elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.48k stars 8.04k forks source link

[bug][8.13] Security Analyzer view takes over 1 minute to load a tree with 2 nodes. #179594

Open aarju opened 3 months ago

aarju commented 3 months ago

Kibana version: 8.13

Browser version: Chrome

Browser OS version: Windows 11

Original install method (e.g. download page, yum, from source, etc.): ECK

Describe the bug: There has been a big hit to the performance in the Analyzer view with 8.13. It took 1.3 minutes to load this view of two nodes. image

The request to /s/infosec-detections/internal/data_views/fields? is is taking around a minute to return. After that call returns there is then a call to /s/infosec-detections/api/endpoint/resolver/tree which takes another minute to return.

There is now a data view selector and a date range selector in analyzer. The default setting when you open analyzer is all security index patterns with a 7 day query. I noticed that both of the above calls are passing the entire security data view index pattern to both calls, but the only the endpoint data can be used by the analyzer.

Steps to reproduce:

  1. Have a cluster with lots of different data integrations being used as part of your default security view.
  2. Click the Analyze button from a malware alert

Expected behavior: The page should load within a few seconds, not over a minute.

Screenshots (if relevant): These are the index patterns being passed to the tree call: image

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context:

elasticmachine commented 3 months ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 3 months ago

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)