Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution][Detections][PIT] - Update findPreviousThresholdSignals to use PIT #127690

Closed
yctercero opened this issue Mar 15, 2022 · 4 comments
Closed

[Security Solution][Detections][PIT] - Update findPreviousThresholdSignals to use PIT #127690

yctercero opened this issue Mar 15, 2022 · 4 comments
Labels
Team:Detection Engine Security Solution Detection Engine Area Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. technical debt Improvement of the software architecture and operational architecture

Comments

@yctercero
Copy link
Contributor

yctercero commented Mar 15, 2022 •
edited
Loading

In an effort to reduce the number of expensive queries in Kiana, core is tracking efforts to move to the use of PIT rather than search queries that pull for 10,000 items.

See Kibana core ticket here.

File
https://github.com/elastic/kibana/blob/main/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold/find_previous_threshold_signals.ts#L82
@yctercero yctercero added Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Alerts Security Detection Alerts Area Team labels Mar 15, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@yctercero yctercero mentioned this issue Mar 15, 2022
Open
45 tasks
@yctercero yctercero added the technical debt Improvement of the software architecture and operational architecture label Mar 16, 2022
@marshallmain
Copy link
Contributor

The core ticket mentions looking for queries against Saved Objects, and the previous threshold signals are in alerts indices rather than Saved Objects - does that mean we can continue to use 10k here?

@yctercero yctercero added Team:Detection Engine Security Solution Detection Engine Area and removed Team:Detection Alerts Security Detection Alerts Area Team labels May 13, 2023
@yctercero
Copy link
Contributor Author

We can close this out as this ticket was indeed specific to querying against SOs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Team:Detection Engine Security Solution Detection Engine Area Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. technical debt Improvement of the software architecture and operational architecture
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@yctercero @elasticmachine @marshallmain