Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Improve rule diff algorithm performance by splitting diff calculation into async chunks #180164

Open
Tracked by #179907
jpdjere opened this issue Apr 5, 2024 · 3 comments
Assignees
Labels
Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area performance refactoring Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.

Comments

@jpdjere
Copy link
Contributor

jpdjere commented Apr 5, 2024

Epics: /~https://github.com/elastic/security-team/issues/1974 (internal), #174168

Summary

  • The calculation of rule fields diffs in the /upgrade/_review endpoint is a computationally expensive synchronous process that blocks the event loop during its calculation.
  • In order to avoid blocking the event loop and improve server-side performance, we can split diff calculation into async chunks that yield control back to the event loop after a number of them are executed.
  • A solution could look like so (PSEUDO):
        for (let i = 0; i < upgradeableRules.length; i += chunkSize) {
            const chunk = upgradeableRules.slice(i, i + chunkSize);

            chunk.forEach(({ current }) => {
                const ruleVersions = ruleVersionsMap.get(current.rule_id);
                invariant(ruleVersions != null, 'ruleVersions not found');
                const diffResult = calculateRuleDiff(ruleVersions);
                ruleDiffCalculationResults.push(diffResult);
            });

            // Yield control back to the event loop
            await setImmediatePromise();
        }

Background

The above solution is based on:

  1. Answer from stack overflow
  2. Node.js guide: Complex calculations without blocking the Event Loop
@jpdjere jpdjere added bug Fixes for quality problems that affect the customer experience performance triage_needed refactoring Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area labels Apr 5, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

@jpdjere jpdjere removed the bug Fixes for quality problems that affect the customer experience label Apr 5, 2024
@banderror banderror changed the title [Security Solution] Improve rule diff algorithm performance by splitting diff calculation into async chunks [Security Solution] Improve rule diff algorithm performance by splitting diff calculation into async chunks (DRAFT) Apr 17, 2024
@jpdjere jpdjere changed the title [Security Solution] Improve rule diff algorithm performance by splitting diff calculation into async chunks (DRAFT) [Security Solution] Improve rule diff algorithm performance by splitting diff calculation into async chunks May 24, 2024
@jpdjere jpdjere self-assigned this Jun 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area performance refactoring Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Projects
None yet
Development

No branches or pull requests

3 participants