Skip to content

[docs-patrol] Update ti_custom README for max_executions advanced setting #18496

@github-actions

Description

@github-actions

Recent code changes in the repository have introduced documentation drift. The following change needs a corresponding documentation update.

Changes Requiring Documentation Updates

1. ti_custom indicator stream now supports configurable max_executions

Commit(s): 5455f1197b5462a833497558d11296d886320cf4

What changed:

  • Added a new stream configuration option in packages/ti_custom/data_stream/indicator/manifest.yml:
    • name: max_executions
    • default 1000
    • described as the remediation control when input becomes DEGRADED with message "exceeding maximum number of CEL executions"
  • Wired this setting into runtime config in packages/ti_custom/data_stream/indicator/agent/stream/cel.yml.hbs via:
    • max_executions: \{\{max_executions}}

Documentation impact:

  • packages/ti_custom/docs/README.md does not mention max_executions (no match for max_executions, Maximum Pages Per Interval, or the CEL execution-limit error).
  • packages/ti_custom/_dev/build/docs/README.md also has no update in the 7-day window.

A user following current docs would not find the new control needed to recover from CEL execution-limit DEGRADED states on high-volume TAXII feeds.

Suggested Actions

  • Add max_executions to packages/ti_custom/docs/README.md under indicator stream configuration/advanced settings, including default, valid values, and when to tune it.
  • Regenerate/update packages/ti_custom/_dev/build/docs/README.md to keep generated docs aligned.
  • Include a short troubleshooting note for the error message "exceeding maximum number of CEL executions" and point to max_executions as remediation.

What is this? | From workflow: Docs Patrol

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

  • expires on Apr 24, 2026, 10:32 AM UTC

Metadata

Metadata

Assignees

No one assigned

    Labels

    Integration:ti_customCustom Threat IntelligenceTeam:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]documentationImprovements or additions to documentation. Applied to PRs that modify *.md files.

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions