Closed frantz45 closed 12 months ago
It's very problematic for "less than 1" rules, because they will always trigger as there is no log in the Stream. Pausing the Event Definition is mandatory for this use case.
Cases to handle:
It seems the disabling/enabling of streams is currently exclusively done on the GUI side (see https://github.com/airbus-cyber/graylog-plugin-alert-wizard/blob/4.4.1/src/web/wizard/components/AlertRuleList.jsx#L106) The disabled state of the rule is based on the disabled state of the stream. Likewise, methods enable and disable of the EventDefinitionsStore should prove useful to fix this issue.
I've tested with Wizard v5.1.0 and I confirm it works well
When you disable a rule from the Wizard it pauses the corresponding streams. It works well because logs can't go into the streams anymore, so the event definition doesn't find any log. But the event definition is still trying to find events every X minutes. It would be cleaner to disable the event definition (in addition to pause the streams).