Skip to content

Commit

Permalink
[DOCS] Revise workaround for aggregated fields in threshold rules (#2074
Browse files Browse the repository at this point in the history
) (#2106)

* Remove workaround from create rule docs

* Restore admonition, with revisions from Madison

(cherry picked from commit 6f0d069)

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
mergify[bot] and joepeeples authored Jun 22, 2022

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
1 parent 5eaadb5 commit 63a7301
Showing 1 changed file with 2 additions and 12 deletions.
14 changes: 2 additions & 12 deletions docs/detections/rules-ui-create.asciidoc
Original file line number Diff line number Diff line change
@@ -164,18 +164,8 @@ For example, if `Group by` is `source.ip`, `destination.ip` and its `Threshold`
+
You can also leave the `Group by` field undefined. The rule then creates an alert when the number of search results is equal to or greater than the threshold value. If you set `Count` to limit the results by `process.name` >= 2, an alert will only be generated for source/destination IP pairs that appear with at least 2 unique process names across all events.
+
[IMPORTANT]
==============
Signals created by *threshold* rules are synthetic signals that do not resemble the source documents. The signal itself only contains data about the fields that were aggregated over (the `Group by` fields). Additionally, the signal contains "lookup" data for retrieving a *Timeline* of all of the source events that caused the threshold to be exceeded.
If you wish to create an <<rule-notifications, *Action*>> based on a threshold rule, you can obtain values of the fields that were aggregated over by entering the following:
```
{{#context.alerts}}
{{#signal.threshold_result.terms}}
{{value}}
{{/signal.threshold_result.terms}}
{{/context.alerts}}
```
==============
IMPORTANT: Alerts created by threshold rules are synthetic alerts that do not resemble the source documents. The alert itself only contains data about the fields that were aggregated over (the `Group by` fields). Other fields are omitted, because they can vary across all source documents that were counted toward the threshold. Additionally, you can reference the actual count of documents that exceeded the threshold from the `kibana.alert.threshold_result.count` field.

. Continue with <<preview-rules, previewing the rule>> (optional) or click *Continue* to <<rule-ui-basic-params, configure basic rule settings>>.

[discrete]

0 comments on commit 63a7301

Please sign in to comment.