Github user simonellistonball commented on the issue:
https://github.com/apache/metron/pull/711
@ottobackwards agreed, this is very separate from the management ui (won't
touch, or be used by anything in the management ui). Also agreed this is a
separate entity, but one that will be used by the alerts ui. Honestly, I'm not
sure what else this needs to do. If we want to expand the scope, maybe we can
do that as a follow on.
@nickwallen thinking about it, I'm inclined to agree that the path of least
surprise for the soc user is the one to go for here, so you're right. The
representation passed should be that shown in the UI. The challenge here is
things like meta-alerts, where the actual alert to pass may not be fully
present on the ui due to paging on its member alerts. (I can certainly see use
cases where a meta-alert might contain O(1000s) of alerts).
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
