search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.73k stars 8.14k forks source link

[Security Solution][Detection Engine] Detection rules should use dataViewLazy to reduce field caps data transfer #189113

Open mattkime opened 2 months ago

mattkime commented 2 months ago

Parent issue: https://github.com/elastic/security-team/issues/10106

This is a continuation of the work in https://github.com/elastic/kibana/pull/184890

New terms, threshold, and indicator match rules still load fieldCaps for all fields on every rule execution. We should look into new terms and threshold next as they are more common rules than indicator match, and they should be simpler to fix than indicator match.

Once new terms and threshold are fixed, we should look at IM rules and check for any other places where we can reduce field caps usage.

The offending logic is https://github.com/elastic/kibana/blob/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts#L340-L353

elasticmachine commented 2 months ago

Pinging @elastic/security-detection-engine (Team:Detection Alerts)

yctercero commented 1 week ago

Related: https://github.com/elastic/kibana/issues/187059