Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent event loop CPU blocking when processing applyUpdate in container rules #9936

Closed
richard-julien opened this issue Feb 11, 2025 · 0 comments · Fixed by #9969
Closed
Assignees
Labels
bug use for describing something not working as expected performance solved use to identify issue that has been solved (must be linked to the solving PR)
Milestone

Comments

@richard-julien
Copy link
Member

richard-julien commented Feb 11, 2025

Description

When processing extremely large report, the rule engine can consume too much cpu

Image

Hints

Code responsible

      // AddedRefs are ids not includes in previous data
      const addedRefs: Array<StixId> = newRefIds.filter((newId) => !previousRefIds.includes(newId));
      // RemovedRefs are ids not includes in current data
      const removedRefs: Array<StixId> = previousRefIds.filter((newId) => !newRefIds.includes(newId));

Todo

Change the filter function to use a loop aware of event loop

Extra performance detection

Image
@richard-julien richard-julien self-assigned this Feb 11, 2025
@richard-julien richard-julien added the bug use for describing something not working as expected label Feb 13, 2025
@richard-julien richard-julien changed the title Improve performance when processing applyUpdate in container rules Prevent event loop CPU blocking when processing applyUpdate in container rules Feb 13, 2025
@richard-julien richard-julien added this to the Release 6.5.2 milestone Feb 13, 2025
@richard-julien richard-julien added the solved use to identify issue that has been solved (must be linked to the solving PR) label Feb 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected performance solved use to identify issue that has been solved (must be linked to the solving PR)
Projects
None yet
1 participant