elastic / elastic/support-diagnostics

Enable Kibana Diagnostic to be Space Aware for Rules

Open
#578 15 comments 0 reactions 0 assignees View on GitHub
diagnostic
Dominant language
Java
Stars
304
Forks
175
PR merge metrics
No merged PRs in 30d

Description

Consolidating parallel conversations in this repository (https://github.com/elastic/support-diagnostics/issues/479, https://github.com/elastic/support-diagnostics/pull/514, https://github.com/elastic/support-diagnostics/issues/512, https://github.com/elastic/kibana/issues/124382). The Kibana diagnostic is not currently space aware though Kibana (SIEM) Rules have been space delineated since at least 7.10.

This implicates that the Kibana diagnostic only captures (SIEM) Rule info from `space:default` & misses any/all other spaces. (You can determine this from an export because the [Task Manager Health API](https://www.elastic.co/guide/en/kibana/current/task-manager-health-monitoring.html) will have scheduled Rule counts surpassing your exported Rule counts.)

SIEM appears more highly impacted because industry Security practices frequently suggest avoiding allocating users to a product's default space rather than purposely creating a new non-default space for them.

Example here: https://github.com/elastic/support-diagnostics/pull/514#issuecomment-1027404877.

cc: @pmuellr @pickypg @CamiloSierraH @111andre111 @mikecote

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.