We currently cache a v8::Script for each rule once per runtime and re-use it for every execution. This cache is keyed by the rule's name. This works well for analysis, however, when authoring a rule, that the key is the rule's name means the first version will always be returned.
What is your solution?
Clear the rule cache for the rules in the HTTP request before executing any of them. This isn't the most elegant solution, but it serves as a stopgap to fix a behavior regression on ddsa that effectively makes rule authoring impossible.
Alternatives considered
Hash the rule so that in the execute_rule function, the cache miss happens without manual intervention. I think the perf hit of having to hash a bunch of text on each execution is not acceptable, given that the rule authoring use case is not performance-sensitive, but analysis is.
What problem are you trying to solve?
We currently cache a
v8::Scriptfor each rule once per runtime and re-use it for every execution. This cache is keyed by the rule's name. This works well for analysis, however, when authoring a rule, that the key is the rule's name means the first version will always be returned.What is your solution?
Clear the rule cache for the rules in the HTTP request before executing any of them. This isn't the most elegant solution, but it serves as a stopgap to fix a behavior regression on ddsa that effectively makes rule authoring impossible.
Alternatives considered
execute_rulefunction, the cache miss happens without manual intervention. I think the perf hit of having to hash a bunch of text on each execution is not acceptable, given that the rule authoring use case is not performance-sensitive, but analysis is.What the reviewer should know