[Security Solutions] Fixes the newer notification system throttle resets and enabling immediate execution on first detection of a signal #114214

FrankHassanabad · 2021-10-07T00:08:38Z

Summary

Fixes:

Resets happening by adding the throttle to the else switches and error catching. We have to call throttle on every rule execution or we will cause a reset.
Fixes a case where we were not firing the signal immediately by pushing down the alerts detected. This can cause a reset or a delay of MTTD.
Adds unit tests for the conditions
Changes some of the logic to clean things up.

Checklist

Unit or functional tests were updated or added to match the most common scenarios

…ndition and fixes bug where it did not fire immediately

FrankHassanabad · 2021-10-11T17:22:08Z

@elasticmachine merge upstream

kibanamachine · 2021-10-11T17:22:12Z

merge conflict between base and head

FrankHassanabad · 2021-10-12T01:18:36Z

@elasticmachine merge upstream

...ion/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.test.ts

yctercero · 2021-10-12T04:11:19Z

...solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.ts

+  esClient: ElasticsearchClient;
+  alertInstance: AlertInstance;
+  notificationRuleParams: NotificationRuleTypeParams;
+  signals: unknown[];


Does SignalSearchResponse work here as a type?

They're not exactly the same type from looking at things. It's legacy and confusing to have the unknown here. We might be able to change it later but I'm not going to for this PR for right now.

...solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.ts

x-pack/plugins/security_solution/server/lib/detection_engine/notifications/utils.test.ts

yctercero · 2021-10-12T06:05:34Z

It's looking great! I only tested with a custom query rule and it wasn't exhaustive. But did verify the following behaviors:

If there are signals found on rule enable or initial run, a notification is sent immediately
If set to hourly interval, only receive one notification within an hour, even if rule hits bulk error response

Some test data for sanity check:

Run 0 (activation) - 🔔 Notified - `NEWWWWW Rule test new generated 200 alerts - 2021-10-12T04:57:13.909Z` (says 200 because I had disabled/enabled the rule to test initial run notification, also note that the clock between my logger and what's showing up on slack notification differs)

Run 1 - No notification -
logs show 100 signals found, 2021-10-11T22:02:15.079-07:00

Run 2 - No notification -
logs show 100 signals found, 2021-10-11T22:07:20.112-07:00

Run 3 - No notification -
logs show 100 signals found, 2021-10-11T22:12:23.174-07:00

[...]

Run 7 - No notification -
logs show error bulk indexing, 2021-10-11T22:32:28.422-07:00

Run 8 - No notification -
logs show 100 signals found, 2021-10-11T22:37:33.129-07:00

[...]

Run 13 - 🔔 Notified -
NEWWWWW Rule test new generated 200 alerts - 2021-10-12T05:57:45.429Z

I am a bit confused about that second notification up there that notifies the user of 200 alerts. I would have thought it would be 1200 alerts (that remove the alerts counted in the initial notification, and the 100 not indexed during one run because of a bulk indexing error).

Went ahead and did another round this time noting the logs and rule running every 10 minutes:

Run 0 (activation) - 🔔 Notified - `Testing total signals count. Rule test new generated 200 alerts - 2021-10-12T06:12:41.325Z` (says 200 because I had disabled/enabled the rule to test initial run notification).

"The notification throttle resultsLink created is: [...]. Notification throttle is querying the results using "from:" 1634015491959 "to": 1634019087830 "size": 100 "index": .siem-signals-default "ruleId": 31bc8759-d877-4e7b-8550-69cd76a7f6bc"
"The notification throttle query result size before deconflicting duplicates is: 0. The notification throttle passed in signals size before deconflicting duplicates is: 100. The deconflicted size and size of the signals sent into throttle notification is: 100."

Run 1 - No notification -

[2021-10-11T23:12:39.977-07:00][INFO ][plugins.securitySolution] Found 100 signals for notification. name: "test new" id: "5c3ee270-2b17-11ec-a3ef-f572d4f1f85c" rule id: "31bc8759-d877-4e7b-8550-69cd76a7f6bc" signals index: ".siem-signals-default"
"The notification throttle resultsLink created is: [...]. Notification throttle is querying the results using "from:" 1634015559977 "to": 1634019155647 "size": 100 "index": .siem-signals-default "ruleId": 31bc8759-d877-4e7b-8550-69cd76a7f6bc"
"The notification throttle query result size before deconflicting duplicates is: 100. The notification throttle passed in signals size before deconflicting duplicates is: 100. The deconflicted size and size of the signals sent into throttle notification is: 200."
[2021-10-11T23:12:41.322-07:00][INFO ][plugins.securitySolution] [+] Finished indexing 100 signals searched between date ranges [
{
"to": "2021-10-12T06:12:37.462Z",
"from": "2021-10-12T06:01:37.463Z",
"maxSignals": 100
}
] name: "test new" id: "5c3ee270-2b17-11ec-a3ef-f572d4f1f85c" rule id: "31bc8759-d877-4e7b-8550-69cd76a7f6bc" signals index: ".siem-signals-default"

Run 2 - No notification -

2021-10-11T23:22:41.130-07:00][INFO ][plugins.securitySolution] Found 100 signals for notification. name: "test new" id: "5c3ee270-2b17-11ec-a3ef-f572d4f1f85c" rule id: "31bc8759-d877-4e7b-8550-69cd76a7f6bc" signals index: ".siem-signals-default"
"The notification throttle resultsLink created is: [...]. Notification throttle is querying the results using "from:" 1634016161130 "to": 1634019755787 "size": 100 "index": .siem-signals-default "ruleId": 31bc8759-d877-4e7b-8550-69cd76a7f6bc"
"The notification throttle query result size before deconflicting duplicates is: 100. The notification throttle passed in signals size before deconflicting duplicates is: 100. The deconflicted size and size of the signals sent into throttle notification is: 200."
[2021-10-11T23:22:42.444-07:00][INFO ][plugins.securitySolution] [+] Finished indexing 100 signals searched between date ranges [
{
"to": "2021-10-12T06:22:38.156Z",
"from": "2021-10-12T06:11:38.156Z",
"maxSignals": 100
}
] name: "test new" id: "5c3ee270-2b17-11ec-a3ef-f572d4f1f85c" rule id: "31bc8759-d877-4e7b-8550-69cd76a7f6bc" signals index: ".siem-signals-default"

Run 3 - No notification -

[2021-10-11T23:32:40.278-07:00][INFO ][plugins.securitySolution] Found 100 signals for notification. name: "test new" id: "5c3ee270-2b17-11ec-a3ef-f572d4f1f85c" rule id: "31bc8759-d877-4e7b-8550-69cd76a7f6bc" signals index: ".siem-signals-default"
"The notification throttle resultsLink created is: [...]. Notification throttle is querying the results using "from:" 1634016760278 "to": 1634020355950 "size": 100 "index": .siem-signals-default "ruleId": 31bc8759-d877-4e7b-8550-69cd76a7f6bc"
"The notification throttle query result size before deconflicting duplicates is: 100. The notification throttle passed in signals size before deconflicting duplicates is: 100. The deconflicted size and size of the signals sent into throttle notification is: 200."
[2021-10-11T23:32:41.575-07:00][INFO ][plugins.securitySolution] [+] Finished indexing 100 signals searched between date ranges [
{
"to": "2021-10-12T06:32:38.054Z",
"from": "2021-10-12T06:21:38.054Z",
"maxSignals": 100
}
] name: "test new" id: "5c3ee270-2b17-11ec-a3ef-f572d4f1f85c" rule id: "31bc8759-d877-4e7b-8550-69cd76a7f6bc" signals index: ".siem-signals-default"

Run 4 - No notification -

[2021-10-11T23:42:43.405-07:00][INFO ][plugins.securitySolution] Found 100 signals for notification. name: "test new" id: "5c3ee270-2b17-11ec-a3ef-f572d4f1f85c" rule id: "31bc8759-d877-4e7b-8550-69cd76a7f6bc" signals index: ".siem-signals-default"
"The notification throttle resultsLink created is: [...]. Notification throttle is querying the results using "from:" 1634017363406 "to": 1634020959105 "size": 100 "index": .siem-signals-default "ruleId": 31bc8759-d877-4e7b-8550-69cd76a7f6bc"
"The notification throttle query result size before deconflicting duplicates is: 100. The notification throttle passed in signals size before deconflicting duplicates is: 100. The deconflicted size and size of the signals sent into throttle notification is: 200."
[2021-10-11T23:42:44.678-07:00][INFO ][plugins.securitySolution] [+] Finished indexing 100 signals searched between date ranges [
{
"to": "2021-10-12T06:42:41.161Z",
"from": "2021-10-12T06:31:41.161Z",
"maxSignals": 100
}
] name: "test new" id: "5c3ee270-2b17-11ec-a3ef-f572d4f1f85c" rule id: "31bc8759-d877-4e7b-8550-69cd76a7f6bc" signals index: ".siem-signals-default"

Run 5 - No notification -

[2021-10-11T23:52:44.560-07:00][INFO ][plugins.securitySolution] Found 100 signals for notification. name: "test new" id: "5c3ee270-2b17-11ec-a3ef-f572d4f1f85c" rule id: "31bc8759-d877-4e7b-8550-69cd76a7f6bc" signals index: ".siem-signals-default"
"The notification throttle resultsLink created is: [...]. Notification throttle is querying the results using "from:" 1634017964561 "to": 1634021559239 "size": 100 "index": .siem-signals-default "ruleId": 31bc8759-d877-4e7b-8550-69cd76a7f6bc"
"The notification throttle query result size before deconflicting duplicates is: 100. The notification throttle passed in signals size before deconflicting duplicates is: 100. The deconflicted size and size of the signals sent into throttle notification is: 200."
[2021-10-11T23:52:45.793-07:00][INFO ][plugins.securitySolution] [+] Finished indexing 100 signals searched between date ranges [
{
"to": "2021-10-12T06:52:41.505Z",
"from": "2021-10-12T06:41:41.505Z",
"maxSignals": 100
}
] name: "test new" id: "5c3ee270-2b17-11ec-a3ef-f572d4f1f85c" rule id: "31bc8759-d877-4e7b-8550-69cd76a7f6bc" signals index: ".siem-signals-default"

Run 6 - No notification -

[2021-10-12T00:02:43.731-07:00][INFO ][plugins.securitySolution] Found 100 signals for notification. name: "test new" id: "5c3ee270-2b17-11ec-a3ef-f572d4f1f85c" rule id: "31bc8759-d877-4e7b-8550-69cd76a7f6bc" signals index: ".siem-signals-default"
"The notification throttle resultsLink created is: [...]. Notification throttle is querying the results using "from:" 1634018563731 "to": 1634022159395 "size": 100 "index": .siem-signals-default "ruleId": 31bc8759-d877-4e7b-8550-69cd76a7f6bc"
"The notification throttle query result size before deconflicting duplicates is: 100. The notification throttle passed in signals size before deconflicting duplicates is: 100. The deconflicted size and size of the signals sent into throttle notification is: 200."
[2021-10-12T00:02:44.903-07:00][INFO ][plugins.securitySolution] [+] Finished indexing 100 signals searched between date ranges [
{
"to": "2021-10-12T07:02:41.370Z",
"from": "2021-10-12T06:51:41.370Z",
"maxSignals": 100
}
] name: "test new" id: "5c3ee270-2b17-11ec-a3ef-f572d4f1f85c" rule id: "31bc8759-d877-4e7b-8550-69cd76a7f6bc" signals index: ".siem-signals-default"

Run 7 - 🔔 Notified -
Testing total signals count. Rule test new generated 200 alerts - 2021-10-12T07:12:48.493Z

[2021-10-12T00:12:46.945-07:00][INFO ][plugins.securitySolution] Found 100 signals for notification. name: "test new" id: "5c3ee270-2b17-11ec-a3ef-f572d4f1f85c" rule id: "31bc8759-d877-4e7b-8550-69cd76a7f6bc" signals index: ".siem-signals-default"
"The notification throttle resultsLink created is: [...]. Notification throttle is querying the results using "from:" 1634019166946 "to": 1634022762443 "size": 100 "index": .siem-signals-default "ruleId": 31bc8759-d877-4e7b-8550-69cd76a7f6bc"
"The notification throttle query result size before deconflicting duplicates is: 100. The notification throttle passed in signals size before deconflicting duplicates is: 100. The deconflicted size and size of the signals sent into throttle notification is: 200."
[2021-10-12T00:12:48.491-07:00][INFO ][plugins.securitySolution] [+] Finished indexing 100 signals searched between date ranges [
{
"to": "2021-10-12T07:12:44.326Z",
"from": "2021-10-12T07:01:44.327Z",
"maxSignals": 100
}
] name: "test new" id: "5c3ee270-2b17-11ec-a3ef-f572d4f1f85c" rule id: "31bc8759-d877-4e7b-8550-69cd76a7f6bc" signals index: ".siem-signals-default"

I'm thinking maybe it's in the dedupe? I'll take a closer look tomorrow.

FrankHassanabad · 2021-10-12T13:13:11Z

@elasticmachine merge upstream

...solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.ts

rylnd

Just adding a few comments that I forgot to submit the other day; I can do another pass later if necessary.

...solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.ts

…hat does not break later.

…into fix-throttle-bug

FrankHassanabad · 2021-10-15T13:50:35Z

@elasticmachine merge upstream

FrankHassanabad · 2021-10-15T17:05:55Z

@elasticmachine merge upstream

yctercero

Reviewed fix. LGTM! Thanks so much 🚀

FrankHassanabad · 2021-10-15T22:04:49Z

@elasticmachine merge upstream

kibanamachine · 2021-10-16T00:27:58Z

💛 Build succeeded, but was flaky

continuous-integration/kibana-ci/pull-request
Commit: 29bcc65
Storybooks Preview
Flaky suites:
- xpack-kibana-ciGroup6

Test Failures

Kibana Pipeline / general / X-Pack API Integration Tests.x-pack/test/api_integration/apis/search/session·ts.apis search search session touched time updates when you poll on an search

Link to Jenkins

Standard Out

Failed Tests Reporter:
  - Test has not failed recently on tracked branches

[00:00:00]     │
[00:00:00]       └-: apis
[00:00:00]         └-> "before all" hook in "apis"
[00:00:00]         └-: search
[00:00:00]           └-> "before all" hook in "search"
[00:00:03]           └-: search session
[00:00:03]             └-> "before all" hook for "should fail to extend a nonexistent session"
[00:00:03]             └-> should fail to extend a nonexistent session
[00:00:03]               └-> "before each" hook: global before each for "should fail to extend a nonexistent session"
[00:00:03]               │ proc [kibana] [2021-10-15T22:53:25.005+00:00][ERROR][plugins.dataEnhanced.data_enhanced] [object Object]
[00:00:03]               └- ✓ pass  (68ms)
[00:00:03]             └-> should sync search ids into not persisted session
[00:00:03]               └-> "before each" hook: global before each for "should sync search ids into not persisted session"
[00:00:03]               │ debg Waiting up to 5000ms for searches persisted into session...
[00:00:03]               │ proc [kibana] [2021-10-15T22:53:25.149+00:00][ERROR][plugins.dataEnhanced.data_enhanced] [object Object]
[00:00:03]               │ debg --- retry.waitForWithTimeout error: expected 200 "OK", got 404 "Not Found"
[00:00:03]               │ proc [kibana] [2021-10-15T22:53:25.718+00:00][ERROR][plugins.dataEnhanced.data_enhanced] [object Object]
[00:00:03]               │ debg --- retry.waitForWithTimeout failed again with the same message...
[00:00:04]               │ info [o.e.c.m.MetadataMappingService] [node-01] [.kibana_8.0.0_001/VlDEGl_iS26fn3bpAa8iCA] update_mapping [_doc]
[00:00:04]               └- ✓ pass  (1.2s)
[00:00:04]             └-> should complete session when searches complete
[00:00:04]               └-> "before each" hook: global before each for "should complete session when searches complete"
[00:00:04]               │ debg Waiting up to 5000ms for searches persisted into session...
[00:00:04]               │ debg --- retry.waitForWithTimeout error: expected [] to contain 'Fmk4bDVaanl6UTJpU3pzazNjcWpyTncbWlJ0bFRXalRRSC00MkhvZUZIeXl0QToyMjQ2'
[00:00:05]               │ debg --- retry.waitForWithTimeout failed again with the same message...
[00:00:06]               │ info [o.e.c.m.MetadataMappingService] [node-01] [.ds-.logs-deprecation.elasticsearch-default-2021.10.15-000001/TmMkEB_pRIydyZRjShdTwQ] update_mapping [_doc]
[00:00:08]               │ info [o.e.c.m.MetadataMappingService] [node-01] [.kibana_8.0.0_001/VlDEGl_iS26fn3bpAa8iCA] update_mapping [_doc]
[00:00:16]               │ debg Waiting up to 5000ms for searches eventually complete and session gets into the complete state...
[00:00:16]               └- ✓ pass  (11.6s)
[00:00:16]             └-> touched time updates when you poll on an search
[00:00:16]               └-> "before each" hook: global before each for "touched time updates when you poll on an search"
[00:00:16]               │ debg Waiting up to 20000ms for search session created...
[00:00:16]               │ proc [kibana] [2021-10-15T22:53:37.987+00:00][ERROR][plugins.dataEnhanced.data_enhanced] [object Object]
[00:00:16]               │ proc [kibana] [2021-10-15T22:53:38.551+00:00][ERROR][plugins.dataEnhanced.data_enhanced] [object Object]
[00:00:20]               └- ✖ fail: apis search search session touched time updates when you poll on an search
[00:00:20]               │      Error: expected '2021-10-15T22:53:38.964Z' to be below 2021-10-15T22:53:38.964Z
[00:00:20]               │       at Assertion.assert (/dev/shm/workspace/parallel/23/kibana/node_modules/@kbn/expect/expect.js:100:11)
[00:00:20]               │       at Assertion.lessThan.Assertion.below (/dev/shm/workspace/parallel/23/kibana/node_modules/@kbn/expect/expect.js:336:8)
[00:00:20]               │       at Function.lessThan (/dev/shm/workspace/parallel/23/kibana/node_modules/@kbn/expect/expect.js:531:15)
[00:00:20]               │       at Context.<anonymous> (test/api_integration/apis/search/session.ts:438:65)
[00:00:20]               │       at runMicrotasks (<anonymous>)
[00:00:20]               │       at processTicksAndRejections (internal/process/task_queues.js:95:5)
[00:00:20]               │       at Object.apply (/dev/shm/workspace/parallel/23/kibana/node_modules/@kbn/test/target_node/functional_test_runner/lib/mocha/wrap_function.js:87:16)
[00:00:20]               │ 
[00:00:20]               │

