mirror of
https://github.com/elastic/kibana.git
synced 2025-04-25 10:23:14 -04:00
[DOCS] Add solution selection to maintenance windows (#169441)
This commit is contained in:
Lisa Cawley
GitHub
parent
0cd75d9126
commit
89dd69656c
7 changed files with 789 additions and 137 deletions
|
|
@ -63,9 +63,14 @@ context and state in action parameter templates, and a short human readable
|
||||||
description. When you create a rule in {kib}, it uses this information to prompt
|
description. When you create a rule in {kib}, it uses this information to prompt
|
||||||
you for these variables in action parameter editors.
|
you for these variables in action parameter editors.
|
||||||
|
|
||||||
|
// `alerts`:: TBD
|
||||||
|
|
||||||
`authorized_consumers`::
|
`authorized_consumers`::
|
||||||
(object) The list of the plugins IDs that have access to the rule type.
|
(object) The list of the plugins IDs that have access to the rule type.
|
||||||
|
|
||||||
|
`category`::
|
||||||
|
(string) The rule category, which is used by features such as category-specific maintenance windows.
|
||||||
|
|
||||||
`default_action_group_id`::
|
`default_action_group_id`::
|
||||||
(string) The default ID for the rule type group.
|
(string) The default ID for the rule type group.
|
||||||
|
|
||||||
|
|
@ -77,6 +82,10 @@ action.
|
||||||
(boolean) Indicates whether the rule type is enabled or disabled based on the
|
(boolean) Indicates whether the rule type is enabled or disabled based on the
|
||||||
subscription.
|
subscription.
|
||||||
|
|
||||||
|
// `has_alerts_mappings`:: TBD
|
||||||
|
|
||||||
|
// `has_fields_for_a_a_d`:: TBD
|
||||||
|
|
||||||
`id`::
|
`id`::
|
||||||
(string) The unique identifier for the rule type.
|
(string) The unique identifier for the rule type.
|
||||||
|
|
||||||
|
|
@ -121,7 +130,28 @@ the API returns the following:
|
||||||
{
|
{
|
||||||
"id":"logs.alert.document.count",
|
"id":"logs.alert.document.count",
|
||||||
"name":"Log threshold",
|
"name":"Log threshold",
|
||||||
|
"category": "observability",
|
||||||
"producer":"logs",
|
"producer":"logs",
|
||||||
|
"alerts": {
|
||||||
|
"context": "observability.logs",
|
||||||
|
"mappings": {
|
||||||
|
"fieldMap": {
|
||||||
|
"kibana.alert.evaluation.threshold": {
|
||||||
|
"type": "scaled_float",
|
||||||
|
"scaling_factor": 100,
|
||||||
|
"required": false
|
||||||
|
},
|
||||||
|
"kibana.alert.evaluation.value": {
|
||||||
|
"type": "scaled_float",
|
||||||
|
"scaling_factor": 100,
|
||||||
|
"required": false
|
||||||
|
},
|
||||||
|
...
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"useEcs": true,
|
||||||
|
"useLegacyAlerts": true
|
||||||
|
},
|
||||||
"enabled_in_license":true,
|
"enabled_in_license":true,
|
||||||
"recovery_action_group":{
|
"recovery_action_group":{
|
||||||
"id":"recovered",
|
"id":"recovered",
|
||||||
|
|
@ -164,7 +194,10 @@ the API returns the following:
|
||||||
"logs":{"read":true,"all":false},
|
"logs":{"read":true,"all":false},
|
||||||
"alerts":{"read":true,"all":false}
|
"alerts":{"read":true,"all":false}
|
||||||
},
|
},
|
||||||
"does_set_recovery_context":true
|
"does_set_recovery_context":true,
|
||||||
}
|
"has_alerts_mappings": true,
|
||||||
|
"has_fields_for_a_a_d": true
|
||||||
|
},
|
||||||
|
....
|
||||||
]
|
]
|
||||||
--------------------------------------------------
|
--------------------------------------------------
|
||||||
|
|
|
||||||
Binary file not shown.
|
Before Width: | Height: | Size: 114 KiB After Width: | Height: | Size: 209 KiB |
|
|
@ -11,7 +11,7 @@ preview::[]
|
||||||
You can schedule single or recurring maintenance windows to temporarily reduce rule notifications.
|
You can schedule single or recurring maintenance windows to temporarily reduce rule notifications.
|
||||||
For example, a maintenance window prevents false alarms during planned outages.
|
For example, a maintenance window prevents false alarms during planned outages.
|
||||||
|
|
||||||
Maintenance windows affect all rules in all {kib} apps and spaces.
|
By default, maintenance windows affect all rules in all {kib} apps and spaces.
|
||||||
Alerts continue to be generated, however notifications are suppressed as follows:
|
Alerts continue to be generated, however notifications are suppressed as follows:
|
||||||
|
|
||||||
- When an alert occurs during a maintenance window, there are no notifications.
|
- When an alert occurs during a maintenance window, there are no notifications.
|
||||||
|
|
@ -42,6 +42,10 @@ You can optionally configure it to repeat daily, monthly, yearly, or on a custom
|
||||||
image::images/create-maintenance-window.png[The Create Maintenance Window user interface in {kib}]
|
image::images/create-maintenance-window.png[The Create Maintenance Window user interface in {kib}]
|
||||||
// NOTE: This is an autogenerated screenshot. Do not edit it directly.
|
// NOTE: This is an autogenerated screenshot. Do not edit it directly.
|
||||||
|
|
||||||
|
By default, maintenance windows affect all categories of rules.
|
||||||
|
The category-specific maintenance window options alter this behavior.
|
||||||
|
For the definitive list of rule types in each category, refer to the <<list-rule-types-api,get rule types API>>.
|
||||||
|
|
||||||
A maintenance window can have any one of the following statuses:
|
A maintenance window can have any one of the following statuses:
|
||||||
|
|
||||||
- `Upcoming`: It will run at the scheduled date and time.
|
- `Upcoming`: It will run at the scheduled date and time.
|
||||||
|
|
|
||||||
|
|
@ -862,6 +862,9 @@
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"alerts": {
|
||||||
|
"type": "object"
|
||||||
|
},
|
||||||
"authorized_consumers": {
|
"authorized_consumers": {
|
||||||
"description": "The list of the plugins IDs that have access to the rule type.",
|
"description": "The list of the plugins IDs that have access to the rule type.",
|
||||||
"type": "object",
|
"type": "object",
|
||||||
|
|
@ -978,6 +981,15 @@
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"category": {
|
||||||
|
"type": "string",
|
||||||
|
"description": "The rule category, which is used by features such as category-specific maintenance windows.",
|
||||||
|
"enum": [
|
||||||
|
"management",
|
||||||
|
"observability",
|
||||||
|
"securitySolution"
|
||||||
|
]
|
||||||
|
},
|
||||||
"default_action_group_id": {
|
"default_action_group_id": {
|
||||||
"description": "The default identifier for the rule type group.",
|
"description": "The default identifier for the rule type group.",
|
||||||
"type": "string"
|
"type": "string"
|
||||||
|
|
@ -990,6 +1002,12 @@
|
||||||
"description": "Indicates whether the rule type is enabled or disabled based on the subscription.",
|
"description": "Indicates whether the rule type is enabled or disabled based on the subscription.",
|
||||||
"type": "boolean"
|
"type": "boolean"
|
||||||
},
|
},
|
||||||
|
"has_alerts_mappings": {
|
||||||
|
"type": "boolean"
|
||||||
|
},
|
||||||
|
"has_fields_for_a_a_d": {
|
||||||
|
"type": "boolean"
|
||||||
|
},
|
||||||
"id": {
|
"id": {
|
||||||
"description": "The unique identifier for the rule type.",
|
"description": "The unique identifier for the rule type.",
|
||||||
"type": "string"
|
"type": "string"
|
||||||
|
|
@ -7570,6 +7588,127 @@
|
||||||
"value": [
|
"value": [
|
||||||
{
|
{
|
||||||
"id": "xpack.ml.anomaly_detection_alert",
|
"id": "xpack.ml.anomaly_detection_alert",
|
||||||
|
"name": "Anomaly detection alert",
|
||||||
|
"category": "management",
|
||||||
|
"producer": "ml",
|
||||||
|
"alerts": {
|
||||||
|
"context": "ml.anomaly-detection",
|
||||||
|
"mappings": {
|
||||||
|
"fieldMap": {
|
||||||
|
"kibana.alert.job_id": {
|
||||||
|
"type": "keyword",
|
||||||
|
"array": false,
|
||||||
|
"required": true
|
||||||
|
},
|
||||||
|
"kibana.alert.anomaly_score": {
|
||||||
|
"type": "double",
|
||||||
|
"array": false,
|
||||||
|
"required": false
|
||||||
|
},
|
||||||
|
"kibana.alert.is_interim": {
|
||||||
|
"type": "boolean",
|
||||||
|
"array": false,
|
||||||
|
"required": false
|
||||||
|
},
|
||||||
|
"kibana.alert.anomaly_timestamp": {
|
||||||
|
"type": "date",
|
||||||
|
"array": false,
|
||||||
|
"required": false
|
||||||
|
},
|
||||||
|
"kibana.alert.top_records": {
|
||||||
|
"type": "object",
|
||||||
|
"array": true,
|
||||||
|
"required": false,
|
||||||
|
"dynamic": false,
|
||||||
|
"properties": {
|
||||||
|
"job_id": {
|
||||||
|
"type": "keyword"
|
||||||
|
},
|
||||||
|
"record_score": {
|
||||||
|
"type": "double"
|
||||||
|
},
|
||||||
|
"initial_record_score": {
|
||||||
|
"type": "double"
|
||||||
|
},
|
||||||
|
"detector_index": {
|
||||||
|
"type": "integer"
|
||||||
|
},
|
||||||
|
"is_interim": {
|
||||||
|
"type": "boolean"
|
||||||
|
},
|
||||||
|
"timestamp": {
|
||||||
|
"type": "date"
|
||||||
|
},
|
||||||
|
"partition_field_name": {
|
||||||
|
"type": "keyword"
|
||||||
|
},
|
||||||
|
"partition_field_value": {
|
||||||
|
"type": "keyword"
|
||||||
|
},
|
||||||
|
"over_field_name": {
|
||||||
|
"type": "keyword"
|
||||||
|
},
|
||||||
|
"over_field_value": {
|
||||||
|
"type": "keyword"
|
||||||
|
},
|
||||||
|
"by_field_name": {
|
||||||
|
"type": "keyword"
|
||||||
|
},
|
||||||
|
"by_field_value": {
|
||||||
|
"type": "keyword"
|
||||||
|
},
|
||||||
|
"function": {
|
||||||
|
"type": "keyword"
|
||||||
|
},
|
||||||
|
"typical": {
|
||||||
|
"type": "double"
|
||||||
|
},
|
||||||
|
"actual": {
|
||||||
|
"type": "double"
|
||||||
|
},
|
||||||
|
"field_name": {
|
||||||
|
"type": "keyword"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"kibana.alert.top_influencers": {
|
||||||
|
"type": "object",
|
||||||
|
"array": true,
|
||||||
|
"required": false,
|
||||||
|
"dynamic": false,
|
||||||
|
"properties": {
|
||||||
|
"job_id": {
|
||||||
|
"type": "keyword"
|
||||||
|
},
|
||||||
|
"influencer_field_name": {
|
||||||
|
"type": "keyword"
|
||||||
|
},
|
||||||
|
"influencer_field_value": {
|
||||||
|
"type": "keyword"
|
||||||
|
},
|
||||||
|
"influencer_score": {
|
||||||
|
"type": "double"
|
||||||
|
},
|
||||||
|
"initial_influencer_score": {
|
||||||
|
"type": "double"
|
||||||
|
},
|
||||||
|
"is_interim": {
|
||||||
|
"type": "boolean"
|
||||||
|
},
|
||||||
|
"timestamp": {
|
||||||
|
"type": "date"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"shouldWrite": true
|
||||||
|
},
|
||||||
|
"enabled_in_license": true,
|
||||||
|
"recovery_action_group": {
|
||||||
|
"id": "recovered",
|
||||||
|
"name": "Recovered"
|
||||||
|
},
|
||||||
"action_groups": [
|
"action_groups": [
|
||||||
{
|
{
|
||||||
"id": "anomaly_score_match",
|
"id": "anomaly_score_match",
|
||||||
|
|
@ -7580,6 +7719,10 @@
|
||||||
"name": "Recovered"
|
"name": "Recovered"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"default_action_group_id": "anomaly_score_match",
|
||||||
|
"minimum_license_required": "platinum",
|
||||||
|
"is_exportable": true,
|
||||||
|
"rule_task_timeout": "5m",
|
||||||
"action_variables": {
|
"action_variables": {
|
||||||
"context": [
|
"context": [
|
||||||
{
|
{
|
||||||
|
|
@ -7620,34 +7763,69 @@
|
||||||
"useWithTripleBracesInTemplates": true
|
"useWithTripleBracesInTemplates": true
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"params": [],
|
"state": [],
|
||||||
"state": []
|
"params": []
|
||||||
},
|
},
|
||||||
"authorized_consumers": {
|
"authorized_consumers": {
|
||||||
"alerts": {
|
"alerts": {
|
||||||
"all": true,
|
"read": true,
|
||||||
"read": true
|
"all": true
|
||||||
|
},
|
||||||
|
"stackAlerts": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"slo": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
},
|
},
|
||||||
"ml": {
|
"ml": {
|
||||||
"all": true,
|
"read": true,
|
||||||
"read": true
|
"all": true
|
||||||
|
},
|
||||||
|
"uptime": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"infrastructure": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"logs": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"monitoring": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"siem": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"apm": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"discover": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"default_action_group_id": "anomaly_score_match",
|
|
||||||
"does_set_recovery_context": true,
|
"does_set_recovery_context": true,
|
||||||
"enabled_in_license": true,
|
"has_alerts_mappings": true,
|
||||||
"is_exportable": true,
|
"has_fields_for_a_a_d": false
|
||||||
"minimum_license_required": "platinum",
|
},
|
||||||
"name": "Anomaly detection alert",
|
{
|
||||||
|
"id": "xpack.ml.anomaly_detection_jobs_health",
|
||||||
|
"name": "Anomaly detection jobs health",
|
||||||
|
"category": "management",
|
||||||
"producer": "ml",
|
"producer": "ml",
|
||||||
|
"enabled_in_license": true,
|
||||||
"recovery_action_group": {
|
"recovery_action_group": {
|
||||||
"id": "recovered",
|
"id": "recovered",
|
||||||
"name": "Recovered"
|
"name": "Recovered"
|
||||||
},
|
},
|
||||||
"rule_task_timeout": "5m"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "xpack.ml.anomaly_detection_jobs_health",
|
|
||||||
"action_groups": [
|
"action_groups": [
|
||||||
{
|
{
|
||||||
"id": "anomaly_detection_realtime_issue",
|
"id": "anomaly_detection_realtime_issue",
|
||||||
|
|
@ -7658,6 +7836,10 @@
|
||||||
"name": "Recovered"
|
"name": "Recovered"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"default_action_group_id": "anomaly_detection_realtime_issue",
|
||||||
|
"minimum_license_required": "platinum",
|
||||||
|
"is_exportable": true,
|
||||||
|
"rule_task_timeout": "5m",
|
||||||
"action_variables": {
|
"action_variables": {
|
||||||
"context": [
|
"context": [
|
||||||
{
|
{
|
||||||
|
|
@ -7669,31 +7851,58 @@
|
||||||
"description": "Alert info message"
|
"description": "Alert info message"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"params": [],
|
"state": [],
|
||||||
"state": []
|
"params": []
|
||||||
},
|
},
|
||||||
"authorized_consumers": {
|
"authorized_consumers": {
|
||||||
"alerts": {
|
"alerts": {
|
||||||
"all": true,
|
"read": true,
|
||||||
"read": true
|
"all": true
|
||||||
|
},
|
||||||
|
"stackAlerts": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"slo": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
},
|
},
|
||||||
"ml": {
|
"ml": {
|
||||||
"all": true,
|
"read": true,
|
||||||
"read": true
|
"all": true
|
||||||
|
},
|
||||||
|
"uptime": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"infrastructure": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"logs": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"monitoring": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"siem": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"apm": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"discover": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"default_action_group_id": "anomaly_detection_realtime_issue",
|
|
||||||
"does_set_recovery_context": true,
|
"does_set_recovery_context": true,
|
||||||
"enabled_in_license": true,
|
"has_alerts_mappings": false,
|
||||||
"is_exportable": true,
|
"has_fields_for_a_a_d": false
|
||||||
"minimum_license_required": "platinum",
|
|
||||||
"name": "Anomaly detection jobs health",
|
|
||||||
"producer": "ml",
|
|
||||||
"recovery_action_group": {
|
|
||||||
"id": "recovered",
|
|
||||||
"name": "Recovered"
|
|
||||||
},
|
|
||||||
"rule_task_timeout": "5m"
|
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -550,6 +550,8 @@ paths:
|
||||||
type: string
|
type: string
|
||||||
name:
|
name:
|
||||||
type: string
|
type: string
|
||||||
|
alerts:
|
||||||
|
type: object
|
||||||
authorized_consumers:
|
authorized_consumers:
|
||||||
description: The list of the plugins IDs that have access to the rule type.
|
description: The list of the plugins IDs that have access to the rule type.
|
||||||
type: object
|
type: object
|
||||||
|
|
@ -624,6 +626,13 @@ paths:
|
||||||
type: boolean
|
type: boolean
|
||||||
read:
|
read:
|
||||||
type: boolean
|
type: boolean
|
||||||
|
category:
|
||||||
|
type: string
|
||||||
|
description: The rule category, which is used by features such as category-specific maintenance windows.
|
||||||
|
enum:
|
||||||
|
- management
|
||||||
|
- observability
|
||||||
|
- securitySolution
|
||||||
default_action_group_id:
|
default_action_group_id:
|
||||||
description: The default identifier for the rule type group.
|
description: The default identifier for the rule type group.
|
||||||
type: string
|
type: string
|
||||||
|
|
@ -633,6 +642,10 @@ paths:
|
||||||
enabled_in_license:
|
enabled_in_license:
|
||||||
description: Indicates whether the rule type is enabled or disabled based on the subscription.
|
description: Indicates whether the rule type is enabled or disabled based on the subscription.
|
||||||
type: boolean
|
type: boolean
|
||||||
|
has_alerts_mappings:
|
||||||
|
type: boolean
|
||||||
|
has_fields_for_a_a_d:
|
||||||
|
type: boolean
|
||||||
id:
|
id:
|
||||||
description: The unique identifier for the rule type.
|
description: The unique identifier for the rule type.
|
||||||
type: string
|
type: string
|
||||||
|
|
@ -5357,11 +5370,101 @@ components:
|
||||||
summary: Retrieve rule types associated with Kibana machine learning features
|
summary: Retrieve rule types associated with Kibana machine learning features
|
||||||
value:
|
value:
|
||||||
- id: xpack.ml.anomaly_detection_alert
|
- id: xpack.ml.anomaly_detection_alert
|
||||||
|
name: Anomaly detection alert
|
||||||
|
category: management
|
||||||
|
producer: ml
|
||||||
|
alerts:
|
||||||
|
context: ml.anomaly-detection
|
||||||
|
mappings:
|
||||||
|
fieldMap:
|
||||||
|
kibana.alert.job_id:
|
||||||
|
type: keyword
|
||||||
|
array: false
|
||||||
|
required: true
|
||||||
|
kibana.alert.anomaly_score:
|
||||||
|
type: double
|
||||||
|
array: false
|
||||||
|
required: false
|
||||||
|
kibana.alert.is_interim:
|
||||||
|
type: boolean
|
||||||
|
array: false
|
||||||
|
required: false
|
||||||
|
kibana.alert.anomaly_timestamp:
|
||||||
|
type: date
|
||||||
|
array: false
|
||||||
|
required: false
|
||||||
|
kibana.alert.top_records:
|
||||||
|
type: object
|
||||||
|
array: true
|
||||||
|
required: false
|
||||||
|
dynamic: false
|
||||||
|
properties:
|
||||||
|
job_id:
|
||||||
|
type: keyword
|
||||||
|
record_score:
|
||||||
|
type: double
|
||||||
|
initial_record_score:
|
||||||
|
type: double
|
||||||
|
detector_index:
|
||||||
|
type: integer
|
||||||
|
is_interim:
|
||||||
|
type: boolean
|
||||||
|
timestamp:
|
||||||
|
type: date
|
||||||
|
partition_field_name:
|
||||||
|
type: keyword
|
||||||
|
partition_field_value:
|
||||||
|
type: keyword
|
||||||
|
over_field_name:
|
||||||
|
type: keyword
|
||||||
|
over_field_value:
|
||||||
|
type: keyword
|
||||||
|
by_field_name:
|
||||||
|
type: keyword
|
||||||
|
by_field_value:
|
||||||
|
type: keyword
|
||||||
|
function:
|
||||||
|
type: keyword
|
||||||
|
typical:
|
||||||
|
type: double
|
||||||
|
actual:
|
||||||
|
type: double
|
||||||
|
field_name:
|
||||||
|
type: keyword
|
||||||
|
kibana.alert.top_influencers:
|
||||||
|
type: object
|
||||||
|
array: true
|
||||||
|
required: false
|
||||||
|
dynamic: false
|
||||||
|
properties:
|
||||||
|
job_id:
|
||||||
|
type: keyword
|
||||||
|
influencer_field_name:
|
||||||
|
type: keyword
|
||||||
|
influencer_field_value:
|
||||||
|
type: keyword
|
||||||
|
influencer_score:
|
||||||
|
type: double
|
||||||
|
initial_influencer_score:
|
||||||
|
type: double
|
||||||
|
is_interim:
|
||||||
|
type: boolean
|
||||||
|
timestamp:
|
||||||
|
type: date
|
||||||
|
shouldWrite: true
|
||||||
|
enabled_in_license: true
|
||||||
|
recovery_action_group:
|
||||||
|
id: recovered
|
||||||
|
name: Recovered
|
||||||
action_groups:
|
action_groups:
|
||||||
- id: anomaly_score_match
|
- id: anomaly_score_match
|
||||||
name: Anomaly score matched the condition
|
name: Anomaly score matched the condition
|
||||||
- id: recovered
|
- id: recovered
|
||||||
name: Recovered
|
name: Recovered
|
||||||
|
default_action_group_id: anomaly_score_match
|
||||||
|
minimum_license_required: platinum
|
||||||
|
is_exportable: true
|
||||||
|
rule_task_timeout: 5m
|
||||||
action_variables:
|
action_variables:
|
||||||
context:
|
context:
|
||||||
- name: timestamp
|
- name: timestamp
|
||||||
|
|
@ -5383,55 +5486,104 @@ components:
|
||||||
- name: anomalyExplorerUrl
|
- name: anomalyExplorerUrl
|
||||||
description: URL to open in the Anomaly Explorer
|
description: URL to open in the Anomaly Explorer
|
||||||
useWithTripleBracesInTemplates: true
|
useWithTripleBracesInTemplates: true
|
||||||
params: []
|
|
||||||
state: []
|
state: []
|
||||||
|
params: []
|
||||||
authorized_consumers:
|
authorized_consumers:
|
||||||
alerts:
|
alerts:
|
||||||
all: true
|
|
||||||
read: true
|
read: true
|
||||||
|
all: true
|
||||||
|
stackAlerts:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
|
slo:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
ml:
|
ml:
|
||||||
all: true
|
|
||||||
read: true
|
read: true
|
||||||
default_action_group_id: anomaly_score_match
|
all: true
|
||||||
|
uptime:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
|
infrastructure:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
|
logs:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
|
monitoring:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
|
siem:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
|
apm:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
|
discover:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
does_set_recovery_context: true
|
does_set_recovery_context: true
|
||||||
enabled_in_license: true
|
has_alerts_mappings: true
|
||||||
is_exportable: true
|
has_fields_for_a_a_d: false
|
||||||
minimum_license_required: platinum
|
- id: xpack.ml.anomaly_detection_jobs_health
|
||||||
name: Anomaly detection alert
|
name: Anomaly detection jobs health
|
||||||
|
category: management
|
||||||
producer: ml
|
producer: ml
|
||||||
|
enabled_in_license: true
|
||||||
recovery_action_group:
|
recovery_action_group:
|
||||||
id: recovered
|
id: recovered
|
||||||
name: Recovered
|
name: Recovered
|
||||||
rule_task_timeout: 5m
|
|
||||||
- id: xpack.ml.anomaly_detection_jobs_health
|
|
||||||
action_groups:
|
action_groups:
|
||||||
- id: anomaly_detection_realtime_issue
|
- id: anomaly_detection_realtime_issue
|
||||||
name: Issue detected
|
name: Issue detected
|
||||||
- id: recovered
|
- id: recovered
|
||||||
name: Recovered
|
name: Recovered
|
||||||
|
default_action_group_id: anomaly_detection_realtime_issue
|
||||||
|
minimum_license_required: platinum
|
||||||
|
is_exportable: true
|
||||||
|
rule_task_timeout: 5m
|
||||||
action_variables:
|
action_variables:
|
||||||
context:
|
context:
|
||||||
- name: results
|
- name: results
|
||||||
description: Results of the rule execution
|
description: Results of the rule execution
|
||||||
- name: message
|
- name: message
|
||||||
description: Alert info message
|
description: Alert info message
|
||||||
params: []
|
|
||||||
state: []
|
state: []
|
||||||
|
params: []
|
||||||
authorized_consumers:
|
authorized_consumers:
|
||||||
alerts:
|
alerts:
|
||||||
all: true
|
|
||||||
read: true
|
read: true
|
||||||
|
all: true
|
||||||
|
stackAlerts:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
|
slo:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
ml:
|
ml:
|
||||||
all: true
|
|
||||||
read: true
|
read: true
|
||||||
default_action_group_id: anomaly_detection_realtime_issue
|
all: true
|
||||||
|
uptime:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
|
infrastructure:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
|
logs:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
|
monitoring:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
|
siem:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
|
apm:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
|
discover:
|
||||||
|
read: true
|
||||||
|
all: true
|
||||||
does_set_recovery_context: true
|
does_set_recovery_context: true
|
||||||
enabled_in_license: true
|
has_alerts_mappings: false
|
||||||
is_exportable: true
|
has_fields_for_a_a_d: false
|
||||||
minimum_license_required: platinum
|
|
||||||
name: Anomaly detection jobs health
|
|
||||||
producer: ml
|
|
||||||
recovery_action_group:
|
|
||||||
id: recovered
|
|
||||||
name: Recovered
|
|
||||||
rule_task_timeout: 5m
|
|
||||||
|
|
|
||||||
|
|
@ -1,81 +1,322 @@
|
||||||
summary: Retrieve rule types associated with Kibana machine learning features
|
summary: Retrieve rule types associated with Kibana machine learning features
|
||||||
value:
|
value:
|
||||||
- id: xpack.ml.anomaly_detection_alert
|
[
|
||||||
action_groups:
|
{
|
||||||
- id: anomaly_score_match
|
"id": "xpack.ml.anomaly_detection_alert",
|
||||||
name: Anomaly score matched the condition
|
"name": "Anomaly detection alert",
|
||||||
- id: recovered
|
"category": "management",
|
||||||
name: Recovered
|
"producer": "ml",
|
||||||
action_variables:
|
"alerts": {
|
||||||
context:
|
"context": "ml.anomaly-detection",
|
||||||
- name: timestamp
|
"mappings": {
|
||||||
description: The bucket timestamp of the anomaly
|
"fieldMap": {
|
||||||
- name: timestampIso8601
|
"kibana.alert.job_id": {
|
||||||
description: The bucket time of the anomaly in ISO8601 format
|
"type": "keyword",
|
||||||
- name: jobIds
|
"array": false,
|
||||||
description: List of job IDs that triggered the alert
|
"required": true
|
||||||
- name: message
|
},
|
||||||
description: Alert info message
|
"kibana.alert.anomaly_score": {
|
||||||
- name: isInterim
|
"type": "double",
|
||||||
description: Indicate if top hits contain interim results
|
"array": false,
|
||||||
- name: score
|
"required": false
|
||||||
description: Anomaly score at the time of the notification action
|
},
|
||||||
- name: topRecords
|
"kibana.alert.is_interim": {
|
||||||
description: Top records
|
"type": "boolean",
|
||||||
- name: topInfluencers
|
"array": false,
|
||||||
description: Top influencers
|
"required": false
|
||||||
- name: anomalyExplorerUrl
|
},
|
||||||
description: URL to open in the Anomaly Explorer
|
"kibana.alert.anomaly_timestamp": {
|
||||||
useWithTripleBracesInTemplates: true
|
"type": "date",
|
||||||
params: []
|
"array": false,
|
||||||
state: []
|
"required": false
|
||||||
authorized_consumers:
|
},
|
||||||
alerts:
|
"kibana.alert.top_records": {
|
||||||
all: true
|
"type": "object",
|
||||||
read: true
|
"array": true,
|
||||||
ml:
|
"required": false,
|
||||||
all: true
|
"dynamic": false,
|
||||||
read: true
|
"properties": {
|
||||||
default_action_group_id: anomaly_score_match
|
"job_id": {
|
||||||
does_set_recovery_context: true
|
"type": "keyword"
|
||||||
enabled_in_license: true
|
},
|
||||||
is_exportable: true
|
"record_score": {
|
||||||
minimum_license_required: platinum
|
"type": "double"
|
||||||
name: Anomaly detection alert
|
},
|
||||||
producer: ml
|
"initial_record_score": {
|
||||||
recovery_action_group:
|
"type": "double"
|
||||||
id: recovered
|
},
|
||||||
name: Recovered
|
"detector_index": {
|
||||||
rule_task_timeout: 5m
|
"type": "integer"
|
||||||
- id: xpack.ml.anomaly_detection_jobs_health
|
},
|
||||||
action_groups:
|
"is_interim": {
|
||||||
- id: anomaly_detection_realtime_issue
|
"type": "boolean"
|
||||||
name: Issue detected
|
},
|
||||||
- id: recovered
|
"timestamp": {
|
||||||
name: Recovered
|
"type": "date"
|
||||||
action_variables:
|
},
|
||||||
context:
|
"partition_field_name": {
|
||||||
- name: results
|
"type": "keyword"
|
||||||
description: Results of the rule execution
|
},
|
||||||
- name: message
|
"partition_field_value": {
|
||||||
description: Alert info message
|
"type": "keyword"
|
||||||
params: []
|
},
|
||||||
state: []
|
"over_field_name": {
|
||||||
authorized_consumers:
|
"type": "keyword"
|
||||||
alerts:
|
},
|
||||||
all: true
|
"over_field_value": {
|
||||||
read: true
|
"type": "keyword"
|
||||||
ml:
|
},
|
||||||
all: true
|
"by_field_name": {
|
||||||
read: true
|
"type": "keyword"
|
||||||
default_action_group_id: anomaly_detection_realtime_issue
|
},
|
||||||
does_set_recovery_context: true
|
"by_field_value": {
|
||||||
enabled_in_license: true
|
"type": "keyword"
|
||||||
is_exportable: true
|
},
|
||||||
minimum_license_required: platinum
|
"function": {
|
||||||
name: Anomaly detection jobs health
|
"type": "keyword"
|
||||||
producer: ml
|
},
|
||||||
recovery_action_group:
|
"typical": {
|
||||||
id: recovered
|
"type": "double"
|
||||||
name: Recovered
|
},
|
||||||
rule_task_timeout: 5m
|
"actual": {
|
||||||
|
"type": "double"
|
||||||
|
},
|
||||||
|
"field_name": {
|
||||||
|
"type": "keyword"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"kibana.alert.top_influencers": {
|
||||||
|
"type": "object",
|
||||||
|
"array": true,
|
||||||
|
"required": false,
|
||||||
|
"dynamic": false,
|
||||||
|
"properties": {
|
||||||
|
"job_id": {
|
||||||
|
"type": "keyword"
|
||||||
|
},
|
||||||
|
"influencer_field_name": {
|
||||||
|
"type": "keyword"
|
||||||
|
},
|
||||||
|
"influencer_field_value": {
|
||||||
|
"type": "keyword"
|
||||||
|
},
|
||||||
|
"influencer_score": {
|
||||||
|
"type": "double"
|
||||||
|
},
|
||||||
|
"initial_influencer_score": {
|
||||||
|
"type": "double"
|
||||||
|
},
|
||||||
|
"is_interim": {
|
||||||
|
"type": "boolean"
|
||||||
|
},
|
||||||
|
"timestamp": {
|
||||||
|
"type": "date"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"shouldWrite": true
|
||||||
|
},
|
||||||
|
"enabled_in_license": true,
|
||||||
|
"recovery_action_group": {
|
||||||
|
"id": "recovered",
|
||||||
|
"name": "Recovered"
|
||||||
|
},
|
||||||
|
"action_groups": [
|
||||||
|
{
|
||||||
|
"id": "anomaly_score_match",
|
||||||
|
"name": "Anomaly score matched the condition"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "recovered",
|
||||||
|
"name": "Recovered"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"default_action_group_id": "anomaly_score_match",
|
||||||
|
"minimum_license_required": "platinum",
|
||||||
|
"is_exportable": true,
|
||||||
|
"rule_task_timeout": "5m",
|
||||||
|
"action_variables": {
|
||||||
|
"context": [
|
||||||
|
{
|
||||||
|
"name": "timestamp",
|
||||||
|
"description": "The bucket timestamp of the anomaly"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "timestampIso8601",
|
||||||
|
"description": "The bucket time of the anomaly in ISO8601 format"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "jobIds",
|
||||||
|
"description": "List of job IDs that triggered the alert"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "message",
|
||||||
|
"description": "Alert info message"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "isInterim",
|
||||||
|
"description": "Indicate if top hits contain interim results"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "score",
|
||||||
|
"description": "Anomaly score at the time of the notification action"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "topRecords",
|
||||||
|
"description": "Top records"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "topInfluencers",
|
||||||
|
"description": "Top influencers"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "anomalyExplorerUrl",
|
||||||
|
"description": "URL to open in the Anomaly Explorer",
|
||||||
|
"useWithTripleBracesInTemplates": true
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"state": [],
