Describe the feature:
Improve rule preview UX to communicate to users how the simulation is occurring. There have been questions from the community around why rule preview takes longer than doing a similar query in Discover or running the rule itself.
@rylnd said it beautifully to explain why this behavior is observed by the user.
The rule preview feature includes a lot of functionality beyond just the basic query, so comparing the two is not going to be particularly useful here.
Rule preview is meant to answer "What would happen if I actually ran this rule?" and to be as comprehensive as possible. In addition to the rule query, this includes:
Applying rule exceptions
Transforming source documents into alert documents
Indexing of the alert documents into a simulated alerts index.
The extra preview time may be spent in any or all of those sections; you would need to play with your rule configuration (or share it here) to get a better sense of that.
One likely cause of slowness is called out in the above documentation:
Avoid setting long time ranges with short rule intervals, or the rule preview might time out.
This is due to the fact that, in an effort to truly "preview" the rule execution, we may simulate invoking the rule multiple times (if the time range and rule interval call for that), which would certainly be slower than performing a single query.
Of particular interest is that last part:
in an effort to truly "preview" the rule execution, we may simulate invoking the rule multiple times (if the time range and rule interval call for that), which would certainly be slower than performing a single query.
@elastic/security-docs @ARWNightingale could we include some kind of text within the rule preview flyout to communicate what is occurring when they preview the rule?
Docs issue https://github.com/elastic/security-docs/issues/4795
Designs Figma link
Describe the feature:
Improve rule preview UX to communicate to users how the simulation is occurring. There have been questions from the community around why rule preview takes longer than doing a similar query in Discover or running the rule itself.
@rylnd said it beautifully to explain why this behavior is observed by the user.
Of particular interest is that last part:
@elastic/security-docs @ARWNightingale could we include some kind of text within the rule preview flyout to communicate what is occurring when they preview the rule?
Docs issue https://github.com/elastic/security-docs/issues/4795
Designs Figma link