Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Alerting][Event Log] Populate event log rule ECS fields with the Security specific rule data. #101677

Closed
YulNaumenko opened this issue Jun 8, 2021 · 2 comments
Labels
discuss estimate:small Small Estimated Level of Effort Feature:Actions/Framework Issues related to the Actions Framework Feature:Alerting insight Issues related to user insight into platform operations and resilience NeededFor:Detections and Resp Project:ObservabilityOfAlerting Alerting team project for observability of alerting. Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)

Comments

@YulNaumenko
Copy link
Contributor

This issue is a follow up from the original PR.
Based on the conversation with @elastic/security-detections-response team, we have got the next fields list, which is currently not supported by the Alerting framework:
rule.author - the Detection Rules do have a dedicated author field, but alerting rules don't. Should use that?
rule.version - is usually an auto-incrementing number that starts out at 1 and moves forward to be 2, 3, 4, so it gives insight into what the version was. It gets updated on if edit particular fields such as author, name, but not on the actions such as enabling/disabling the rule. We don't have similar in alerting.
rule.description - the Detection Rules do have a dedicated field
rule.uuid - in Security Solution they populate a rule.id. Maybe could be something else?

@YulNaumenko YulNaumenko added discuss Feature:Alerting Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) labels Jun 8, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

@gmmorris gmmorris added Project:ObservabilityOfAlerting Alerting team project for observability of alerting. NeededFor:Detections and Resp labels Jun 30, 2021
@gmmorris gmmorris added the Feature:Actions/Framework Issues related to the Actions Framework label Jul 1, 2021
@gmmorris gmmorris added the loe:medium Medium Level of Effort label Jul 15, 2021
@gmmorris gmmorris added insight Issues related to user insight into platform operations and resilience estimate:small Small Estimated Level of Effort labels Aug 16, 2021
@gmmorris gmmorris removed the loe:medium Medium Level of Effort label Sep 2, 2021
@kobelb kobelb added the needs-team Issues missing a team label label Jan 31, 2022
@botelastic botelastic bot removed the needs-team Issues missing a team label label Jan 31, 2022
@mikecote
Copy link
Contributor

mikecote commented Sep 1, 2022

Closing issue until we have a UI to support with these fields.

@mikecote mikecote closed this as completed Sep 1, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
discuss estimate:small Small Estimated Level of Effort Feature:Actions/Framework Issues related to the Actions Framework Feature:Alerting insight Issues related to user insight into platform operations and resilience NeededFor:Detections and Resp Project:ObservabilityOfAlerting Alerting team project for observability of alerting. Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)
Projects
None yet
Development

No branches or pull requests

5 participants