Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Detection Engine][ES|QL] - ES|QL support for partial results #211622

Open
2 tasks
yctercero opened this issue Feb 18, 2025 · 2 comments
Open
2 tasks

[Detection Engine][ES|QL] - ES|QL support for partial results #211622

yctercero opened this issue Feb 18, 2025 · 2 comments
Labels
Feature: ES|QL Rule Team:Detection Engine Security Solution Detection Engine Area Team:Detections and Resp Security Detection Response Team v8.19.0 v9.1.0

Comments

@yctercero
Copy link
Contributor

Summary

ES|QL will support partial results by default in 8.19/9.1. We need to ensure that we are dealing with these changes appropriately.

Requirements

  • Rule shows as partial failure if there are partial results, rule error clearly communicates partial results and what shards were not searched.
  • Test for possible false positive scenarios with ES|QL. For EQL, it was clear that we cannot support partial results for sequence queries, it's not as clear with ES|QL.
@yctercero yctercero added Feature: ES|QL Rule Team:Detection Engine Security Solution Detection Engine Area Team:Detections and Resp Security Detection Response Team v8.19.0 v9.1.0 labels Feb 18, 2025
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-engine (Team:Detection Engine)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature: ES|QL Rule Team:Detection Engine Security Solution Detection Engine Area Team:Detections and Resp Security Detection Response Team v8.19.0 v9.1.0
Projects
None yet
Development

No branches or pull requests

2 participants