-
Notifications
You must be signed in to change notification settings - Fork 8.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Security Solution] Fix performance issues affecting rules management #135311
Conversation
982de5c
to
5671e9c
Compare
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
Pinging @elastic/security-solution (Team: SecuritySolution) |
x-pack/plugins/security_solution/cypress/downloads/rules_export.ndjson
Outdated
Show resolved
Hide resolved
...ution/public/detections/components/rules/related_integrations/use_installed_integrations.tsx
Outdated
Show resolved
Hide resolved
/** | ||
* We should use this hook to invalidate the prepackaged rules cache. For | ||
* example, rule mutations that affect rule set size, like creation or deletion, | ||
* should lead to cache invalidation. | ||
* | ||
* @returns A rules cache invalidation callback | ||
*/ | ||
export const useInvalidatePrePackagedRulesStatus = () => { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Appreciate the comment/context here. This is one of those things the team just needs to know about when working with mutations as it would be easy to add a mutation operation and not know you have to invalidate the PrePackagedStatus. If we guaranteed all rule access was going through a specific hook/API, we could invalidate at that layer, but not much else can be done, so thanks for the context here 👍
const { data: prePackagedRulesStatus, isFetching } = usePrePackagedRulesStatus(); | ||
const { mutate: installPrePackagedRules, isLoading: loadingCreatePrePackagedRules } = | ||
useInstallPrePackagedRules(); | ||
|
||
const createPrePackagedRules = useCallback(() => { | ||
if ( | ||
canUserCRUD && | ||
hasIndexWrite && | ||
isAuthenticated && | ||
hasEncryptionKey && | ||
isSignalIndexExists | ||
) { | ||
installPrePackagedRules(); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The tech debt cleanup here is fantastic @xcrzx! Like finally paying off 150 year mortgage that has been following your family for generations, haha! 😅 Thanks for tackling this one -- so much cleaner and easier to grok the actual control flow with this, usePrePackagedRulesStatus
, and useInstallPrePackagedRules
. 💯💯💯
...olution/public/detections/containers/detection_engine/rules/use_pre_packaged_rules_status.ts
Outdated
Show resolved
Hide resolved
x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
Outdated
Show resolved
Hide resolved
x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Checked out, tested locally, and performed code review -- LGTM! 👍
Couple nits/questions around cache expiration timing (and will have to resolve conflicts with main coming from the recent schema changes), but everything else looks great @xcrzx! Thanks for the massive tech debt cleanup here, further APM instrumentation, and general perf cleanup as well. 🎉 🙌 🚀
427a3d1
to
99eb6a3
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
05f7b35
to
759f0b2
Compare
a32295b
to
0278c47
Compare
0278c47
to
fcd603f
Compare
💚 Build SucceededMetrics [docs]Module Count
Async chunks
History
To update your PR or re-run it, just comment with: cc @xcrzx |
Summary
This PR fixes some of the performance issues identified here #134826.
useQuery
. That allows us to fetch the prepackaged rules statuses only once and re-fetch them only after server state mutations.installPrepackagedRules
method to use the promise pool and respect theMAX_RULES_TO_UPDATE_IN_PARALLEL
setting.withSecuritySpan
for better discoverability in APM.Results
Before the rules management table took 950ms to render for 95% of users
Now, the rules management table takes less than 300ms to render for 95% of users (3x faster)