[microsoft-exchange-online-message-trace] - Added support for sliding window attributes and updated default interval values. #12239
Conversation
ShourieG
added
integration
🚀 Benchmarks reportTo see the full report comment with |
|
There was a problem hiding this comment.
The logic of this looks good.
In a separate PR we should also remove the look-back logic and have it save the time of the last data seen rather than the time of the last execution.
As a name, "End Interval" is a bit confusing for someone who isn't looking at how the request is built. What do you think about this?
- name: min_age
type: text
title: Minimum Age
description: |
Logs will not be requested until they are at least this old.
This value should...
Supported units for this parameter are h/m/s.
| @@ -45,9 +45,13 @@ In order to continue using the Microsoft Exchange Online Message Trace you will | |||
| - For configuring `Local Domains` you can check your [Microsoft Admin Exchange Center](https://admin.exchange.microsoft.com/) for the domains | |||
| available in your organization. They are usually under the sections [Accepted Domains](https://admin.exchange.microsoft.com/#/accepteddomains) and [Remote Domains](https://admin.exchange.microsoft.com/#/remotedomains). | |||
|
|
|||
| - The default `Polling Interval` and `Initial Interval` values are configured to `1h`, you can however change these to your required values. The look-back | |||
| - The default `Polling Interval` is configured to `1h` and `Initial Interval` to `48h`, you can however change these to your required values. The look-back | |||
There was a problem hiding this comment.
| - The default `Polling Interval` is configured to `1h` and `Initial Interval` to `48h`, you can however change these to your required values. The look-back | |
| - The default `Interval` for polling is configured to `1h` and `Initial Interval` to `48h`, you can however change these to your required values. The look-back |
The title used for the interval variable is just "Interval"
| description: | | ||
| The time window starting from the initial interval up to when the logs would be pulled. This value should be always lesser than the interval. | ||
| Supported units for this parameter are h/m/s. | ||
| default: 24h |
There was a problem hiding this comment.
I think the default should be 1h, since I think I saw in the documentation or something that the status is usually available in an hour. If a user wants 24h to match what they've done elsewhere they can override the default.
| type: text | ||
| title: End Interval | ||
| description: | | ||
| The time window starting from the initial interval up to when the logs would be pulled. This value should be always lesser than the interval. |
There was a problem hiding this comment.
This value should be always lesser than the interval.
Also true of initial interval, to avoid request ranges where the end is before the start.
If we remove the lookback logic (in a different PR), this can be cleaned up. Then it will only be initial interval. And then we can probably just use initial interval + end interval to avoid the complication entirely.
| value of `Initial Interval` should not exceed `200 hours` as this might cause unexpected errors with the API. | ||
|
|
||
| - The default `End Interval` is configured to `24h`, you can however change these to your required values. The `End Interval` was introduced to allow a sliding |
There was a problem hiding this comment.
Shouldn't this be a default of 0s to keep existing functionality the same for current users? Else this would be a breaking change?
There was a problem hiding this comment.
Yes, ideally that should be the case, still having some discussions on this internally.
There was a problem hiding this comment.
It's been reduced to 1h as a default in order to avoid logs with the "gettingStatus" state which a lot of users were complaining about.
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
|
@chrisberkhout, I've added the suggested changes. |
|
/test |
1 similar comment
|
/test |
|
@chrisberkhout, could you review the updated PR once |
💔 Build Failed
Failed CI StepsHistory
cc @ShourieG |
Type of change
Proposed commit message
Some scenarios demand for a configurable time window with an initial interval and an end interval. To allow this, a configurable time window has been introduced along with updates to necessary default interval values.
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots
Under Advanced Options