Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SIEM] Adds stable alerting ids and more scripting for product testing #48165

Closed

Conversation

FrankHassanabad
Copy link
Contributor

@FrankHassanabad FrankHassanabad commented Oct 14, 2019

Summary

  • Adds stable alerting id's by using the alert params.
  • Currently does a manual walk through of the alert params to find the stable id
  • Updated all of the endpoints to take either of the two id's.
  • Added several scripts to support performance testing ad-hoc such as post_x_signals.sh
  • Added scripts to support converting from saved searches to alerts.
  • [SIEM][Detection Engine] Create REST API endpoint for KQL signals  #47013

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

- [ ] This was checked for cross-browser compatibility, including a check against IE11

- [ ] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support

- [ ] Documentation was added for features that require explanation or tutorials

- [ ] This was checked for keyboard-only and screenreader accessibility

For maintainers

@FrankHassanabad FrankHassanabad self-assigned this Oct 14, 2019

if (require.main === module) {
main();
}
Copy link
Contributor Author

@FrankHassanabad FrankHassanabad Oct 14, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking for a way to make files like this a TypeScript file. It is a command line script at the moment but we might end up having an endpoint which takes exported saved objects and just move most if not all of this logic into that endpoint eventually so will concentrate more on that instead and leave this as is.

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

@FrankHassanabad FrankHassanabad changed the title Add stable id option [SIEM] Adds stable alerting ids and more scripting for product testing Oct 15, 2019
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

@FrankHassanabad
Copy link
Contributor Author

Closing in favor of this one which is better:
#48471

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants