Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove Detection Rule telemetry from Security Solution (8.0+) #119047

Closed
wants to merge 6 commits into from

Conversation

pjhampton
Copy link
Contributor

Summary

I have opened this pull request for discussion.

From some internal wrangling, It seems based on RAC changes that Detection Rule telemetry is bust 8.0+.
After chatting with @stevewritescode we are making the case for removing it completely for these releases - this is because we have found there was been little to no interaction with the data from 7.13 (April 2020).

Related PRs:

There is a cross-team discussion as to the data we want to collect from 8.2 and index it in a way that is useful for technical and non-technical stakeholders.

For maintainers

@pjhampton pjhampton added bug Fixes for quality problems that affect the customer experience Feature:Telemetry v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. auto-backport Deprecated - use backport:version if exact versions are needed v8.1.0 labels Nov 18, 2021
@pjhampton pjhampton requested a review from a team as a code owner November 18, 2021 15:44
@pjhampton pjhampton self-assigned this Nov 18, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@pjhampton pjhampton requested review from a team as code owners November 18, 2021 15:52
@pjhampton
Copy link
Contributor Author

@elasticmachine merge upstream

@rylnd
Copy link
Contributor

rylnd commented Nov 19, 2021

we have found there was been little to no interaction with the data from 7.13

@pjhampton can you expound on this a bit? Is there an expected vs. actual level of interaction?

@pjhampton
Copy link
Contributor Author

Thanks, @rylnd. I have replied to you offline.
If you are aware of the use of this data from other teams please point me in their direction.

@pjhampton
Copy link
Contributor Author

@elasticmachine merge upstream

@kibana-ci
Copy link
Collaborator

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @pjhampton

@rylnd
Copy link
Contributor

rylnd commented Nov 30, 2021

@pjhampton we are tracking the broken telemetry as part of https://github.com/elastic/security-team/issues/1018#issuecomment-937323352 and will have it fixed as part of 8.0. As discussed offline, we expect that the downstream ingest process will be update to make this data more usable moving forward.

@pjhampton
Copy link
Contributor Author

@rylnd Sounds good. We have this planned on our end for 8.1 FF.
Closing. Thanks, everyone!

@pjhampton pjhampton closed this Dec 1, 2021
@spalger spalger deleted the pjhampton/drule-fix branch May 8, 2022 22:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
auto-backport Deprecated - use backport:version if exact versions are needed bug Fixes for quality problems that affect the customer experience Feature:Telemetry release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.0.0 v8.1.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants