Declarative process grouping, maximum/limit of process group definition

[SimonGuillemot]

Hi,

Following previous question, I had to create a lot of process group definition in a Declarative process grouping.

I didn't find in the document the maximum process group definition per technology/declarative process grouping we can add ? What is the default limit ? Can we extend it ? Is there best practices to share here.

Simon GUILLEMOT

[mark_bley]

Hi Simon,

by default there is indeed a limit set of up to 400 rules in total, however this limit could be changed at the cluster level.

As for best practices (from my experience), since the DPG rules can generate some more load trying to find all new processes if left too general, try and make them a bit more specific or even pinning them down to Host Groups or even Hosts.

Hope this helps.

Best,

Mark

[SimonGuillemot · Accepted solution]

Hi Mark,

Thanks for the limit configuration.

For the best practices, I didn't see a place where I can reduce the scope of the DPG :

Regards,

Simon Guillemot

[mark_bley · Accepted solution]

Hi Simon,

in order to define a scope you can achieve this either via the API or UI.

Go into the setting for the e.g. Host and under the Declarative process grouping tab you can define these rules that will only run on that specific host.  (for Host group would be analogous)

Also as an example for usage in the API you can also push this payload against /api/v2/settings/objects (you may also adjust the scope to a Host group e.g.)

[
  {
    "summary": "some-technology",
    "scope": "HOST-xxxxxxxxxxxxxxxx",
    "schemaId": "builtin:declarativegrouping",
    "schemaVersion": "1.0.12",
    "value": {
      "enabled": true,
      "name": "My technology Name",
      "detection": [
        {
          "processGroupName": "lorem",
          "id": "dpg-id",
          "rules": [
            {
              "property": "executable",
              "condition": "$eq(foo)"
            }
          ]
        }
      ]
    }
  }
]

Best,

Mark

[SimonGuillemot]

OK yes, of course, I was in the global settings...

Thx !