Stack Trace

Error: expected '2021-10-15T22:53:38.964Z' to be below 2021-10-15T22:53:38.964Z
    at Assertion.assert (/dev/shm/workspace/parallel/23/kibana/node_modules/@kbn/expect/expect.js:100:11)
    at Assertion.lessThan.Assertion.below (/dev/shm/workspace/parallel/23/kibana/node_modules/@kbn/expect/expect.js:336:8)
    at Function.lessThan (/dev/shm/workspace/parallel/23/kibana/node_modules/@kbn/expect/expect.js:531:15)
    at Context.<anonymous> (test/api_integration/apis/search/session.ts:438:65)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (internal/process/task_queues.js:95:5)
    at Object.apply (/dev/shm/workspace/parallel/23/kibana/node_modules/@kbn/test/target_node/functional_test_runner/lib/mocha/wrap_function.js:87:16)

Metrics [docs]

✅ unchanged

History

💔 Build #161554 failed 34556bd
💔 Build #161452 failed b9b2cd8
💚 Build #161167 succeeded e3f214f
💚 Build #159957 succeeded f3fb62b
💔 Build #159800 failed 9e5a2f1

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @FrankHassanabad

…ets and enabling immediate execution on first detection of a signal (elastic#114214) ## Summary Fixes: * Resets happening by adding the throttle to the else switches and error catching. We have to call throttle on every rule execution or we will cause a reset. * Fixes a case where we were not firing the signal immediately by pushing down the alerts detected. This can cause a reset or a delay of MTTD. * Adds unit tests for the conditions * Changes some of the logic to clean things up. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

kibanamachine · 2021-10-16T00:40:15Z

💚 Backport successful

Status	Branch	Result
✅	7.x

This backport PR will be merged automatically after passing CI.

…ets and enabling immediate execution on first detection of a signal (#114214) (#115292) ## Summary Fixes: * Resets happening by adding the throttle to the else switches and error catching. We have to call throttle on every rule execution or we will cause a reset. * Fixes a case where we were not firing the signal immediately by pushing down the alerts detected. This can cause a reset or a delay of MTTD. * Adds unit tests for the conditions * Changes some of the logic to clean things up. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios Co-authored-by: Frank Hassanabad <frank.hassanabad@elastic.co>

