+2I updated a rule, and a few minutes later I received a new alert triggered by an event from the past. The event has an ingestion timestamp from two days ago.
Is this expected behavior? Does updating a rule automatically trigger a retroactive run/reprocessing of previously ingested events, or could this be a bug?
+4Hi,
Without further context about your rule, I cannot tell whether this is caused by the Detection Engine of Google SecOps, your rule logic, your rule type, or ingestion latency.
There are quite a few mechanisms that aren’t obvious for the general SecOps user unless you have scrutinized the docs (which is not an easy task given they have been moving all the information recently). You may want to take a look at Automatic true-up stages in the Schedule Rule Runs Google SecOps documentation.
Basically, multi-event rules by default run a few more times in the background to account for late arriving data due to enrichment lag or ingestion latency.
Also, Google SecOps recently introduced Customized Schedules for rules. It is in Pre-GA though, but it may help you address your own use cases better.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
