opensearch-project / opensearch-project/security-analytics
[FEATURE] Security Analytics: Inlcude findings as ctx.results
@eirsep is already working on this.
Since May 1, 2024.
- Dominant language
- Java
- Stars
- 111
- Forks
- 111
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 13
Description
Is your feature request related to a problem?
ctx.results is present in alerts but always empty. Enriching detector alerts with details from findings is not possible.
What solution would you like?
In Alerting ctx.results is populated and can be used. Including findings as ctx.results in Security Analytics would be consistent with the behaviour in Alerting. Also, including details from the findings via ctx.results in the trigger message would greatly improve alerting workflows.
What alternatives have you considered?
I do not see an alternative, since the information is currently just not available.
Do you have any additional context?
I am referring to the feature set of OpenSearch 2.10 using notification messages in alert trigger in the Security Analytics plugin.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.