Open
Description
Parent issue: https://github.com/elastic/security-team/issues/10106
#192287 significantly reduced the CPU usage by detection rules when transforming source documents into alerts (in buildBulkBody, now renamed transformHitToAlert) but CPU usage is still high in alertWithPersistence. We should investigate why CPU usage is high and make changes to optimize it, as high CPU usage in Kibana during rule execution can block the event loop and reduce our ability to run multiple rules concurrently.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment