Surya Sashank Nistala

**Is your feature request related to a problem?** A clear and concise description of what the problem is, e.g. _I'm always frustrated when [...]_ **What solution would you like?** A...

If cluster ingests more than 10k docs per shard per minute, monitor lags behind the ingestion rate and will not be generating findings eventually (lag increases as ingestion keeps increasing)...

[FEATURE] re-model monitor executions as a cancellable task

1

Today Alerting execution is not tracked by Opensearch task manager because it is executed as a Job Scheduler job. This renders us without any control over long runnign monitor exceutions...

[FEATURE] Monitor indices for occurences of malicious IPs/domains etc stored in high cardinality threat intelligence feeds

1

**Is your feature request related to a problem?** Customers have constant streams of threat intel feeds which contain millions of malicious IPs or DNS or other Indicators of Compromise (IoCs)....

All correlations are executing on the same node as the executing doc level monitor

1

**Is your feature request related to a problem?** - Make correlations pub-sub model and not keep it push based. - publish/subscribe findings should be distributed to different nodes **What solution...

Percolate query optimization: Fetch fields mentioned in queries instead of entire doc and batch percolate query by heap-based threshold

3

*Issue #, if available:* #1353 #1367 *Description of changes:* This PR optimizes scalability of percolate query performed in doc level monitors. Status quo behaviour - The behaviour is to query...

[FEATURE]Add node_id,latest_run_timestamp in workflow and monitor metadata.

1

Helps with better tracking of monitors and workflows executions and tracing the executions

- We could create a boolean flag `createErrorAlertsAndMoveOn` which is true by default - create a list that holds exceptions from following operations --- **If percolate query fails, on one...

*Issue #, if available:* *Description of changes:* *CheckList:* - [ ] Commits are signed per the DCO using --signoff By submitting this pull request, I confirm that my contribution is...