These settings control how Threat Manager executes rules during ingestion and when databases are unavailable. All settings are configured by editing docker-compose_v10.yaml directly.

IMPORTANT: Before editing this file, create a backup.

In this section:

(On-premises) INGESTION_OCCURRING_WAIT_TIME_IN_MINUTES 

When a rule is set to run continuously, it wakes up every minute to check for new data in any of the databases. If the rule finds new data in a database and ingestion is complete, the rule runs. If ingestion is still in progress, the rule waits for ingestion to complete before running. If ingestion takes longer than the configured time limit, the rule runs at the end of that period (the default time limit is 15 minutes).

When a rule runs on multiple databases, the alert generated on the first database is updated each time the rule runs on subsequent databases to reflect the latest risk score. For example, if rule 1 runs on database 1 and generates an alert, then runs on database 2, the alert is updated to reflect the new risk score.

Task: Update INGESTION_OCCURRING_WAIT_TIME_IN_MINUTES

  1. Open docker-compose_v10.yaml with a suitable editing program.

  2. Under the analytics-engine service, within the environment: subsection, locate the following:

    INGESTION_OCCURRING_WAIT_TIME_IN_MINUTES=15

  3. Update the value (default is 15) to the required number of minutes.

  4. Save docker-compose_v10.yaml.

  5. Restart the Docker stack to apply the changes. Refer to On-premises: Stopping and restarting the Docker stack to apply new settings.

(On-premises) CONTINUOUS_RUNNING_RULE_OFFSET_IN_DAYS

When a rule is set to run continuously and one database goes down, ingestion continues on the other databases, the rule runs, and alerts are generated. When the database comes back up, Threat Manager detects the change and revises alerts for the period the database was down, up to the configured number of days (the default setting is 2 days).

Task: Update CONTINUOUS_RUNNING_RULE_OFFSET_IN_DAYS

  1. Open docker-compose_v10.yaml with a suitable editing program.

  2. Under analytics-engine, within the environment: subsection, locate the following:

    CONTINUOUS_RUNNING_RULE_OFFSET_IN_DAYS=2

  3. Update the value (default is 2 days).

  4. Save docker-compose_v10.yaml.

  5. Restart the Docker stack to apply the changes. Refer to Stopping and restarting the Docker stack to apply new settings.

(On-premises) MONITORING_RULE_MAX_OFFSET_IN_DAYS

When connectivity is restored after a database outage, Threat Manager updates alerts or generates new alerts to reflect information that was missed during the outage. Data is ingested for the entire outage period, but alerts are updated or generated for the configured number of days (the default is 3 days) back from the point of restoration.

For more information, refer to Using the Detect and Protect Alert List and Behavior Analytics Alert List in iManage Threat Manager Help.

Task: Update MONITORING_RULE_MAX_OFFSET_IN_DAYS

  1. Open docker-compose_v10.yaml with a suitable editing program.

  2. Under analytics-engine, within the environment: subsection, locate the following:

    - MONITORING_RULE_MAX_OFFSET_IN_DAYS=3

  3. Update the value (default is 3 days).

  4. Save docker-compose_v10.yaml.

  5. Restart the Docker stack to apply the changes. Refer to Stopping and restarting the Docker stack to apply new settings.