Only persist top 5 inputs for a risk score

This commit is contained in:
Ryland Herrick 2023-09-20 14:27:48 -05:00
parent 82024c240a
commit b12224c323

View file

@ -158,7 +158,7 @@ const buildIdentifierTypeAggregation = ({
aggs: {
inputs: {
top_hits: {
size: 10,
size: 5,
sort: { [ALERT_RISK_SCORE]: 'desc' },
_source: false,
docvalue_fields: ['@timestamp', ALERT_RISK_SCORE, ALERT_RULE_NAME],