[Security Solution] [Detections] Fixes bug for determining when we hi…

…t max signals after filtering with lists (#71768) update signal counter with filtered results, not with direct search results.
elastic · Jul 15, 2020 · 56de45d · 56de45d
1 parent a885f8a
commit 56de45d
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 5 deletions.
diff --git a/.../plugins/security_solution/server/lib/detection_engine/signals/filter_events_with_list.ts b/.../plugins/security_solution/server/lib/detection_engine/signals/filter_events_with_list.ts
@@ -31,7 +31,6 @@ export const filterEventsAgainstList = async ({
   buildRuleMessage,
 }: FilterEventsAgainstList): Promise<SignalSearchResponse> => {
   try {
-    logger.debug(buildRuleMessage(`exceptionsList: ${JSON.stringify(exceptionsList, null, 2)}`));
     if (exceptionsList == null || exceptionsList.length === 0) {
       logger.debug(buildRuleMessage('about to return original search result'));
       return eventSearchResult;

diff --git a/...plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts b/...plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts
@@ -91,7 +91,7 @@ export const searchAfterAndBulkCreate = async ({
   };
 
   let sortId; // tells us where to start our next search_after query
-  let searchResultSize = 0;
+  let signalsCreatedCount = 0;
 
   /*
     The purpose of `maxResults` is to ensure we do not perform
@@ -127,8 +127,8 @@ export const searchAfterAndBulkCreate = async ({
       toReturn.success = false;
       return toReturn;
     }
-    searchResultSize = 0;
-    while (searchResultSize < tuple.maxSignals) {
+    signalsCreatedCount = 0;
+    while (signalsCreatedCount < tuple.maxSignals) {
       try {
         logger.debug(buildRuleMessage(`sortIds: ${sortId}`));
         const {
@@ -167,7 +167,6 @@ export const searchAfterAndBulkCreate = async ({
                 searchResult.hits.hits[searchResult.hits.hits.length - 1]?._source['@timestamp']
               )
             : null;
-        searchResultSize += searchResult.hits.hits.length;
 
         // filter out the search results that match with the values found in the list.
         // the resulting set are valid signals that are not on the allowlist.
@@ -187,6 +186,14 @@ export const searchAfterAndBulkCreate = async ({
           break;
         }
 
+        // make sure we are not going to create more signals than maxSignals allows
+        if (signalsCreatedCount + filteredEvents.hits.hits.length > tuple.maxSignals) {
+          filteredEvents.hits.hits = filteredEvents.hits.hits.slice(
+            0,
+            tuple.maxSignals - signalsCreatedCount
+          );
+        }
+
         const {
           bulkCreateDuration: bulkDuration,
           createdItemsCount: createdCount,
@@ -211,6 +218,7 @@ export const searchAfterAndBulkCreate = async ({
         });
         logger.debug(buildRuleMessage(`created ${createdCount} signals`));
         toReturn.createdSignalsCount += createdCount;
+        signalsCreatedCount += createdCount;
         if (bulkDuration) {
           toReturn.bulkCreateTimes.push(bulkDuration);
         }