Open
Description
Currently it's possible to specify arbitrary values for to
, from
, and interval
in the detection rules APIs. This can lead to scenarios where the difference between to
and from
is smaller than the rule interval and some time periods will not be searched by the rule. For example, if we have
to: 'now-5m',
from: 'now-7m',
interval: '5m',
then the rule searches a 2 minute time period every 5 minutes. This leaves 3 out of every 5 minutes un-searched. We should add additional validation in rule APIs and/or runtime checks at rule execution time to prevent/warn users about misconfigurations like this.
Related Issues
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment