Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Allow editing alert suppression settings independently of source data #207244

Open
Tracked by #180407
, #179907
...
approksiu opened this issue Jan 20, 2025 · 2 comments
Open
Tracked by #180407
, #179907
...

[Security Solution] Allow editing alert suppression settings independently of source data #207244

approksiu opened this issue Jan 20, 2025 · 2 comments
Labels
enhancement New value added to drive a business result Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Feature:Rule Creation Security Solution Detection Rule Creation workflow Feature:Rule Edit Security Solution Detection Rule Editing workflow Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.

Comments

@approksiu
Copy link

approksiu commented Jan 20, 2025 •
edited by banderror
Loading

Epic: #179907

Summary

To help users customize rules on the environments where the required data is missing, and align the experience with editing of query fields and required fields field, we want to allow users setting suppression fields even if the source data is missing while editing a rule.

Acceptance criteria

On the Rule Creation and Rule Editing pages:

  • user can add alert suppression settings when data is not present on the cluster
  • user should see the validation warning, but it should allow saving the rule with these settings
@approksiu approksiu mentioned this issue Jan 20, 2025
Open
@approksiu approksiu added Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detections and Resp Security Detection Response Team Team:Detection Rule Management Security Detection Rule Management Team Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area triage_needed labels Jan 20, 2025
@banderror
Copy link
Contributor

banderror commented Jan 24, 2025 •
edited
Loading

@approksiu Not sure I'm following what's written in the description. As far as I remember (could be wrong), we made a decision to exclude the alert suppression settings from the upgrade workflow - we always update them to the current version. We don't show them in the flyout. What's expected instead of that?

@approksiu
Copy link
Author

@banderror This is about rules customization (on the rule editing page), not in the upgrade workflow. It is possible to modify the query and accept validation errors due to missing data, but the suppression settings are blocked.

@banderror banderror added Feature:Rule Creation Security Solution Detection Rule Creation workflow Feature:Rule Edit Security Solution Detection Rule Editing workflow enhancement New value added to drive a business result and removed triage_needed labels Jan 28, 2025
@banderror banderror removed their assignment Jan 28, 2025
@banderror banderror mentioned this issue Jan 28, 2025
Open
@banderror banderror changed the title [Security Solution] Allow suppression settings without the source data on customization [Security Solution] Allow editing alert suppression settings independently of source data Jan 28, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New value added to drive a business result Feature:Prebuilt Detection Rules Security Solution Prebuilt Detection Rules area Feature:Rule Creation Security Solution Detection Rule Creation workflow Feature:Rule Edit Security Solution Detection Rule Editing workflow Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@banderror @approksiu