[Security Solution][Detection Engine] Split search request building from search#216887
Merged
marshallmain merged 10 commits intoelastic:mainfrom Apr 15, 2025
Merged
[Security Solution][Detection Engine] Split search request building from search#216887marshallmain merged 10 commits intoelastic:mainfrom
marshallmain merged 10 commits intoelastic:mainfrom
Conversation
marshallmain
added
release_note:skip
Contributor
|
Pinging @elastic/security-detection-engine (Team:Detection Engine) |
Contributor
💚 Build Succeeded
Metrics [docs]Unknown metric groupsESLint disabled line counts
Total ESLint disabled count
History
|
vitaliidm
approved these changes
Apr 15, 2025
Contributor
|
Starting backport for target branches: 8.x https://github.com/elastic/kibana/actions/runs/14469229860 |
Contributor
💔 All backports failed
Manual backportTo create the backport manually run: Questions ?Please refer to the Backport tool documentation |
Contributor
Author
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
1 task
marshallmain
added a commit
that referenced
this pull request
Apr 16, 2025
…ding from search (#216887) (#218262) # Backport This will backport the following commits from `main` to `8.x`: - [[Security Solution][Detection Engine] Split search request building from search (#216887)](#216887) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Marshall Main","email":"55718608+marshallmain@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-04-15T12:19:34Z","message":"[Security Solution][Detection Engine] Split search request building from search (#216887)\n\n## Summary\n\nThis PR better separates the request building logic in the detection\nengine from query building logic, removes outdated error checking logic,\nupdates the `singleSearchAfter` `search` call to no longer use the\nlegacy `meta: true` param, and improves search response type inference.","sha":"dee4dfbe5995614b82792b692775c150dc79635e","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Detection Engine","backport:version","v9.1.0","v8.19.0"],"title":"[Security Solution][Detection Engine] Split search request building from search","number":216887,"url":"https://github.com/elastic/kibana/pull/216887","mergeCommit":{"message":"[Security Solution][Detection Engine] Split search request building from search (#216887)\n\n## Summary\n\nThis PR better separates the request building logic in the detection\nengine from query building logic, removes outdated error checking logic,\nupdates the `singleSearchAfter` `search` call to no longer use the\nlegacy `meta: true` param, and improves search response type inference.","sha":"dee4dfbe5995614b82792b692775c150dc79635e"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/216887","number":216887,"mergeCommit":{"message":"[Security Solution][Detection Engine] Split search request building from search (#216887)\n\n## Summary\n\nThis PR better separates the request building logic in the detection\nengine from query building logic, removes outdated error checking logic,\nupdates the `singleSearchAfter` `search` call to no longer use the\nlegacy `meta: true` param, and improves search response type inference.","sha":"dee4dfbe5995614b82792b692775c150dc79635e"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT-->
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Oct 29, 2025
…o group by fields defined (elastic#241022) Fixes a regression in threshold rule logic introduced by elastic#216887 - threshold rules with no "group by" fields defined would no longer generate alerts. (cherry picked from commit fce9007)
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Oct 29, 2025
…o group by fields defined (elastic#241022) Fixes a regression in threshold rule logic introduced by elastic#216887 - threshold rules with no "group by" fields defined would no longer generate alerts. (cherry picked from commit fce9007)
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Oct 29, 2025
…o group by fields defined (elastic#241022) Fixes a regression in threshold rule logic introduced by elastic#216887 - threshold rules with no "group by" fields defined would no longer generate alerts. (cherry picked from commit fce9007)
tkajtoch
pushed a commit
to tkajtoch/kibana
that referenced
this pull request
Oct 29, 2025
…o group by fields defined (elastic#241022) Fixes a regression in threshold rule logic introduced by elastic#216887 - threshold rules with no "group by" fields defined would no longer generate alerts.
kibanamachine
added a commit
that referenced
this pull request
Oct 29, 2025
…with no group by fields defined (#241022) (#241123) # Backport This will backport the following commits from `main` to `9.1`: - [[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined (#241022)](#241022) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Marshall Main","email":"55718608+marshallmain@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-10-29T12:18:27Z","message":"[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined (#241022)\n\nFixes a regression in threshold rule logic introduced by\nhttps://github.com//pull/216887 - threshold rules with no\n\"group by\" fields defined would no longer generate alerts.","sha":"fce90071cc1be29b9874d8dc147e6ea0ca8a513b","branchLabelMapping":{"^v9.3.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team: SecuritySolution","Team:Detection Engine","backport:version","v8.19.5","v9.1.5","v9.3.0","v9.2.1"],"title":"[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined","number":241022,"url":"https://github.com/elastic/kibana/pull/241022","mergeCommit":{"message":"[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined (#241022)\n\nFixes a regression in threshold rule logic introduced by\nhttps://github.com//pull/216887 - threshold rules with no\n\"group by\" fields defined would no longer generate alerts.","sha":"fce90071cc1be29b9874d8dc147e6ea0ca8a513b"}},"sourceBranch":"main","suggestedTargetBranches":["8.19","9.1","9.2"],"targetPullRequestStates":[{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.3.0","branchLabelMappingKey":"^v9.3.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/241022","number":241022,"mergeCommit":{"message":"[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined (#241022)\n\nFixes a regression in threshold rule logic introduced by\nhttps://github.com//pull/216887 - threshold rules with no\n\"group by\" fields defined would no longer generate alerts.","sha":"fce90071cc1be29b9874d8dc147e6ea0ca8a513b"}},{"branch":"9.2","label":"v9.2.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Marshall Main <55718608+marshallmain@users.noreply.github.com>
kibanamachine
added a commit
that referenced
this pull request
Oct 29, 2025
… with no group by fields defined (#241022) (#241122) # Backport This will backport the following commits from `main` to `8.19`: - [[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined (#241022)](#241022) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Marshall Main","email":"55718608+marshallmain@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-10-29T12:18:27Z","message":"[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined (#241022)\n\nFixes a regression in threshold rule logic introduced by\nhttps://github.com//pull/216887 - threshold rules with no\n\"group by\" fields defined would no longer generate alerts.","sha":"fce90071cc1be29b9874d8dc147e6ea0ca8a513b","branchLabelMapping":{"^v9.3.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team: SecuritySolution","Team:Detection Engine","backport:version","v8.19.5","v9.1.5","v9.3.0","v9.2.1"],"title":"[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined","number":241022,"url":"https://github.com/elastic/kibana/pull/241022","mergeCommit":{"message":"[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined (#241022)\n\nFixes a regression in threshold rule logic introduced by\nhttps://github.com//pull/216887 - threshold rules with no\n\"group by\" fields defined would no longer generate alerts.","sha":"fce90071cc1be29b9874d8dc147e6ea0ca8a513b"}},"sourceBranch":"main","suggestedTargetBranches":["8.19","9.1","9.2"],"targetPullRequestStates":[{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.3.0","branchLabelMappingKey":"^v9.3.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/241022","number":241022,"mergeCommit":{"message":"[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined (#241022)\n\nFixes a regression in threshold rule logic introduced by\nhttps://github.com//pull/216887 - threshold rules with no\n\"group by\" fields defined would no longer generate alerts.","sha":"fce90071cc1be29b9874d8dc147e6ea0ca8a513b"}},{"branch":"9.2","label":"v9.2.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Marshall Main <55718608+marshallmain@users.noreply.github.com>
kibanamachine
added a commit
that referenced
this pull request
Oct 29, 2025
…with no group by fields defined (#241022) (#241125) # Backport This will backport the following commits from `main` to `9.2`: - [[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined (#241022)](#241022) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Marshall Main","email":"55718608+marshallmain@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-10-29T12:18:27Z","message":"[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined (#241022)\n\nFixes a regression in threshold rule logic introduced by\nhttps://github.com//pull/216887 - threshold rules with no\n\"group by\" fields defined would no longer generate alerts.","sha":"fce90071cc1be29b9874d8dc147e6ea0ca8a513b","branchLabelMapping":{"^v9.3.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team: SecuritySolution","Team:Detection Engine","backport:version","v8.19.5","v9.1.5","v9.3.0","v9.2.1"],"title":"[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined","number":241022,"url":"https://github.com/elastic/kibana/pull/241022","mergeCommit":{"message":"[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined (#241022)\n\nFixes a regression in threshold rule logic introduced by\nhttps://github.com//pull/216887 - threshold rules with no\n\"group by\" fields defined would no longer generate alerts.","sha":"fce90071cc1be29b9874d8dc147e6ea0ca8a513b"}},"sourceBranch":"main","suggestedTargetBranches":["8.19","9.1","9.2"],"targetPullRequestStates":[{"branch":"8.19","label":"v8.19.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.3.0","branchLabelMappingKey":"^v9.3.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/241022","number":241022,"mergeCommit":{"message":"[Security Solution][Detection Engine] Fix threshold rule logic with no group by fields defined (#241022)\n\nFixes a regression in threshold rule logic introduced by\nhttps://github.com//pull/216887 - threshold rules with no\n\"group by\" fields defined would no longer generate alerts.","sha":"fce90071cc1be29b9874d8dc147e6ea0ca8a513b"}},{"branch":"9.2","label":"v9.2.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Marshall Main <55718608+marshallmain@users.noreply.github.com>
qn895
pushed a commit
to qn895/kibana
that referenced
this pull request
Oct 30, 2025
…o group by fields defined (elastic#241022) Fixes a regression in threshold rule logic introduced by elastic#216887 - threshold rules with no "group by" fields defined would no longer generate alerts.
ana-davydova
pushed a commit
to ana-davydova/kibana
that referenced
this pull request
Nov 3, 2025
…o group by fields defined (elastic#241022) Fixes a regression in threshold rule logic introduced by elastic#216887 - threshold rules with no "group by" fields defined would no longer generate alerts.
albertoblaz
pushed a commit
to albertoblaz/kibana
that referenced
this pull request
Nov 4, 2025
…o group by fields defined (elastic#241022) Fixes a regression in threshold rule logic introduced by elastic#216887 - threshold rules with no "group by" fields defined would no longer generate alerts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR better separates the request building logic in the detection engine from query building logic, removes outdated error checking logic, updates the
singleSearchAftersearchcall to no longer use the legacymeta: trueparam, and improves search response type inference.