Open
Description
openedon Nov 2, 2021
Summary
There are a number of duplicate, misleading, and inconsistent types across the DE backend. This issue will outline some potential problems and solutions as we work toward a more consistent type framework.
Work Items
SignalHit
- Uses EShit
terminology, but is not actually a hit (it's used to build alerts inbuild_bulk_body.ts
)... there is also a different type namedSignalHit
in the cases plugin => Remove in favor ofAlertBody
below.SignalSource
- TODOSignalSourceHit
- Like above, useshit
terminology, but is used to construct alerts.WrappedSignalHit
- Same as above.RACAlert
- This is the new type to replaceSignalHit
, but should be renamed toAlertBody
.WrappedRACAlert
- Rename toWrappedAlertBody
.SimpleHit
- Fairly useless type... justBaseHit
parameterized with an optional@timestamp
.Signal
- Will be deprecated.(Need to wait for rule preview work)SignalRuleAlertTypeDefinition
- Remove.- Threshold types - move to different location.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment