You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/detections/rules-ui-manage.asciidoc
+7-6Lines changed: 7 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -111,7 +111,7 @@ NOTE: When duplicating a rule with exceptions, you can choose to duplicate the r
111
111
112
112
beta::[]
113
113
114
-
Manually run enabled rules for a specified period of time for testing purposes or additional rule coverage.
114
+
Manually run enabled rules for a specified period of time to deliberately test them or provide additional rule coverage.
115
115
116
116
IMPORTANT: Before manually running rules, make sure you properly understand and plan for rule dependencies. Incorrect scheduling can lead to inconsistent rule results.
117
117
@@ -121,20 +121,21 @@ IMPORTANT: Before manually running rules, make sure you properly understand and
121
121
* Select all the rules you want to manually run, select the **Bulk actions** menu, then select **Manual run**.
122
122
. Specify when the manual run starts and ends. The default selection is the current day starting three hours in the past. The rule will search for events during the selected time range.
123
123
. Click **Run** to manually run the rule.
124
-
+
125
-
NOTE: Manual runs can produce multiple rule executions. This is determined by the manual run's time range and the rule's execution schedule.
126
124
127
-
The manual run's details are shown in the <<manual-runs-table,Manual runs>> table on the *Execution results* tab. Changes you make to the manual run or rule settings will display in the Manual runs table after the current run completes.
125
+
The rule will run over the time range that you selected. Go to the <<manual-runs-table>> on the **Execution results** tabto track the manual rule executions.
128
126
129
127
[NOTE]
130
128
=====
131
129
Be mindful of the following:
132
130
133
-
* Rule actions are not activated during manual runs.
131
+
* <<rule-notifications,Rule actions>> are not activated during the manual runs.
132
+
* Any changes that you make to the manual run or rule settings will display in the Manual runs table after the current run completes.
134
133
* Except for threshold rules, duplicate alerts aren't created if you manually run a rule during a time range that was already covered by a scheduled run.
135
-
* Manual runs are executed with low priority and limited concurrency, meaning they might take longer to complete. This can be especially apparent for rules requiring multiple executions.
134
+
* Manually running a custom query rule with suppression may incorrectly inflate the number of suppressed alerts.
Copy file name to clipboardExpand all lines: docs/detections/rules-ui-monitor.asciidoc
+14-15Lines changed: 14 additions & 15 deletions
Original file line number
Diff line number
Diff line change
@@ -62,35 +62,34 @@ Use these controls to filter what's included in the logs table:
62
62
63
63
* The *Show metrics columns* toggle includes more or less data in the table, pertaining to the timing of each rule execution.
64
64
65
-
* The *Actions* column allows you to show alerts generated from a given rule execution. Click the filter icon (image:images/filter-icon.png[Filter icon,18,17]) to create a global search filter based on the rule execution's ID value. This replaces any previously applied filters, changes the global date and time range to 24 hours before and after the rule execution, and displays a confirmation notification. You can revert this action by clicking *Restore previous filters* in the notification.
66
65
67
66
[float]
68
67
[[manual-runs-table]]
69
68
==== Manual runs table
70
69
71
70
beta::[]
72
71
73
-
Each manual run can produce multiple rule executions, depending on the time range of the run and the rule's execution schedule. These details are shown in the Manual runs table.
72
+
You can <<manually-run-rules,manually run>> enabled rules for a specified period of time to deliberately test them or provide additional rule coverage. Each manual run can produce multiple rule executions, depending on the time range of the run and the rule's execution schedule.
74
73
75
-
To access the table, navigate to the detection rules page, click the rule's name to open its details, then scroll down and select the **Execution results** tab. Scroll down again to find the Manual runs table.
74
+
NOTE: Manual runs are given lower priority and limited concurrency, meaning they might take longer to complete. This can be especially apparent for rules requiring multiple executions.
76
75
77
-
To stop an active run, go to the appropriate row and click **Stop run** in the **Actions** column. Completed rule executions for each manual run are logged in the Execution log table.
76
+
The Manual runs table tracks manual rule executions. To access the table, navigate to the detection rules page, click the rule's name to open its details, then scroll down and select the **Execution results** tab. Scroll down again to find the Manual runs table.
78
77
79
-
[role="screenshot"]
80
-
image::images/manual-rule-run-table.png[Manual rule runs table on the rule execution results tab]
81
-
82
-
The Manual runs table displays important details such as:
78
+
The Manual runs table provides important details such as:
83
79
80
+
* The total number of rule executions that the manual run will produce and how many are failing, pending, running, and completed.
81
+
* When the manual run started and the time range that it will cover.
82
+
+
83
+
NOTE: To stop an active run, go to the appropriate row in the table and click **Stop run** in the **Actions** column. Completed rule executions for each manual run are logged in the Execution log table.
84
+
+
84
85
* The status of each manual run:
85
-
** **Pending**: The rule is not yet running.
86
-
** **Running**: The rule is executing during the time range you specified. Some rules, such as indicator match rules, can take longer to run.
87
-
** **Error**: The rule's configuration is preventing it from running correctly. For example, the rule's conditions cannot be validated.
86
+
** `Pending`: The rule is not yet running.
87
+
** `Running`: The rule is running during the time range you specified. Some rule types, such as indicator match rules, can take longer to run.
88
+
** `Error`: The rule's configuration is preventing it from running correctly. For example, the rule's conditions cannot be validated.
88
89
89
-
* When a manual run started and the time in which it will run
90
-
91
-
* The number of rule executions that are failing, pending, running, and completed for a manual run
90
+
[role="screenshot"]
91
+
image::images/manual-rule-run-table.png[Manual rule runs table on the rule execution results tab]
92
92
93
-
* The total number of rule executions that are occurring for a manual run
0 commit comments