic/kibana: (187 commits) Space management page UX improvements (elastic#100448) [Reporting] Unskip flaky test when downloading CSV with "no data" (elastic#105252) Update dependency @elastic/charts to v33 (master) (elastic#105633) [Observability RAC] Improve alerts table columns (elastic#105446) Introduce `preboot` lifecycle stage (elastic#103636) [Security Solution] Invalid kql query timeline refresh bug (elastic#105525) skip flaky suite (elastic#106121) [Security Solution][Endpoint] Fix UI inconsistency between isolation forms and remove display of Pending isolation statuses (elastic#106118) docs: APM RUM Source map API (elastic#105332) [CTI] Adds indicator match rule improvements (elastic#97310) [Security Solution] update text for Isolation action submissions (elastic#105956) EP Meta Telemetry Perf (elastic#104396) [Metrics UI] Drop partial buckets from ALL Metrics UI queries (elastic#104784) Remove beta admonitions for Fleet docs (elastic#106010) [Observability RAC] Remove indexing of rule evaluation documents (elastic#104970) Parameterize migration test for kibana version (elastic#105417) [Alerting] Allow rule to execute if the value is 0 and that mets the condition (elastic#105626) [ML] Fix Index data visualizer sometimes shows wrong doc count for saved searches (elastic#106007) [Security Solution] UX fixes for Policy page and Case Host Isolation comment (elastic#106027) [Security Solution]Memory protection configuration card for policies integration. (elastic#101365) ... # Conflicts: # x-pack/plugins/reporting/public/management/report_listing.test.tsx # x-pack/plugins/reporting/public/management/report_listing.tsx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Acceptance Criteria
track_total_hits: falseto reduce unnecessary query overhead@timestamp: descto allow short-circuitingChecklist
Delete any items that are not applicable to this PR.
For maintainers