…-migrate-away-from-injected-css-js * 'master' of github.com:elastic/kibana: (237 commits) [Uptime] Added uptime query inspector panel (elastic#115170) [Osquery] Add packs (elastic#107345) [App Search] Allow for query parameter to indicate ingestion mechanism for new engines (elastic#115188) [Alerting] Active alerts do not recover after re-enabling a rule (elastic#111671) skip flaky tests. elastic#115308, elastic#115313 [Breaking] Remove deprecated `enabled` settings from plugins. (elastic#113495) skip flaky suite. elastic#107057 skip flaky tests. elastic#89052, elastic#113418, elastic#115304 skip flaky test. elastic#113892 Bump node to 16.11.1 (elastic#110684) [Security Solution] Restores Alerts table local storage persistence and the Remove Column action (elastic#114742) skip flaky suite. elastic#115130 one line remove assert (elastic#115127) Fixes migration bug where I was deleting attributes (elastic#115098) [Security Solutions] Fixes the newer notification system throttle resets and enabling immediate execution on first detection of a signal (elastic#114214) [build] Dockerfile update (elastic#115237) Fixes Cypress flake cypress test (elastic#115270) Disable APM e2e tests log an invalid type for SO (elastic#115175) [Fleet] Don't auto upgrade policies for AUTO_UPDATE packages (elastic#115199) ... # Conflicts: # src/plugins/dashboard/public/application/dashboard_app.tsx # src/plugins/dashboard/public/types.ts # x-pack/plugins/reporting/server/lib/layouts/print_layout.ts

…-link-to-kibana-app * 'master' of github.com:elastic/kibana: (287 commits) [Security Solution][Endpoint] Change `trustedAppByPolicyEnabled` flag to `true` by default (elastic#115264) [APM] generator: support error events and application metrics (elastic#115311) [kibanaUtils] Don't import full `semver` client side (elastic#114986) [RAC] Link inventory alerts to the right inventory view (elastic#113553) [Uptime] Added uptime query inspector panel (elastic#115170) [Osquery] Add packs (elastic#107345) [App Search] Allow for query parameter to indicate ingestion mechanism for new engines (elastic#115188) [Alerting] Active alerts do not recover after re-enabling a rule (elastic#111671) skip flaky tests. elastic#115308, elastic#115313 [Breaking] Remove deprecated `enabled` settings from plugins. (elastic#113495) skip flaky suite. elastic#107057 skip flaky tests. elastic#89052, elastic#113418, elastic#115304 skip flaky test. elastic#113892 Bump node to 16.11.1 (elastic#110684) [Security Solution] Restores Alerts table local storage persistence and the Remove Column action (elastic#114742) skip flaky suite. elastic#115130 one line remove assert (elastic#115127) Fixes migration bug where I was deleting attributes (elastic#115098) [Security Solutions] Fixes the newer notification system throttle resets and enabling immediate execution on first detection of a signal (elastic#114214) [build] Dockerfile update (elastic#115237) ... # Conflicts: # x-pack/plugins/reporting/public/management/__snapshots__/report_listing.test.tsx.snap

FrankHassanabad added 3 commits October 6, 2021 17:38

Fixes throttle bugs from resets if we don't call it on every error co…

5f55e77

…ndition and fixes bug where it did not fire immediately

Merge branch 'master' into fix-throttle-bug

2809fd2

Fixes tests and adds a few more unit tests

9eb64d5

FrankHassanabad self-assigned this Oct 7, 2021

FrankHassanabad added v8.0.0 v7.16.0 Feature:Rule Actions Security Solution Detection Rule Actions area release_note:skip Skip the PR/issue when compiling release notes auto-backport Deprecated - use backport:version if exact versions are needed labels Oct 7, 2021

FrankHassanabad changed the title ~~Fix throttle bug~~ [Security Solutions] Fixes the newer notification system throttle resets and enabling immediate execution on first detection of a signal Oct 7, 2021

FrankHassanabad marked this pull request as ready for review October 7, 2021 15:00

FrankHassanabad requested a review from a team as a code owner October 7, 2021 15:00

FrankHassanabad requested review from yctercero and dhurley14 October 7, 2021 15:00

FrankHassanabad added 2 commits October 11, 2021 15:01

Merge branch 'master' into fix-throttle-bug

aa31674

Merge branch 'master' into fix-throttle-bug

cfcf378

Merge branch 'master' into fix-throttle-bug

9e5a2f1

yctercero reviewed Oct 12, 2021

View reviewed changes

...ion/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.test.ts Outdated Show resolved Hide resolved

yctercero reviewed Oct 12, 2021

View reviewed changes

...solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.ts Show resolved Hide resolved

yctercero reviewed Oct 12, 2021

View reviewed changes

x-pack/plugins/security_solution/server/lib/detection_engine/notifications/utils.test.ts Show resolved Hide resolved

Merge branch 'master' into fix-throttle-bug

f3fb62b

yctercero reviewed Oct 12, 2021

View reviewed changes

...solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.ts Show resolved Hide resolved

rylnd reviewed Oct 13, 2021

View reviewed changes

...solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.ts Outdated Show resolved Hide resolved

...solution/server/lib/detection_engine/notifications/schedule_throttle_notification_actions.ts Outdated Show resolved Hide resolved

Merge branch 'master' into fix-throttle-bug

6613502

FrankHassanabad added 3 commits October 14, 2021 14:07

Fixes PR comments and the sizing and adds more unit tests to ensure t…

0cf1ad3

…hat does not break later.

Merge branch 'master' into fix-throttle-bug

00ca3ae

Merge branch 'fix-throttle-bug' of github.com:FrankHassanabad/kibana …

e3f214f

…into fix-throttle-bug

FrankHassanabad added the Team:Security Solution Platform Security Solution Platform Team label Oct 14, 2021

Merge branch 'master' into fix-throttle-bug

b9b2cd8

Merge branch 'master' into fix-throttle-bug

34556bd

yctercero approved these changes Oct 15, 2021

View reviewed changes

Merge branch 'master' into fix-throttle-bug

29bcc65

FrankHassanabad enabled auto-merge (squash) October 15, 2021 22:06

FrankHassanabad disabled auto-merge October 16, 2021 00:01

FrankHassanabad merged commit 55235c6 into elastic:master Oct 16, 2021

kibanamachine mentioned this pull request Oct 16, 2021

[7.x] [Security Solutions] Fixes the newer notification system throttle resets and enabling immediate execution on first detection of a signal (#114214) #115292

Merged

FrankHassanabad deleted the fix-throttle-bug branch October 16, 2021 00:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solutions] Fixes the newer notification system throttle resets and enabling immediate execution on first detection of a signal #114214

[Security Solutions] Fixes the newer notification system throttle resets and enabling immediate execution on first detection of a signal #114214

FrankHassanabad commented Oct 7, 2021 •

edited

Loading

FrankHassanabad commented Oct 11, 2021

kibanamachine commented Oct 11, 2021

FrankHassanabad commented Oct 12, 2021

yctercero Oct 12, 2021

FrankHassanabad Oct 14, 2021

yctercero commented Oct 12, 2021 •

edited

Loading

FrankHassanabad commented Oct 12, 2021

rylnd left a comment

FrankHassanabad commented Oct 15, 2021

FrankHassanabad commented Oct 15, 2021

yctercero left a comment

FrankHassanabad commented Oct 15, 2021

kibanamachine commented Oct 16, 2021

Standard Out

Stack Trace

kibanamachine commented Oct 16, 2021

[Security Solutions] Fixes the newer notification system throttle resets and enabling immediate execution on first detection of a signal #114214

[Security Solutions] Fixes the newer notification system throttle resets and enabling immediate execution on first detection of a signal #114214

Conversation

FrankHassanabad commented Oct 7, 2021 • edited Loading

Summary

Checklist

FrankHassanabad commented Oct 11, 2021

kibanamachine commented Oct 11, 2021

FrankHassanabad commented Oct 12, 2021

yctercero Oct 12, 2021

Choose a reason for hiding this comment

FrankHassanabad Oct 14, 2021

Choose a reason for hiding this comment

yctercero commented Oct 12, 2021 • edited Loading

FrankHassanabad commented Oct 12, 2021

rylnd left a comment

Choose a reason for hiding this comment

FrankHassanabad commented Oct 15, 2021

FrankHassanabad commented Oct 15, 2021

yctercero left a comment

Choose a reason for hiding this comment

FrankHassanabad commented Oct 15, 2021

kibanamachine commented Oct 16, 2021

💛 Build succeeded, but was flaky

Test Failures

Standard Out

Stack Trace

Metrics [docs]

History

kibanamachine commented Oct 16, 2021

💚 Backport successful

FrankHassanabad commented Oct 7, 2021 •

edited

Loading

yctercero commented Oct 12, 2021 •

edited

Loading