Open
Description
It's possible through the Detection Rules APIs to specify arbitrary to, from, and interval values for detection rules. However, the create/edit/details pages display these values in terms of "Interval" and "Additional Lookback", implicitly assuming that the value of to is now. These creates a misleading experience in the Rule Details page when to is not now, as the "Additional Lookback" is computed with the assumption that to is now. We should look into ways we can display the rule configuration accurately even when to is set to values other than now.
Related Issues
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment