Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Monitor model changed to add an optional fanoutEnabled field #758

Merged
merged 5 commits into from
Dec 17, 2024

Conversation

riysaxen-amzn
Copy link
Collaborator

Description

Detectors configured with aggregation sigma rules should ideally generate only one alert in one execution when a set of documents match the rule’s condition. But currently there are duplicate alerts being generated when aggregate sigma rules are matched.
This PR adds a field in monitor fanoutEnabled (optional field), default value of this flag will be true. When detector is created/updated, the value of this field will be set to false in case chained findings doc level monitor, this will ensure that fanout approach will be disabled when executing doc level monitor

Related Issues

Resolves #[Issue number to be closed when this PR is merged]

Check List

  • New functionality includes testing.
  • New functionality has been documented.
  • API changes companion pull request created.
  • Commits are signed per the DCO using --signoff.
  • Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

eirsep
eirsep previously approved these changes Dec 17, 2024
@riysaxen-amzn riysaxen-amzn requested a review from eirsep December 17, 2024 19:24
Copy link
Member

@eirsep eirsep left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unit test not added

@riysaxen-amzn riysaxen-amzn merged commit cb9d38b into opensearch-project:main Dec 17, 2024
5 of 12 checks passed
opensearch-trigger-bot bot pushed a commit that referenced this pull request Dec 17, 2024
* Monitor model changed to add an optional fanoutEnabled field

Signed-off-by: Riya Saxena <[email protected]>

* Monitor model changed to add an optional fanoutEnabled field

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

---------

Signed-off-by: Riya Saxena <[email protected]>
(cherry picked from commit cb9d38b)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@riysaxen-amzn
Copy link
Collaborator Author

UTs will add as a follow up

opensearch-trigger-bot bot pushed a commit that referenced this pull request Dec 17, 2024
* Monitor model changed to add an optional fanoutEnabled field

Signed-off-by: Riya Saxena <[email protected]>

* Monitor model changed to add an optional fanoutEnabled field

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

---------

Signed-off-by: Riya Saxena <[email protected]>
(cherry picked from commit cb9d38b)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
opensearch-trigger-bot bot pushed a commit that referenced this pull request Dec 17, 2024
* Monitor model changed to add an optional fanoutEnabled field

Signed-off-by: Riya Saxena <[email protected]>

* Monitor model changed to add an optional fanoutEnabled field

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

---------

Signed-off-by: Riya Saxena <[email protected]>
(cherry picked from commit cb9d38b)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
opensearch-trigger-bot bot pushed a commit that referenced this pull request Dec 17, 2024
* Monitor model changed to add an optional fanoutEnabled field

Signed-off-by: Riya Saxena <[email protected]>

* Monitor model changed to add an optional fanoutEnabled field

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

---------

Signed-off-by: Riya Saxena <[email protected]>
(cherry picked from commit cb9d38b)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
opensearch-trigger-bot bot pushed a commit that referenced this pull request Dec 17, 2024
* Monitor model changed to add an optional fanoutEnabled field

Signed-off-by: Riya Saxena <[email protected]>

* Monitor model changed to add an optional fanoutEnabled field

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

* move fanoutEnabled to docLevel input

Signed-off-by: Riya Saxena <[email protected]>

---------

Signed-off-by: Riya Saxena <[email protected]>
(cherry picked from commit cb9d38b)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
AWSHurneyt pushed a commit that referenced this pull request Dec 17, 2024
…763)

* Monitor model changed to add an optional fanoutEnabled field



* Monitor model changed to add an optional fanoutEnabled field



* move fanoutEnabled to docLevel input



* move fanoutEnabled to docLevel input



* move fanoutEnabled to docLevel input



---------


(cherry picked from commit cb9d38b)

Signed-off-by: Riya Saxena <[email protected]>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
sbcd90 pushed a commit that referenced this pull request Dec 18, 2024
…762)

Signed-off-by: Riya Saxena <[email protected]>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
sbcd90 pushed a commit that referenced this pull request Dec 18, 2024
…765)

Signed-off-by: Riya Saxena <[email protected]>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants