elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.62k stars 8.22k forks source link

[Security Solution] Consider removing `throttle` from the rule schema #155577

Open e40pud opened 1 year ago

e40pud commented 1 year ago

Post https://github.com/elastic/kibana/pull/154990 updates:

marshallmain commented 1 year ago

To minimize breaking changes now and in the future, we could copy the validation logic that the alerting framework uses: either the rule level frequency can be used or frequencies can be set on individual actions, but frequencies can not be specified at both levels simultaneously in a request. We could leave the throttle and notifyWhen settings where they are in the schema but not allow them to be set when the new action-level frequencies are used.

Copied from slack:

the code we have will work for converting from rule + action level frequencies into just action level frequencies, but the potential problem is that we are allowing API users to use the rule level frequency as a default setting whereas alerting does not allow that. If we wanted to consolidate the APIs (possibly remove our API and just redirect to the alerting APIs) in the future we might have to remove the ability to use the rule level setting as a default which would be another breaking change for users that used it that way. If our API never allows both together then we won't have to risk a breaking change by taking away that ability in the future. But, we can still remove the restriction in the future at any point if it becomes necessary.

elasticmachine commented 1 year ago

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine commented 1 year ago

Pinging @elastic/security-solution (Team: SecuritySolution)

yctercero commented 2 months ago

@banderror is this required to be worked on for rule customization? Going to be un-assigning @e40pud, so this will be backlog.

banderror commented 1 month ago

@yctercero It's not a part of the customization epic.