Test notifications on rule timeout (revert this)

elastic · Mar 22, 2022 · 0c49fc4 · 0c49fc4
1 parent dc4d64b
commit 0c49fc4
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/...rity_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts b/...rity_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts
@@ -50,6 +50,7 @@ export const createSecurityRuleTypeWrapper: CreateSecurityRuleTypeWrapper =
     const persistenceRuleType = createPersistenceRuleTypeWrapper({ ruleDataClient, logger });
     return persistenceRuleType({
       ...type,
+      ruleTaskTimeout: '10s',
       cancelAlertsOnRuleTimeout: false,
       useSavedObjectReferences: {
         extractReferences: (params) => extractReferences({ logger, params }),

diff --git a/...plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts b/...plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts
@@ -70,6 +70,17 @@ export const searchAfterAndBulkCreate = async ({
         if (hasSortId) {
           const { searchResult, searchDuration, searchErrors } = await singleSearchAfter({
             buildRuleMessage,
+            // time out after 2 signals created
+            aggregations:
+              signalsCreatedCount > 0
+                ? {
+                    delay: {
+                      shard_delay: {
+                        value: '30s',
+                      },
+                    },
+                  }
+                : {},
             searchAfterSortIds: sortIds,
             index: inputIndexPattern,
             from: tuple.from.toISOString(),
@@ -78,7 +89,8 @@ export const searchAfterAndBulkCreate = async ({
             logger,
             // @ts-expect-error please, declare a type explicitly instead of unknown
             filter,
-            pageSize: Math.ceil(Math.min(tuple.maxSignals, pageSize)),
+            // pageSize: Math.ceil(Math.min(tuple.maxSignals, pageSize)),
+            pageSize: 2,
             timestampOverride: ruleParams.timestampOverride,
             trackTotalHits,
             sortOrder,