github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 09:48:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

[SIEM] [Detection Engine] Log time gaps as failures for now (#55515)

Browse source 
* log a failure to failure history if time gap is detected. stop-gap solution until a feature is fully fleshed out to report this and future messaging / monitoring.

* write date the gap warning occurred in the last_failure_at field, along with the status_date field.
This commit is contained in:
Devin W. Hurley 2020-01-22 07:50:32 -05:00 • committed by GitHub
parent 3e69ea5f01
commit e828a12954
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

21
x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
View file

@ -134,6 +134,27 @@ export const signalRulesAlertType = ({
logger.warn(
`Signal rule name: "${name}", id: "${alertId}", rule_id: "${ruleId}" has a time gap of ${gap.humanize()} (${gap.asMilliseconds()}ms), and could be missing signals within that time. Consider increasing your look behind time or adding more Kibana instances.`
);
// write a failure status whenever we have a time gap
// this is a temporary solution until general activity
// monitoring is developed as a feature
const gapDate = new Date().toISOString();
await services.savedObjectsClient.create(ruleStatusSavedObjectType, {
alertId,
statusDate: gapDate,
status: 'failed',
lastFailureAt: gapDate,
lastSuccessAt: currentStatusSavedObject.attributes.lastSuccessAt,
lastFailureMessage: `Signal rule name: "${name}", id: "${alertId}", rule_id: "${ruleId}" has a time gap of ${gap.humanize()} (${gap.asMilliseconds()}ms), and could be missing signals within that time. Consider increasing your look behind time or adding more Kibana instances.`,
lastSuccessMessage: currentStatusSavedObject.attributes.lastSuccessMessage,
});
if (ruleStatusSavedObjects.saved_objects.length >= 6) {
// delete fifth status and prepare to insert a newer one.
const toDelete = ruleStatusSavedObjects.saved_objects.slice(5);
await toDelete.forEach(async item =>
services.savedObjectsClient.delete(ruleStatusSavedObjectType, item.id)
);
}
}
// set searchAfter page size to be the lesser of default page size or maxSignals.
const searchAfterSize =