[Security Solution][Detections] Implement hybrid approach to writing rule execution event logs #114852
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
xcrzx
added
v8.0.0
release_note:skip
Contributor
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
Contributor
|
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
banderror
approved these changes
Oct 13, 2021
Contributor
banderror
left a comment
banderror
left a comment
There was a problem hiding this comment.
LGTM 👍
Mostly nitpicking, but I left one suggestion for fixing the sum(undefined). I'd ideally fix it this PR, but I could do it in a follow-up myself.
Approving so you could merge at will. Thank you!
Contributor
There was a problem hiding this comment.
Nit: can be imported as src/core/server or kibana/server. I think kibana/server is stricter in terms of what can be imported for some reason.
Contributor
Author
There was a problem hiding this comment.
I usually don't write import statements manually. Instead, VS Code adds them automatically. In this case it thinks that '../../../../../../../../src/core/server' is the best place to import SavedObjectsClientContract from, so who am I to argue 🙂
...lution/server/lib/detection_engine/rule_execution_log/event_log_adapter/event_log_adapter.ts
Outdated
Show resolved
Hide resolved
...lution/server/lib/detection_engine/rule_execution_log/event_log_adapter/event_log_adapter.ts
Outdated
Show resolved
Hide resolved
xcrzx
force-pushed
the
hybrid-exec-log
branch
from
189a085 to
c36aff3
Compare
Contributor
💚 Build SucceededMetrics [docs]
History
To update your PR or re-run it, just comment with: cc @xcrzx |
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Oct 14, 2021
Contributor
💚 Backport successful
This backport PR will be merged automatically after passing CI. |
kibanamachine
added a commit
that referenced
this pull request
Oct 14, 2021
…) (#114955) Co-authored-by: Dmitry Shevchenko <dmshevch@gmail.com>
jloleysens
added a commit
to jloleysens/kibana
that referenced
this pull request
Oct 14, 2021
…mple/introduce-baseline-tests * 'master' of github.com:elastic/kibana: (55 commits) [Fleet] Improve Functionality around Managed Package Policies (elastic#114526) cleanup (elastic#114902) remove stray semicolon (elastic#114969) [Security Solution] Edit host isolation exception IP UI (elastic#114279) [ML] APM Correlations: Round duration values to be used in range aggregations. (elastic#114833) [Index Management] Added `data-test-subj` values to the index context menu buttons (elastic#114900) [Stack monitoring] Fix logstash functional tests for react (elastic#114819) Implement hybrid approach to writing rule execution event logs (elastic#114852) [Detection Rules] Add 7.16 rules (elastic#114939) Fixing exceptions export format (elastic#114920) Clean up inaccurate comments (elastic#114935) chore(NA): fixes a typo on persist_bazel_cache.sh comment (elastic#114943) [ci] Fixes Bazel cache writes (elastic#114915) fix package.json: (elastic#114936) [Controls] Redux Toolkit and Embeddable Redux Wrapper (elastic#114371) [APM] Fixes incorrect index config names (elastic#114901) (elastic#114904) [Workplace Search] Fix button order and remove extra source name label (elastic#114899) [Actions] Fixed actions telemetry for multiple namespaces usage (elastic#114748) docs: fix config names (elastic#114903) Update kibana to EMS 7.16 (elastic#114865) ...
19 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related to: #106469
Summary
Implement getting statuses and metrics from the legacy rule status SOs via the new EventLogAdapter.