Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] [Detections] Combine multiple timestamp searches into single request #96078

Merged
merged 13 commits into from
Apr 20, 2021
Merged

[Security Solution] [Detections] Combine multiple timestamp searches into single request #96078

merged 13 commits into from
Apr 20, 2021

Commits on Apr 20, 2021

  1. merge multiple timestamp queries into one single search

    @dhurley14
    dhurley14 committed Apr 20, 2021
    Configuration menu
    Copy the full SHA
    7f557ae View commit details
    Browse the repository at this point in the history

  2. fix types and unit tests

    @dhurley14
    dhurley14 committed Apr 20, 2021
    Configuration menu
    Copy the full SHA
    bf50a37 View commit details
    Browse the repository at this point in the history

  3. remove unused code for sending secondary search

    @dhurley14
    dhurley14 committed Apr 20, 2021
    Configuration menu
    Copy the full SHA
    bd7252c View commit details
    Browse the repository at this point in the history

  4. removes unused excludeDocsWithTimestampOverride

    @dhurley14
    dhurley14 committed Apr 20, 2021
    Configuration menu
    Copy the full SHA
    b52d1db View commit details
    Browse the repository at this point in the history

  5. adds integration tests to cover cases that should / should not genera… 

    …te signals when timestamp override is present in rule
    @dhurley14
    dhurley14 committed Apr 20, 2021
    Configuration menu
    Copy the full SHA
    1ff5050 View commit details
    Browse the repository at this point in the history

  6. adds integration test to ensure unmapped sort fields do not break sea… 

    …rch after functionality of detection rules
    @dhurley14
    dhurley14 committed Apr 20, 2021
    Configuration menu
    Copy the full SHA
    a4de3be View commit details
    Browse the repository at this point in the history

  7. Need to figure out why moving the tests around fixed them...

    @dhurley14
    dhurley14 committed Apr 20, 2021
    Configuration menu
    Copy the full SHA
    3567909 View commit details
    Browse the repository at this point in the history

  8. updates tests with new es archive data and fixes bug where exclusion … 

    …filter was hardcoded to event.ingested :yikes:
    @dhurley14
    dhurley14 committed Apr 20, 2021
    Configuration menu
    Copy the full SHA
    cc5269b View commit details
    Browse the repository at this point in the history

  9. remove dead commented out code

    @dhurley14
    dhurley14 committed Apr 20, 2021
    Configuration menu
    Copy the full SHA
    8aad3e1 View commit details
    Browse the repository at this point in the history

  10. fixes typo in test file, removes redundant delete signals call in int… 

    …egration test, fixes logic for possibility of receving a null value in sort ids, removes unused utility function for checking valid sort ids
    @dhurley14
    dhurley14 committed Apr 20, 2021
    Configuration menu
    Copy the full SHA
    d29c16f View commit details
    Browse the repository at this point in the history

  11. a unit test for checking if an empty string of a sort id is present w… 

    …as failing because we moved the logic for checking that out of the build search query function and up into the big loop. So I moved that unit test into the search after bulk create test file.
    @dhurley14
    dhurley14 committed Apr 20, 2021
    Configuration menu
    Copy the full SHA
    b3d932a View commit details
    Browse the repository at this point in the history

  12. fix types

    @dhurley14
    dhurley14 committed Apr 20, 2021
    Configuration menu
    Copy the full SHA
    40b9b27 View commit details
    Browse the repository at this point in the history

  13. removes isEmpty since it doesn't check for empty strings

    @dhurley14
    dhurley14 committed Apr 20, 2021
    Configuration menu
    Copy the full SHA
    d155fed View commit details
    Browse the repository at this point in the history