You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: solutions/security/detect-and-alert/manage-detection-rules.md
+8-16Lines changed: 8 additions & 16 deletions
Original file line number
Diff line number
Diff line change
@@ -66,7 +66,7 @@ For {{ml}} rules, an indicator icon ( or [{{serverless-short}} project tier](../../../deploy-manage/deploy/elastic-cloud/project-settings.md).
68
68
* You can edit [rule notifications](/solutions/security/detect-and-alert/create-detection-rule.md#rule-notifications) (notifications and response actions) for prebuilt rules with any {{stack}} subscription or {{serverless-short}} project tier.
69
-
* You must have an [Enterprise subscription](https://www.elastic.co/pricing){{stack}} or a [Complete project tier](../../../deploy-manage/deploy/elastic-cloud/project-settings.md) subscription on {{serverless-short}} to edit all prebuilt rule settings (except for the **Author** and **License** fields) and bulk-modify them.
69
+
* You must have an [Enterprise subscription](https://www.elastic.co/pricing) {{stack}} or a [Complete project tier](../../../deploy-manage/deploy/elastic-cloud/project-settings.md) subscription on {{serverless-short}} to edit all prebuilt rule settings (except for the **Author** and **License** fields) and bulk-modify them.
70
70
71
71
::::
72
72
@@ -130,12 +130,7 @@ When duplicating a rule with exceptions, you can choose to duplicate the rule an
130
130
131
131
## Run rules manually [manually-run-rules]
132
132
133
-
::::{warning}
134
-
This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.
135
-
::::
136
-
137
-
138
-
Manually run enabled rules for a specified period of time for testing purposes or additional rule coverage.
133
+
Manually run enabled rules for a specified period of time to deliberately test them, provide additional rule coverage, or fill gaps in rule executions.
139
134
140
135
::::{important}
141
136
Before manually running rules, make sure you properly understand and plan for rule dependencies. Incorrect scheduling can lead to inconsistent rule results.
@@ -151,19 +146,16 @@ Before manually running rules, make sure you properly understand and plan for ru
151
146
3. Specify when the manual run starts and ends. The default selection is the current day starting three hours in the past. The rule will search for events during the selected time range.
152
147
4. Click **Run** to manually run the rule.
153
148
154
-
::::{note}
155
-
Manual runs can produce multiple rule executions. This is determined by the manual run’s time range and the rule’s execution schedule.
156
-
::::
157
-
149
+
The rule will run over the time range that you selected. Note that all [rule actions](/solutions/security/detect-and-alert/create-detection-rule.md#rule-notifications) will also be activated, except for **Summary of alerts** actions that run at a custom frequency.
158
150
159
-
The manual run’s details are shown in the [Manual runs](/solutions/security/detect-and-alert/monitor-rule-executions.md#manual-runs-table)table on the **Execution results** tab. Changes you make to the manual run or rule settings will display in the Manual runs table after the current run completes.
151
+
Go to the [Manual runs table](/solutions/security/detect-and-alert/monitor-rule-executions.md#manual-runs-table) on the **Execution results** tab to track the manual rule executions. If you manually ran the rule over a gap, you can also monitor the gap fill's progress from the [Gaps table](/solutions/security/detect-and-alert/monitor-rule-executions.md#gaps-table).
160
152
161
153
::::{note}
162
154
Be mindful of the following:
163
155
164
-
*Rule actions are not activated during manual runs.
165
-
* Except for threshold rules, duplicate alerts aren’t created if you manually run a rule during a time range that was already covered by a scheduled run.
166
-
*Manual runs are executed with low priority and limited concurrency, meaning they might take longer to complete. This can be especially apparent for rules requiring multiple executions.
156
+
*Any changes that you make to the manual run or rule settings will display in the Manual runs table after the current run completes.
157
+
* Except for threshold rules, duplicate alerts aren't created if you manually run a rule during a time range that was already covered by a scheduled run.
158
+
*Manually running a custom query rule with suppression may incorrectly inflate the number of suppressed alerts.
167
159
168
160
::::
169
161
@@ -188,7 +180,7 @@ You can snooze rule notifications from the **Installed Rules** tab, the rule det
188
180
189
181
::::{admonition} Requirements
190
182
* You can export and import custom rules and prebuilt rules (modified and unmodified) with any [{{stack}} subscription](https://www.elastic.co/pricing) or [{{serverless-short}} project tier](../../../deploy-manage/deploy/elastic-cloud/project-settings.md).
191
-
*At minimum, your role needs `Read` privileges for the **Action and Connectors** feature to import rules with actions. To overwrite or add new connectors, you need `All` privileges. Refer to [Enable and access detections](/solutions/security/detect-and-alert/detections-requirements.md#enable-detections-ui) to learn more about the required privileges for managing rules.
183
+
* At minimum, your role needs `Read` privileges for the **Action and Connectors** feature to import rules with actions. To overwrite or add new connectors, you need `All` privileges. Refer to [Enable and access detections](/solutions/security/detect-and-alert/detections-requirements.md#enable-detections-ui) to learn more about the required privileges for managing rules.
192
184
::::
193
185
194
186
You can export custom detection rules to an `.ndjson` file, which you can then import into another {{elastic-sec}} environment.
Copy file name to clipboardExpand all lines: solutions/security/detect-and-alert/monitor-rule-executions.md
+63-19Lines changed: 63 additions & 19 deletions
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,7 @@ Refer to the [Troubleshoot missing alerts](../../../troubleshoot/security/detect
21
21
22
22
## Rule Monitoring tab [rule-monitoring-tab]
23
23
24
-
To view a summary of all rule executions, including the most recent failures and execution times, select the **Rule Monitoring** tab on the **Rules** page. To access the tab, find **Detection rules (SIEM)** in the navigation menu or look for “Detection rules (SIEM)” using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then go to the **Rule Monitoring** tab.
24
+
To view a summary of all rule executions (including the most recent failures, execution times, and gaps in rule executions), select the **Rule Monitoring** tab on the **Rules** page. To access the tab, find **Detection rules (SIEM)** in the navigation menu or look for “Detection rules (SIEM)” using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then go to the **Rule Monitoring** tab.
@@ -37,19 +37,28 @@ To sort the rules list, click any column header. To sort in descending order, cl
37
37
38
38
For detailed information on a rule, the alerts it generated, and associated errors, click on its name in the table. This also allows you to perform the same actions that are available on the [**Installed Rules** tab](manage-detection-rules.md), such as modifying or deleting rules, activating or deactivating rules, exporting or importing rules, and duplicating prebuilt rules.
39
39
40
+
For information about rule execution gaps (which are periods of time when a rule didn't run), use the panel above the table. The time filter on the left allows you to select a time range for viewing gap data. The **Total rules with gaps:** field tells you how many rules have unfilled or partially filled gaps within the selected time range. The **Only rules with gaps** filter on the right lets you only display rules with unfilled or partially filled gaps.
40
41
41
-
## Execution results [rule-execution-logs]
42
+
Within the table, the **Last Gap (if any)** column conveys how long the most recent gap for a rule lasted. The **Unfilled gaps duration** column shows whether a rule still has gaps and provides a total sum of the remaining unfilled or partially filled gaps. The total sum can change based on the time range that you select in the panel above the table. If a rule has no gaps, the columns display a dash (`––`).
42
43
43
-
Each detection rule execution is logged, including the execution type, the execution’s success or failure, any warning or error messages, how long it took to search for data, create alerts, and complete. This can help you troubleshoot a particular rule if it isn’t behaving as expected (for example, if it isn’t creating alerts or takes a long time to run).
44
+
::::{tip}
45
+
For a detailed view of a rule's gaps, go to the **Execution results** tab and check the [Gaps table](/solutions/security/detect-and-alert/monitor-rule-executions.md#gaps-table).
46
+
::::
47
+
48
+
## Execution results tab [rule-execution-logs]
49
+
50
+
From the **Execution results** tab, you can access the rule’s execution log, monitor and address gaps in a rule's execution schedule, and check manual runs for the rule. To find the tab, click the rule's name to open its details, then scroll down.
44
51
45
-
To access a rule’s execution log, click the rule’s name to open its details, then scroll down and select the **Execution results** tab. Within the Execution log table, you can click the arrow at the end of a row to expand a long warning or error message.
52
+
### Execution log table [execution-log-table]
53
+
54
+
Each detection rule execution is logged, including the execution type, the execution’s success or failure, any warning or error messages, how long it took to search for data, create alerts, and complete. This can help you troubleshoot a particular rule if it isn’t behaving as expected (for example, if it isn’t creating alerts or takes a long time to run).
:alt: Execution log table on the rule execution results tab
49
58
:screenshot:
50
59
:::
51
60
52
-
You can hover over each column heading to display a tooltip about that column’s data. Click a column heading to sort the table by that column.
61
+
You can hover over each column heading to display a tooltip about that column’s data. Click a column heading to sort the table by that column. Within the Execution log table, you can click the arrow at the end of a row to expand a long warning or error message.
53
62
54
63
Use these controls to filter what’s included in the logs table:
55
64
@@ -70,32 +79,67 @@ Use these controls to filter what’s included in the logs table:
70
79
* The **Actions** column allows you to show alerts generated from a given rule execution. Click the filter icon (![Filter icon](/solutions/images/security-filter-icon.png"title =20x20")) to create a global search filter based on the rule execution’s ID value. This replaces any previously applied filters, changes the global date and time range to 24 hours before and after the rule execution, and displays a confirmation notification. You can revert this action by clicking **Restore previous filters** in the notification.
71
80
72
81
73
-
### Manual runs table [manual-runs-table]
82
+
### Gaps table [gaps-table]
74
83
75
84
::::{warning}
76
85
This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.
77
86
::::
78
87
88
+
Gaps in rule executions are periods of time where a rule didn’t run. They can be caused by various disruptions, including system updates, rule failures, or simply turning off a rule. Addressing gaps is essential for maintaining consistent coverage and avoiding missed alerts.
79
89
80
-
Each manual run can produce multiple rule executions, depending on the time range of the run and the rule’s execution schedule. These details are shown in the Manual runs table.
81
-
82
-
To access the table, navigate to the detection rules page, click the rule’s name to open its details, then scroll down and select the **Execution results** tab. Scroll down again to find the Manual runs table.
90
+
::::{tip}
91
+
Refer to the [Troubleshoot gaps](../../../troubleshoot/security/detection-rules.md#troubleshoot-gaps) section for strategies for avoiding gaps.
92
+
::::
83
93
84
-
To stop an active run, go to the appropriate row and click **Stop run**in the **Actions** column. Completed rule executions for each manual run are logged in the Execution log table.
94
+
Use the information in the Gaps table to assess the scope and severity of rule execution gaps. To control what's shown in the table, you can filter the table by gap status, select a time range for viewing gap data, and sort multiple columns.
:alt: Gaps table on the rule execution results tab
88
98
:screenshot:
89
99
:::
90
100
91
-
The Manual runs table displays important details such as:
101
+
The Gaps table has the following columns:
102
+
103
+
***Status**: The current state of the gap. It can be `Filled`, `Partially filled`, or `Unfilled`.
104
+
***Detected at**: The date and time the gap was first discovered.
105
+
***Manual fill tasks**: The status of the manual run that’s filling the gap. For more details about the manual run, refer to its entry in the [Manual runs table](/solutions/security/detect-and-alert/monitor-rule-executions.md#manual-runs-table).
106
+
***Event time covered**: How much progress the manual run has made filling the gap.
107
+
108
+
::::{note}
109
+
If you stop a manual run that's hasn't finished filling a gap, the gap’s status will be set to `Partially filled`. To fill the remaining gap, you can select the **Fill remaining gap** action or [manually run](/solutions/security/detect-and-alert/manage-detection-rules.md#manually-run-rules) the rule over the gap's time frame.
110
+
::::
111
+
112
+
***Range**: When the gap started and ended.
113
+
***Total gap duration**: How long the gap lasted.
114
+
***Actions**: The actions that you can take for the gap. They can be **Fill gap** (starts a manual run to fill the gap) or **Fill remaining gap** (starts a manual run that fills the leftover portion of the gap).
115
+
116
+
117
+
### Manual runs table [manual-runs-table]
118
+
119
+
You can [manually run](/solutions/security/detect-and-alert/manage-detection-rules.md#manually-run-rules) enabled rules for a specified period of time to deliberately test them, provide additional rule coverage, or fill gaps in rule executions. Each manual run can produce multiple rule executions, depending on the time range of the run and the rule's execution schedule.
120
+
121
+
::::{note}
122
+
Manual runs are executed with low priority and limited concurrency, meaning they might take longer to complete. This can be especially apparent for rules requiring multiple executions.
123
+
::::
124
+
125
+
The Manual runs table tracks manual rule executions and provides important details such as:
126
+
127
+
* The total number of rule executions that the manual run will produce and how many are failing, pending, running, and completed.
128
+
* When the manual run started and the time range that it will cover.
129
+
130
+
::::{note}
131
+
To stop an active run, go to the appropriate row in the table and click **Stop run** in the **Actions** column. Completed rule executions for each manual run are logged in the Execution log table.
132
+
::::
92
133
93
134
* The status of each manual run:
94
135
95
-
***Pending**: The rule is not yet running.
96
-
***Running**: The rule is executing during the time range you specified. Some rules, such as indicator match rules, can take longer to run.
97
-
***Error**: The rule’s configuration is preventing it from running correctly. For example, the rule’s conditions cannot be validated.
136
+
*`Pending`: The rule is not yet running.
137
+
*`Running`: The rule is executing during the time range you specified. Some rule types, such as indicator match rules, can take longer to run.
138
+
*`Error`: The rule's configuration is preventing it from running correctly. For example, the rule's conditions cannot be validated.
0 commit comments