Skip to content

Comments

Remove Detection Rule telemetry from Security Solution (8.0+)#119047

Closed
pjhampton wants to merge 6 commits intomainfrom
pjhampton/drule-fix
Closed

Remove Detection Rule telemetry from Security Solution (8.0+)#119047
pjhampton wants to merge 6 commits intomainfrom
pjhampton/drule-fix

Conversation

@pjhampton
Copy link
Contributor

Summary

I have opened this pull request for discussion.

From some internal wrangling, It seems based on RAC changes that Detection Rule telemetry is bust 8.0+.
After chatting with @stevewritescode we are making the case for removing it completely for these releases - this is because we have found there was been little to no interaction with the data from 7.13 (April 2020).

Related PRs:

There is a cross-team discussion as to the data we want to collect from 8.2 and index it in a way that is useful for technical and non-technical stakeholders.

For maintainers

@pjhampton pjhampton added bug Fixes for quality problems that affect the customer experience Feature:Telemetry v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. auto-backport Deprecated - use backport:version if exact versions are needed v8.1.0 labels Nov 18, 2021
@pjhampton pjhampton requested a review from a team as a code owner November 18, 2021 15:44
@pjhampton pjhampton self-assigned this Nov 18, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@pjhampton pjhampton requested review from a team as code owners November 18, 2021 15:52
@pjhampton pjhampton requested a review from donaherc November 18, 2021 15:52
@pjhampton
Copy link
Contributor Author

@elasticmachine merge upstream

@rylnd
Copy link
Contributor

rylnd commented Nov 19, 2021

we have found there was been little to no interaction with the data from 7.13

@pjhampton can you expound on this a bit? Is there an expected vs. actual level of interaction?

@pjhampton
Copy link
Contributor Author

Thanks, @rylnd. I have replied to you offline.
If you are aware of the use of this data from other teams please point me in their direction.

@pjhampton
Copy link
Contributor Author

@elasticmachine merge upstream

@kibana-ci
Copy link

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @pjhampton

@rylnd
Copy link
Contributor

rylnd commented Nov 30, 2021

@pjhampton we are tracking the broken telemetry as part of https://github.com/elastic/security-team/issues/1018#issuecomment-937323352 and will have it fixed as part of 8.0. As discussed offline, we expect that the downstream ingest process will be update to make this data more usable moving forward.

@pjhampton
Copy link
Contributor Author

@rylnd Sounds good. We have this planned on our end for 8.1 FF.
Closing. Thanks, everyone!

@pjhampton pjhampton closed this Dec 1, 2021
@spalger spalger deleted the pjhampton/drule-fix branch May 8, 2022 22:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auto-backport Deprecated - use backport:version if exact versions are needed bug Fixes for quality problems that affect the customer experience Feature:Telemetry release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.0.0 v8.1.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants