elastic / elastic/docs-content

Add details around rule execution expectations when performing upgrades to `Upgrade Elastic Security` docs

Open
#7,839 3 comments 1 reaction 0 assignees View on GitHub
documentation enhancement Team:SKI
Dominant language
No language data
Stars
47
Forks
261
Avg merge
3d 12h
Merged PRs (30d)
116

Description

## Description

This docs issue is for adding a section to the [Upgrade Elastic Security docs](https://www.elastic.co/guide/en/security/current/upgrade-intro.html) that details the expected behaviors of rule execution during the downtime that may occur during an upgrade. This is with regards to managing gaps and missed alerts from downtime.

Currently, as detailed in https://github.com/elastic/kibana/pull/68339, the system is setup to remediate gaps in rule execution by performing up to a 4x lookback of the rule's configured interval. So if the deployment has rules configured to run every 10 minutes, and there was 30min of downtime for the upgrade, the rules will 'self recover' and ensure there was no gap during the upgrade. However if there were 45min of downtime, this could result in ~5min window of gaps for the rules, and the user will have to manually resolve by increasing the lookback to cover there period of time (perhaps some crossover with the [managing gaps docs](https://www.elastic.co/guide/en/security/8.6/alerts-ui-monitor.html#troubleshoot-gaps))

## Acceptance Test Criteria

As a user I should be able to understand what happens to enabled and executing rules during an upgrade, and if there should be any concern for missed alerts and how I would go about remediating any gaps that may have occurred during the upgrade.

## Notes

Please see the above issue or ping the @elastic/security-detections-response-alerts folks for the most up-to-date information here.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.