-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Open
Labels
ArchitectureRequires an architecture change/reviewRequires an architecture change/reviewEnhancementNew feature or requestNew feature or requestInfrastructureInfrastructure related issuesInfrastructure related issues
Description
** Current architecture/design **
Currently, there is a lot of logic around alerts including:
- deduplication (
alert_deduplicator/) - enrichment (
enrich_alertindb.py) - mapping and extraction (
EnrichBlunderbl) - search engine (
search_alerts/) - rules engine (
rule_engine/)
** Why is this change needed? **
- It is hard to understand all the changes/logic that touch alerts
- No clear guidelines how to do things (e.g. some cases use direct access to db, some have wrapper around it)
** Expected behavior **
- All logic sits under
engine/folder. - No direct operations on alerts directly on
db
Metadata
Metadata
Assignees
Labels
ArchitectureRequires an architecture change/reviewRequires an architecture change/reviewEnhancementNew feature or requestNew feature or requestInfrastructureInfrastructure related issuesInfrastructure related issues