elastic / elastic/support-diagnostics
Enable Kibana Diagnostic to be Space Aware for Rules
- Dominant language
- Java
- Stars
- 304
- Forks
- 175
- PR merge metrics
- No merged PRs in 30d
Description
Consolidating parallel conversations in this repository (https://github.com/elastic/support-diagnostics/issues/479, https://github.com/elastic/support-diagnostics/pull/514, https://github.com/elastic/support-diagnostics/issues/512, https://github.com/elastic/kibana/issues/124382). The Kibana diagnostic is not currently space aware though Kibana (SIEM) Rules have been space delineated since at least 7.10.
This implicates that the Kibana diagnostic only captures (SIEM) Rule info from `space:default` & misses any/all other spaces. (You can determine this from an export because the [Task Manager Health API](https://www.elastic.co/guide/en/kibana/current/task-manager-health-monitoring.html) will have scheduled Rule counts surpassing your exported Rule counts.)
SIEM appears more highly impacted because industry Security practices frequently suggest avoiding allocating users to a product's default space rather than purposely creating a new non-default space for them.
Example here: https://github.com/elastic/support-diagnostics/pull/514#issuecomment-1027404877.
cc: @pmuellr @pickypg @CamiloSierraH @111andre111 @mikecote
Contributor guide
Assessment
This issue has not been assessed yet.