Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Detection Engine] Threshold rule alert suppression docs #4315

Closed
6 tasks done
vitaliidm opened this issue Nov 28, 2023 · 1 comment
Closed
6 tasks done

[Detection Engine] Threshold rule alert suppression docs #4315

vitaliidm opened this issue Nov 28, 2023 · 1 comment
Assignees
@joepeeples
Labels
Docset: ESS Issues that apply to docs in the Stack release Docset: Serverless Issues for Serverless Security Feature: Rules Team: Detection Engine v8.12.0

Comments

@vitaliidm
Copy link
Contributor

vitaliidm commented Nov 28, 2023 •
edited by joepeeples
Loading

Description

Few changes in comparison with custom query alerts suppression UI behaviour

  1. Suppress by fields removed, since suppression is performed on Threshold Groups By fields
  2. Instead, we show checkbox - so user can opt-in for alert suppression (either by selected threshold fields or w/o any)
  3. Only time interval is radio button is available, suppression in rule execution is disabled(Threshold rule itself 'suppress' by grouping during rule execution)

Demo video, shows suppression on interval when users select threshold group by fields and when do not

Screen.Recording.2023-11-27.at.16.54.52.mov
Suppression is enabled, threshold fields selected Screenshot 2023-11-27 at 16 44 04
Suppression is not enabled, threshold fields selected Screenshot 2023-11-27 at 16 44 27
Suppression is not enabled, threshold fields not selected Screenshot 2023-11-27 at 16 44 42

Before doc published, feature is hidden behind alertSuppressionForThresholdRuleEnabled flag.
Available for ESS - Platinum license, Serverless - Essentials

Acceptance Test Criteria

  • UI behavior documented
  • Changes to API documented

Docs PRs
Preview Give feedback

Tasks
Preview Give feedback
@vitaliidm vitaliidm mentioned this issue Nov 28, 2023
Merged
6 tasks
@joepeeples joepeeples self-assigned this Nov 30, 2023
@joepeeples joepeeples added Docset: Serverless Issues for Serverless Security Docset: ESS Issues that apply to docs in the Stack release labels Dec 1, 2023
vitaliidm added a commit to elastic/kibana that referenced this issue Dec 4, 2023
@vitaliidm @kibanamachine
[Security Solution][Detection Engine] adds alerts Suppression to thre…
be7f6cf 
…shold rule (#171423)

## Summary

- addresses milestone 1 of
elastic/security-team#7773 epic
- adds alerts suppression capabilities to threshold rule type
- to enable alerts suppression for threshold rule type use experimental
feature flag `alertSuppressionForThresholdRuleEnabled` in kibana.yml
  ```
  xpack.securitySolution.enableExperimental:
    - alertSuppressionForThresholdRuleEnabled
  ```
- similarly to query rule Platinum license is required

### UI
Few changes in comparison with custom query alerts suppression

1. Suppress by fields removed, since suppression is performed on
Threshold Groups By fields
2. Instead, we show checkbox - so user can opt-in for alert suppression
(either by selected threshold fields or w/o any)
3. Only time interval is radio button is available, suppression in rule
execution is disabled(Threshold rule itself 'suppress' by grouping
during rule execution)


Demo video, shows suppression on interval when users select threshold
group by fields and when do not


https://github.com/elastic/kibana/assets/92328789/7dc476ad-0d0f-4e40-8042-d4dd552759d9

<details>
<summary>
Suppression is  enabled, threshold fields selected
</summary>
<img width="1056" alt="Screenshot 2023-11-27 at 16 44 04"
src="https://github.com/elastic/kibana/assets/92328789/c654a7b2-6f70-4a04-8a85-48b2a2445014">
</details>

<details>
<summary>
Suppression is not enabled, threshold fields selected
</summary>
<img width="1036" alt="Screenshot 2023-11-27 at 16 44 27"
src="https://github.com/elastic/kibana/assets/92328789/1cd4145f-df17-4b41-954b-c64de9eac0ff">
</details>

<details>
<summary>
Suppression is not enabled, threshold fields not selected
</summary>
<img width="1050" alt="Screenshot 2023-11-27 at 16 44 42"
src="https://github.com/elastic/kibana/assets/92328789/8b64a65b-4abd-4334-a1a5-e2b00fe7d8a5">
</details>



### Checklist

- [x] Functional changes are hidden behind a feature flag 

  Feature flag `alertSuppressionForThresholdRuleEnabled`

- [x] Functional changes are covered with a test plan and automated
tests.

Test plan in progress(cc @vgomez-el), unit/ftr/cypress tests added to
cover alert suppression functionality added

- [x] Stability of new and changed tests is verified using the [Flaky
Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner).

[FTR ESS & Serverless
tests](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4057)
[Cypress
ESS](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4058)
[Cypress
Serverless](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/4059)


- [ ] Comprehensive manual testing is done by two engineers: the PR
author and one of the PR reviewers. Changes are tested in both ESS and
Serverless.

- [x] Mapping changes are accompanied by a technical design document. It
can be a GitHub issue or an RFC explaining the changes. The design
document is shared with and approved by the appropriate teams and
individual stakeholders.

Existing AlertSuppression schema field is used for Threshold rule,
similarly to Query. But only `duration` field is applicable and required

- [x] Functional changes are communicated to the Docs team. A ticket or
PR is opened in https://github.com/elastic/security-docs. The following
information is included: any feature flags used, affected environments
(Serverless, ESS, or both).

elastic/security-docs#4315

---------

Co-authored-by: kibanamachine <[email protected]>
@joepeeples joepeeples changed the title [Detection Engine] Add documentation update for threshold rule alert suppression [Detection Engine] Threshold rule alert suppression Dec 7, 2023
@joepeeples joepeeples changed the title [Detection Engine] Threshold rule alert suppression [Detection Engine] Threshold rule alert suppression docs Dec 7, 2023
This was referenced Dec 13, 2023
Merged
Closed
@vitaliidm vitaliidm mentioned this issue Dec 20, 2023
Merged
vitaliidm added a commit to elastic/kibana that referenced this issue Dec 21, 2023
@vitaliidm
[Security Solution][Detection Engine] removes threshold alert suppres…
f1deae8 
…sion feature flag (#173762)

## Summary

- removes threshold alert suppression experimental feature flag
introduced in #171423
- docs [issue](elastic/security-docs#4315) for
reference
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Dec 21, 2023
@vitaliidm
[Security Solution][Detection Engine] removes threshold alert suppres…
555c104 
…sion feature flag (elastic#173762)

## Summary

- removes threshold alert suppression experimental feature flag
introduced in elastic#171423
- docs [issue](elastic/security-docs#4315) for
reference

(cherry picked from commit f1deae8)
kibanamachine added a commit to elastic/kibana that referenced this issue Dec 21, 2023
@kibanamachine @vitaliidm
[8.12] [Security Solution][Detection Engine] removes threshold alert …
9251d59 
…suppression feature flag (#173762) (#173851)

# Backport

This will backport the following commits from `main` to `8.12`:
- [[Security Solution][Detection Engine] removes threshold alert
suppression feature flag
(#173762)](#173762)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Vitalii
Dmyterko","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-12-21T15:41:52Z","message":"[Security
Solution][Detection Engine] removes threshold alert suppression feature
flag (#173762)\n\n## Summary\r\n\r\n- removes threshold alert
suppression experimental feature flag\r\nintroduced in
https://github.com/elastic/kibana/pull/171423\r\n- docs
[issue](elastic/security-docs#4315)
for\r\nreference","sha":"f1deae8bd62ecaf97d41a3078bc5c85f4df17b70","branchLabelMapping":{"^v8.13.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Detections
and Resp","Team: SecuritySolution","backport:prev-minor","Team:Detection
Engine","v8.12.0","v8.13.0"],"number":173762,"url":"https://github.com/elastic/kibana/pull/173762","mergeCommit":{"message":"[Security
Solution][Detection Engine] removes threshold alert suppression feature
flag (#173762)\n\n## Summary\r\n\r\n- removes threshold alert
suppression experimental feature flag\r\nintroduced in
https://github.com/elastic/kibana/pull/171423\r\n- docs
[issue](elastic/security-docs#4315)
for\r\nreference","sha":"f1deae8bd62ecaf97d41a3078bc5c85f4df17b70"}},"sourceBranch":"main","suggestedTargetBranches":["8.12"],"targetPullRequestStates":[{"branch":"8.12","label":"v8.12.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.13.0","labelRegex":"^v8.13.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/173762","number":173762,"mergeCommit":{"message":"[Security
Solution][Detection Engine] removes threshold alert suppression feature
flag (#173762)\n\n## Summary\r\n\r\n- removes threshold alert
suppression experimental feature flag\r\nintroduced in
https://github.com/elastic/kibana/pull/171423\r\n- docs
[issue](elastic/security-docs#4315)
for\r\nreference","sha":"f1deae8bd62ecaf97d41a3078bc5c85f4df17b70"}}]}]
BACKPORT-->

Co-authored-by: Vitalii Dmyterko <[email protected]>
@joepeeples
Copy link
Contributor

Threshold rule alert suppression docs are done. Semi-separately, we're also backporting API docs for the query rule alert suppression options, via #4496 (issue #4481), will be merged soon.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@joepeeples joepeeples

Labels
Docset: ESS Issues that apply to docs in the Stack release Docset: Serverless Issues for Serverless Security Feature: Rules Team: Detection Engine v8.12.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@joepeeples @vitaliidm