|
||||||
|
"params": []
|
||||||
|
},
|
||||||
|
"authorized_consumers": {
|
||||||
|
"alerts": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"stackAlerts": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"slo": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"ml": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"uptime": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"infrastructure": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"logs": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"monitoring": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"siem": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"apm": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"discover": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"does_set_recovery_context": true,
|
||||||
|
"has_alerts_mappings": true,
|
||||||
|
"has_fields_for_a_a_d": false
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "xpack.ml.anomaly_detection_jobs_health",
|
||||||
|
"name": "Anomaly detection jobs health",
|
||||||
|
"category": "management",
|
||||||
|
"producer": "ml",
|
||||||
|
"enabled_in_license": true,
|
||||||
|
"recovery_action_group": {
|
||||||
|
"id": "recovered",
|
||||||
|
"name": "Recovered"
|
||||||
|
},
|
||||||
|
"action_groups": [
|
||||||
|
{
|
||||||
|
"id": "anomaly_detection_realtime_issue",
|
||||||
|
"name": "Issue detected"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "recovered",
|
||||||
|
"name": "Recovered"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"default_action_group_id": "anomaly_detection_realtime_issue",
|
||||||
|
"minimum_license_required": "platinum",
|
||||||
|
"is_exportable": true,
|
||||||
|
"rule_task_timeout": "5m",
|
||||||
|
"action_variables": {
|
||||||
|
"context": [
|
||||||
|
{
|
||||||
|
"name": "results",
|
||||||
|
"description": "Results of the rule execution"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "message",
|
||||||
|
"description": "Alert info message"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"state": [],
|
||||||
|
"params": []
|
||||||
|
},
|
||||||
|
"authorized_consumers": {
|
||||||
|
"alerts": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"stackAlerts": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"slo": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"ml": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"uptime": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"infrastructure": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"logs": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"monitoring": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"siem": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"apm": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
},
|
||||||
|
"discover": {
|
||||||
|
"read": true,
|
||||||
|
"all": true
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"does_set_recovery_context": true,
|
||||||
|
"has_alerts_mappings": false,
|
||||||
|
"has_fields_for_a_a_d": false
|
||||||
|
}
|
||||||
|
]
|
||||||
|
|
@ -74,6 +74,8 @@ get:
|
||||||
type: string
|
type: string
|
||||||
name:
|
name:
|
||||||
type: string
|
type: string
|
||||||
|
alerts:
|
||||||
|
type: object
|
||||||
authorized_consumers:
|
authorized_consumers:
|
||||||
description: The list of the plugins IDs that have access to the rule type.
|
description: The list of the plugins IDs that have access to the rule type.
|
||||||
type: object
|
type: object
|
||||||
|
|
@ -148,6 +150,13 @@ get:
|
||||||
type: boolean
|
type: boolean
|
||||||
read:
|
read:
|
||||||
type: boolean
|
type: boolean
|
||||||
|
category:
|
||||||
|
type: string
|
||||||
|
description: The rule category, which is used by features such as category-specific maintenance windows.
|
||||||
|
enum:
|
||||||
|
- management
|
||||||
|
- observability
|
||||||
|
- securitySolution
|
||||||
default_action_group_id:
|
default_action_group_id:
|
||||||
description: The default identifier for the rule type group.
|
description: The default identifier for the rule type group.
|
||||||
type: string
|
type: string
|
||||||
|
|
@ -157,6 +166,10 @@ get:
|
||||||
enabled_in_license:
|
enabled_in_license:
|
||||||
description: Indicates whether the rule type is enabled or disabled based on the subscription.
|
description: Indicates whether the rule type is enabled or disabled based on the subscription.
|
||||||
type: boolean
|
type: boolean
|
||||||
|
has_alerts_mappings:
|
||||||
|
type: boolean
|
||||||
|
has_fields_for_a_a_d:
|
||||||
|
type: boolean
|
||||||
id:
|
id:
|
||||||
description: The unique identifier for the rule type.
|
description: The unique identifier for the rule type.
|
||||||
type: string
|
type: string
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue