topic Re: Declarative process grouping, maximum/limit of process group definition in Open Q&A

Declarative process grouping, maximum/limit of process group definition

SimonGuillemot — Tue, 05 Apr 2022 07:31:14 GMT

Hi,

Following previous question, I had to create a lot of process group definition in a Declarative process grouping.

I didn't find in the document the maximum process group definition per technology/declarative process grouping we can add ? What is the default limit ? Can we extend it ? Is there best practices to share here.

Simon GUILLEMOT

Re: Declarative process grouping, maximum/limit of process group definition

mark_bley — Mon, 04 Apr 2022 11:51:35 GMT

Hi Simon,

by default there is indeed a limit set of up to 400 rules in total, however this limit could be changed at the cluster level.

As for best practices (from my experience), since the DPG rules can generate some more load trying to find all new processes if left too general, try and make them a bit more specific or even pinning them down to Host Groups or even Hosts.

Hope this helps.

Best,

Mark

Re: Declarative process grouping, maximum/limit of process group definition

SimonGuillemot — Mon, 04 Apr 2022 12:15:54 GMT

Hi Mark,

Thanks for the limit configuration.

For the best practices, I didn't see a place where I can reduce the scope of the DPG :

Regards,

Simon Guillemot

Re: Declarative process grouping, maximum/limit of process group definition

mark_bley — Mon, 04 Apr 2022 12:58:27 GMT

Hi Simon,

in order to define a scope you can achieve this either via the API or UI.

Go into the setting for the e.g. Host and under the Declarative process grouping tab you can define these rules that will only run on that specific host. (for Host group would be analogous)

Also as an example for usage in the API you can also push this payload against /api/v2/settings/objects (you may also adjust the scope to a Host group e.g.)

[ { "summary": "some-technology", "scope": "HOST-xxxxxxxxxxxxxxxx", "schemaId": "builtin:declarativegrouping", "schemaVersion": "1.0.12", "value": { "enabled": true, "name": "My technology Name", "detection": [ { "processGroupName": "lorem", "id": "dpg-id", "rules": [ { "property": "executable", "condition": "$eq(foo)" } ] } ] } } ]

Best,

Mark

Re: Declarative process grouping, maximum/limit of process group definition

SimonGuillemot — Mon, 04 Apr 2022 13:13:17 GMT

OK yes, of course, I was in the global settings...

Thx !