Add runtime license check for suppression

elastic · Nov 10, 2022 · d757582 · d757582
1 parent 66fda9d
commit d757582
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/executors/query.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/executors/query.ts
@@ -62,8 +62,12 @@ export const queryExecutor = async ({
       exceptionFilter: runOpts.exceptionFilter,
     });
 
+    const license = await firstValueFrom(licensing.license$);
+    const hasPlatinumLicense = license.hasAtLeast('platinum');
+    const hasGoldLicense = license.hasAtLeast('gold');
+
     const result =
-      ruleParams.alertSuppression?.groupBy != null
+      ruleParams.alertSuppression?.groupBy != null && hasPlatinumLicense
         ? await groupAndBulkCreate({
             runOpts,
             services,
@@ -94,9 +98,6 @@ export const queryExecutor = async ({
             state: {},
           };
 
-    const license = await firstValueFrom(licensing.license$);
-    const hasGoldLicense = license.hasAtLeast('gold');
-
     if (hasGoldLicense) {
       if (completeRule.ruleParams.responseActions?.length && result.createdSignalsCount) {
         scheduleNotificationResponseActions(