handle threat intel enabled check during detector updation

opensearch-project · Oct 12, 2023 · 528b978 · 528b978
1 parent 6dabe61
commit 528b978
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/main/java/org/opensearch/securityanalytics/transport/TransportIndexDetectorAction.java b/src/main/java/org/opensearch/securityanalytics/transport/TransportIndexDetectorAction.java
@@ -255,7 +255,7 @@ private void createMonitorFromQueries(List<Pair<String, Rule>> rulesById, Detect
 
         List<IndexMonitorRequest> monitorRequests = new ArrayList<>();
 
-        if (!docLevelRules.isEmpty()) {
+        if (!docLevelRules.isEmpty() || detector.getThreatIntelEnabled()) {
             monitorRequests.add(createDocLevelMonitorRequest(docLevelRules, detector, refreshPolicy, Monitor.NO_ID, Method.POST));
         }
 
@@ -474,7 +474,7 @@ public void onFailure(Exception e) {
                     Collectors.toList());
 
             // Process doc level monitors
-            if (!docLevelRules.isEmpty()) {
+            if (!docLevelRules.isEmpty() || detector.getThreatIntelEnabled()) {
                 if (detector.getDocLevelMonitorId() == null) {
                     monitorsToBeAdded.add(createDocLevelMonitorRequest(docLevelRules, detector, refreshPolicy, Monitor.NO_ID, Method.POST));
                 } else {