Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution][SIEM migrations] Add timeouts and surface execution errors #212799

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

semd
Copy link
Contributor

@semd semd commented Feb 28, 2025

Summary

Implements controls to have more visibility over the errors, especially in the initialization phase (populate ELSER indices)

Changes

  • Added timeout to the initialization phase (20 minutes).
  • Added concurrency control for initialization tasks, only the first concurrent migration will trigger it, and the rest will await it.
  • Added proper error handling for the ES bulk index operations of integrations and prebuilt rules ELSER indices.
  • Added timeout for individual agent invocations (3 minutes)
  • Added migrationsLastError server state to store the errors (not ideal, this should be moved to the migration index when we implement it) for now it's fine.
  • Added the last_error in the /stats API response.
  • The UI displays the last_error if it's defined.

Screenshots

Onboarding error:
error_onboarding

Rules page error:
error_rules_page

@semd semd added release_note:skip Skip the PR/issue when compiling release notes v9.0.0 Team:Threat Hunting Security Solution Threat Hunting Team backport:version Backport to applied version labels v8.18.0 v9.1.0 v8.19.0 labels Feb 28, 2025
@semd semd self-assigned this Feb 28, 2025
@elasticmachine
Copy link
Contributor

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

  • Click to trigger kibana-pull-request for this PR!
  • Click to trigger kibana-deploy-project-from-pr for this PR!
  • Click to trigger kibana-deploy-cloud-from-pr for this PR!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport:version Backport to applied version labels release_note:skip Skip the PR/issue when compiling release notes Team:Threat Hunting Security Solution Threat Hunting Team v8.18.0 v8.19.0 v9.0.0 v9.1.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants