Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[DOCS] Threshold rules: multiple aggregations with cardinality #535

Closed
jmikell821 opened this issue Mar 4, 2021 · 1 comment
Closed

[DOCS] Threshold rules: multiple aggregations with cardinality #535

jmikell821 opened this issue Mar 4, 2021 · 1 comment
Assignees
@jmikell821
Labels
Team: Detections/Response Detections and Response v7.12.0

Comments

@jmikell821
Copy link
Contributor

Related PR: elastic/kibana#90826

Summary

This PR adds support for multiple terms aggregations within a Threshold Rule, as well as an additional cardinality aggregation for matching a specific number of unique values across a field.

Pre-existing signals from 7.11.x are handled without a migration by converting the existing document to a 7.12-conforming document DE-side and client-side before evaluating.
@jmikell821 jmikell821 added Team: Detections/Response Detections and Response v7.12.0 labels Mar 4, 2021
@jmikell821 jmikell821 self-assigned this Mar 4, 2021
@jmikell821 jmikell821 mentioned this issue Mar 24, 2021
Merged
@jmikell821
Copy link
Contributor Author

Merged #582.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jmikell821 jmikell821

Labels
Team: Detections/Response Detections and Response v7.12.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@jmikell821