Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SECURITYSOLUTION][ALERTS] - Show warning that custom action intervals cannot be shorter than the rule's check interval #155502

Open
e40pud opened this issue Apr 21, 2023 · 3 comments · May be fixed by #155684
Open

[SECURITYSOLUTION][ALERTS] - Show warning that custom action intervals cannot be shorter than the rule's check interval #155502

e40pud opened this issue Apr 21, 2023 · 3 comments · May be fixed by #155684
Labels
8.8 candidate consider-next Team:Detection Engine Security Solution Detection Engine Area Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)

Comments

@e40pud
Copy link
Contributor

e40pud commented Apr 21, 2023

Describe the feature:

We should show the warning when user selects the action's frequency which is shorter than the rule's schedule interval.

Main ticket

cc @vitaliidm
@e40pud e40pud added Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) Team:Detection Alerts Security Detection Alerts Area Team 8.8 candidate labels Apr 21, 2023
@e40pud e40pud self-assigned this Apr 21, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/response-ops (Team:ResponseOps)

@e40pud e40pud mentioned this issue Apr 21, 2023
Merged
3 tasks
@vitaliidm
Copy link
Contributor

Current behaviour is described here

@e40pud e40pud moved this from Awaiting Triage to Todo in AppEx: ResponseOps - Rules & Alerts Management Apr 21, 2023
@XavierM
Copy link
Contributor

XavierM commented Apr 21, 2023 •
edited
Loading

if you use minimumThrottleInterval then you will have that behavior below
image

@e40pud e40pud mentioned this issue Apr 23, 2023
Closed
19 tasks
@e40pud e40pud moved this from Todo to In Progress in AppEx: ResponseOps - Rules & Alerts Management Apr 24, 2023
e40pud added a commit to e40pud/kibana that referenced this issue Apr 25, 2023
@e40pud
[RAM][SECURITYSOLUTION][ALERTS] - Show warning that custom action int…
a12b25e 
…ervals cannot be shorter than the rule's check interval (elastic#155502)
This was referenced Apr 25, 2023
Draft
Merged
@e40pud e40pud moved this from In Progress to In Review in AppEx: ResponseOps - Rules & Alerts Management Apr 25, 2023
@e40pud e40pud mentioned this issue May 4, 2023
Merged
e40pud added a commit that referenced this issue May 5, 2023
@e40pud @kibanamachine
[RAM][SECURITYSOLUTION][ALERTS] - Throw an error when user tries to s…
e1ee019 
…et schedule interval shorter than any action frequency (#156644)

## Summary

These changes insure that alerting framework throws an exception when
user tries to set rule's schedule interval shorter than one of the
action frequencies.

The message will look like:

`"message": "Error updating rule: the interval is longer than the action
frequencies: 1h"`

TheUI changes will be addressed in the 8.9 in this ticket
#155502

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue May 5, 2023
@e40pud
[RAM][SECURITYSOLUTION][ALERTS] - Throw an error when user tries to s…
022822a 
…et schedule interval shorter than any action frequency (elastic#156644)

## Summary

These changes insure that alerting framework throws an exception when
user tries to set rule's schedule interval shorter than one of the
action frequencies.

The message will look like:

`"message": "Error updating rule: the interval is longer than the action
frequencies: 1h"`

TheUI changes will be addressed in the 8.9 in this ticket
elastic#155502

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
(cherry picked from commit e1ee019)
kibanamachine added a commit that referenced this issue May 5, 2023
@kibanamachine @e40pud
[8.8] [RAM][SECURITYSOLUTION][ALERTS] - Throw an error when user trie…
4c76392 
…s to set schedule interval shorter than any action frequency (#156644) (#156920)

# Backport

This will backport the following commits from `main` to `8.8`:
- [[RAM][SECURITYSOLUTION][ALERTS] - Throw an error when user tries to
set schedule interval shorter than any action frequency
(#156644)](#156644)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Ievgen
Sorokopud","email":"ievgen.sorokopud@elastic.co"},"sourceCommit":{"committedDate":"2023-05-05T20:46:31Z","message":"[RAM][SECURITYSOLUTION][ALERTS]
- Throw an error when user tries to set schedule interval shorter than
any action frequency (#156644)\n\n## Summary\r\n\r\nThese changes insure
that alerting framework throws an exception when\r\nuser tries to set
rule's schedule interval shorter than one of the\r\naction
frequencies.\r\n\r\nThe message will look like:\r\n\r\n`\"message\":
\"Error updating rule: the interval is longer than the
action\r\nfrequencies: 1h\"`\r\n\r\nTheUI changes will be addressed in
the 8.9 in this
ticket\r\nhttps://github.com//issues/155502\r\n\r\n---------\r\n\r\nCo-authored-by:
Kibana Machine
<42973632+kibanamachine@users.noreply.github.com>","sha":"e1ee0196653a38fc6b7f8abfb191a286ad020176","branchLabelMapping":{"^v8.9.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:ResponseOps","Team:Detection
Alerts","backport:prev-minor","ci:cloud-deploy","v8.9.0"],"number":156644,"url":"https://github.com/elastic/kibana/pull/156644","mergeCommit":{"message":"[RAM][SECURITYSOLUTION][ALERTS]
- Throw an error when user tries to set schedule interval shorter than
any action frequency (#156644)\n\n## Summary\r\n\r\nThese changes insure
that alerting framework throws an exception when\r\nuser tries to set
rule's schedule interval shorter than one of the\r\naction
frequencies.\r\n\r\nThe message will look like:\r\n\r\n`\"message\":
\"Error updating rule: the interval is longer than the
action\r\nfrequencies: 1h\"`\r\n\r\nTheUI changes will be addressed in
the 8.9 in this
ticket\r\nhttps://github.com//issues/155502\r\n\r\n---------\r\n\r\nCo-authored-by:
Kibana Machine
<42973632+kibanamachine@users.noreply.github.com>","sha":"e1ee0196653a38fc6b7f8abfb191a286ad020176"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v8.9.0","labelRegex":"^v8.9.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/156644","number":156644,"mergeCommit":{"message":"[RAM][SECURITYSOLUTION][ALERTS]
- Throw an error when user tries to set schedule interval shorter than
any action frequency (#156644)\n\n## Summary\r\n\r\nThese changes insure
that alerting framework throws an exception when\r\nuser tries to set
rule's schedule interval shorter than one of the\r\naction
frequencies.\r\n\r\nThe message will look like:\r\n\r\n`\"message\":
\"Error updating rule: the interval is longer than the
action\r\nfrequencies: 1h\"`\r\n\r\nTheUI changes will be addressed in
the 8.9 in this
ticket\r\nhttps://github.com//issues/155502\r\n\r\n---------\r\n\r\nCo-authored-by:
Kibana Machine
<42973632+kibanamachine@users.noreply.github.com>","sha":"e1ee0196653a38fc6b7f8abfb191a286ad020176"}}]}]
BACKPORT-->

Co-authored-by: Ievgen Sorokopud <ievgen.sorokopud@elastic.co>
@vgomez-el vgomez-el mentioned this issue May 12, 2023
Closed
@yctercero yctercero added Team:Detection Engine Security Solution Detection Engine Area and removed Team:Detection Alerts Security Detection Alerts Area Team labels May 13, 2023
@XavierM XavierM changed the title [RAM][SECURITYSOLUTION][ALERTS] - Show warning that custom action intervals cannot be shorter than the rule's check interval [SECURITYSOLUTION][ALERTS] - Show warning that custom action intervals cannot be shorter than the rule's check interval May 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
8.8 candidate consider-next Team:Detection Engine Security Solution Detection Engine Area Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)
Projects
None yet
Milestone
No milestone
5 participants
@XavierM @e40pud @yctercero @elasticmachine @vitaliidm