Changing timeout for threat indicator match rule to 10 minutes (#171254)

Per https://github.com/elastic/security-team/issues/7803, the security
solution team would like to increase the timeout for the threat
indicator match rule to 10 minutes. They're experiencing timeouts with
the 1 minute circuit breaker and are comfortable with the trade-offs
this will have.
This commit is contained in:
Brandon Kobel 2023-11-16 07:59:58 -05:00 committed by GitHub
parent feca84f9eb
commit 0916894657
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -127,7 +127,7 @@ xpack.alerting.rules.run.actions.max: 3000
xpack.alerting.rules.run.timeout: 1m
xpack.alerting.rules.run.ruleTypeOverrides:
- id: siem.indicatorRule
timeout: 1m
timeout: 10m
xpack.alerting.rules.minimumScheduleInterval.enforce: true
xpack.alerting.rules.maxScheduledPerMinute: 400
xpack.actions.run.maxAttempts: 10