Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adjust CR Schedules and Lookbacks #1417

Merged
merged 2 commits into from
Nov 4, 2024
Merged

Adjust CR Schedules and Lookbacks #1417

merged 2 commits into from
Nov 4, 2024

Conversation

ben-githubs
Copy link
Contributor

Background

Correlation rules that run too frequently are very cost-ineffective. This PR defaults all managed CRs to running once per day and looking back over the past 36 hours (while respecting the relative time constraints between events using WithinTimeFrameMinutes.

Changes

  • adjusted all CR schedule RateMinutes to 1440 (24 hours)
  • adjusted all CR LookbackWindowMinutes to 2160 (36 hours) to allow for log latency
  • added WithinTimeFrameMinutes to transitions to preserve the original lookback window

Testing

  • make test
  • pat validate

@ben-githubs ben-githubs requested a review from a team as a code owner November 1, 2024 15:44
@arielkr256 arielkr256 added tuning detection tuning correlation_rules Correlation rules establish correlations across logs, identify anomalies, and model complex attack b labels Nov 4, 2024
arielkr256
arielkr256 approved these changes Nov 4, 2024
View reviewed changes
Copy link
Contributor

@arielkr256 arielkr256 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@arielkr256 arielkr256 enabled auto-merge (squash) November 4, 2024 16:15
@arielkr256 arielkr256 merged commit 18e11fd into develop Nov 4, 2024
8 checks passed
@arielkr256 arielkr256 deleted the THREAT-379/review-cr-schedule-and-lookback-intervals branch November 4, 2024 16:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@arielkr256 arielkr256 arielkr256 approved these changes

Assignees
No one assigned
Labels
correlation_rules Correlation rules establish correlations across logs, identify anomalies, and model complex attack b tuning detection tuning
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@ben-githubs @arielkr256