search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.76k stars 8.16k forks source link

[Security Solution] Rule don't clear last_run information after executions #192499

Open nkhristinin opened 2 weeks ago

nkhristinin commented 2 weeks ago

Kibana version: 8.16

Describe the bug:

If rule has gap, there was set gap_duration_s to some value, next successful runs stil have info about gap_duration_s

Steps to reproduce:

  1. Create a rule with 1 minutes interval, 1 s lookback (I check with detection rules)
  2. Run it ones, have successful status
  3. Disable rule
  4. Wait > 5 minutes
  5. Enable rule, wait and observe fail execution status with information about gaps
  6. Disable/enable rule, wait for succesffull status
  7. Check API response from rule last run and check that there that there still info about gaps

Expected behavior:

last run contain info only about last run

elasticmachine commented 2 weeks ago

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)