Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Threshold rule less than or checking when count is 0 #3617

Open
kulbozz opened this issue Apr 23, 2024 · 0 comments
Open

Threshold rule less than or checking when count is 0 #3617

kulbozz opened this issue Apr 23, 2024 · 0 comments
Assignees
Labels

Comments

@kulbozz
Copy link

kulbozz commented Apr 23, 2024

Is your feature request related to a problem? Please describe.
Problem statement: monitor for a condition with less than operator, supporting 0.

Describe the solution you'd like
I'm trying to implement a rule for monitoring when a rule hasn't has any alerts in X time period. Threshold rule only supports greater than and trying in ESQL counting also doesn't not count unless a value is present.

Describe alternatives you've considered
Here's an example in ESQL counting the number of building block alerts:

from .alerts-security.alerts
| where kibana.alert.building_block_type == "default"
| stats alert_count = count(*) by kibana.alert.rule.name
| where alert_count == 0

I want to know if a building block rule has 0 alerts in the last 1 week.

@kulbozz kulbozz added the enhancement New feature or request label Apr 23, 2024
@w0rk3r w0rk3r self-assigned this May 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants