Skip to content

Commit ea8736f

Browse files
Updates manual run docs (#6800) (#6812)
* First draft * Re-adds the beta tag * update screenshot * Update docs/detections/rules-ui-monitor.asciidoc * Update docs/detections/rules-ui-monitor.asciidoc Co-authored-by: Janeen Mikell Roberts <[email protected]> * consistency --------- Co-authored-by: Janeen Mikell Roberts <[email protected]> (cherry picked from commit a5d83de) Co-authored-by: Nastasha Solomon <[email protected]>
1 parent 1e7e765 commit ea8736f

File tree

3 files changed

+21
-21
lines changed

3 files changed

+21
-21
lines changed
-1.84 KB
Loading

docs/detections/rules-ui-manage.asciidoc

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ NOTE: When duplicating a rule with exceptions, you can choose to duplicate the r
111111

112112
beta::[]
113113

114-
Manually run enabled rules for a specified period of time for testing purposes or additional rule coverage.
114+
Manually run enabled rules for a specified period of time to deliberately test them or provide additional rule coverage.
115115

116116
IMPORTANT: Before manually running rules, make sure you properly understand and plan for rule dependencies. Incorrect scheduling can lead to inconsistent rule results.
117117

@@ -121,20 +121,21 @@ IMPORTANT: Before manually running rules, make sure you properly understand and
121121
* Select all the rules you want to manually run, select the **Bulk actions** menu, then select **Manual run**.
122122
. Specify when the manual run starts and ends. The default selection is the current day starting three hours in the past. The rule will search for events during the selected time range.
123123
. Click **Run** to manually run the rule.
124-
+
125-
NOTE: Manual runs can produce multiple rule executions. This is determined by the manual run's time range and the rule's execution schedule.
126124

127-
The manual run's details are shown in the <<manual-runs-table,Manual runs>> table on the *Execution results* tab. Changes you make to the manual run or rule settings will display in the Manual runs table after the current run completes.
125+
The rule will run over the time range that you selected. Go to the <<manual-runs-table>> on the **Execution results** tab to track the manual rule executions.
128126

129127
[NOTE]
130128
=====
131129
Be mindful of the following:
132130
133-
* Rule actions are not activated during manual runs.
131+
* <<rule-notifications,Rule actions>> are not activated during the manual runs.
132+
* Any changes that you make to the manual run or rule settings will display in the Manual runs table after the current run completes.
134133
* Except for threshold rules, duplicate alerts aren't created if you manually run a rule during a time range that was already covered by a scheduled run.
135-
* Manual runs are executed with low priority and limited concurrency, meaning they might take longer to complete. This can be especially apparent for rules requiring multiple executions.
134+
* Manually running a custom query rule with suppression may incorrectly inflate the number of suppressed alerts.
135+
136136
=====
137137

138+
138139
[float]
139140
[[snooze-rule-actions]]
140141
=== Snooze rule actions

docs/detections/rules-ui-monitor.asciidoc

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -62,35 +62,34 @@ Use these controls to filter what's included in the logs table:
6262

6363
* The *Show metrics columns* toggle includes more or less data in the table, pertaining to the timing of each rule execution.
6464

65-
* The *Actions* column allows you to show alerts generated from a given rule execution. Click the filter icon (image:images/filter-icon.png[Filter icon,18,17]) to create a global search filter based on the rule execution's ID value. This replaces any previously applied filters, changes the global date and time range to 24 hours before and after the rule execution, and displays a confirmation notification. You can revert this action by clicking *Restore previous filters* in the notification.
6665

6766
[float]
6867
[[manual-runs-table]]
6968
==== Manual runs table
7069

7170
beta::[]
7271

73-
Each manual run can produce multiple rule executions, depending on the time range of the run and the rule's execution schedule. These details are shown in the Manual runs table.
72+
You can <<manually-run-rules,manually run>> enabled rules for a specified period of time to deliberately test them or provide additional rule coverage. Each manual run can produce multiple rule executions, depending on the time range of the run and the rule's execution schedule.
7473

75-
To access the table, navigate to the detection rules page, click the rule's name to open its details, then scroll down and select the **Execution results** tab. Scroll down again to find the Manual runs table.
74+
NOTE: Manual runs are given lower priority and limited concurrency, meaning they might take longer to complete. This can be especially apparent for rules requiring multiple executions.
7675

77-
To stop an active run, go to the appropriate row and click **Stop run** in the **Actions** column. Completed rule executions for each manual run are logged in the Execution log table.
76+
The Manual runs table tracks manual rule executions. To access the table, navigate to the detection rules page, click the rule's name to open its details, then scroll down and select the **Execution results** tab. Scroll down again to find the Manual runs table.
7877

79-
[role="screenshot"]
80-
image::images/manual-rule-run-table.png[Manual rule runs table on the rule execution results tab]
81-
82-
The Manual runs table displays important details such as:
78+
The Manual runs table provides important details such as:
8379

80+
* The total number of rule executions that the manual run will produce and how many are failing, pending, running, and completed.
81+
* When the manual run started and the time range that it will cover.
82+
+
83+
NOTE: To stop an active run, go to the appropriate row in the table and click **Stop run** in the **Actions** column. Completed rule executions for each manual run are logged in the Execution log table.
84+
+
8485
* The status of each manual run:
85-
** **Pending**: The rule is not yet running.
86-
** **Running**: The rule is executing during the time range you specified. Some rules, such as indicator match rules, can take longer to run.
87-
** **Error**: The rule's configuration is preventing it from running correctly. For example, the rule's conditions cannot be validated.
86+
** `Pending`: The rule is not yet running.
87+
** `Running`: The rule is running during the time range you specified. Some rule types, such as indicator match rules, can take longer to run.
88+
** `Error`: The rule's configuration is preventing it from running correctly. For example, the rule's conditions cannot be validated.
8889

89-
* When a manual run started and the time in which it will run
90-
91-
* The number of rule executions that are failing, pending, running, and completed for a manual run
90+
[role="screenshot"]
91+
image::images/manual-rule-run-table.png[Manual rule runs table on the rule execution results tab]
9292

93-
* The total number of rule executions that are occurring for a manual run
9493

9594
[float]
9695
[[troubleshoot-signals]]

0 commit comments

Comments
 (0)