[DOCS] Create rule updates - 7.10 #336

jmikell821 · 2020-10-22T21:05:17Z

Updated links as of 11/10/20:

Create Detection Rules Preview.
Detections and Alerts Intro.
Replaces #272.

Co-authored-by: Ryland Herrick <ryalnd@gmail.com>

docs/detections/rules-ui-create.asciidoc

peluja1012 · 2020-11-02T14:53:39Z

docs/detections/rules-ui-create.asciidoc

+`destination.ip` field values in the `logs-*` or `packetbeat-*` {es-sec} indices
+are identical to the corresponding field values in the `ip-threat-list` threat
+index, enter the rule parameters seen in the following image:
+


Relaying a suggestion from @aarju here.

It would also help a lot if there was an example of how to format an index to be used as a threat index. For example, if I have a list of 10 domains and their IP addresses that I want to monitor, how do I add those to Elastic to be used as a thread index

@peluja1012 I think this is a good idea, but I probably won't have time to incorporate it before tomorrow unless it's a simple process. This might be best as a separate topic since this one is already pretty long as is. WDYT?

I think it makes sense to include it in a separate topic. We could link to it from this page. 👍

rylnd

Just a few comments! The rule creation page is very noisy right now due to all the different formatting; anything we can do to normalize that would be a big win!

docs/detections/rules-ui-create.asciidoc

docs/detections/detection-engine-intro.asciidoc

docs/detections/rules-ui-create.asciidoc

docs/detections/detections-ui-exceptions.asciidoc

spong · 2020-11-10T21:29:14Z

docs/detections/detections-ui-exceptions.asciidoc

+Be careful when adding exceptions to EQL sequence rules. Exceptions are
+evaluated against every event in the sequence, and when the exception matches any
+event(s) in the sequence, alerts are not generated. To exclude values from a
+specific event in the sequence, update the rule's EQL statement. For example:


This is perfect, and even an example too -- thank you @jmikell821! 🙂

docs/detections/rules-ui-create.asciidoc

spong

Couple nits, but looks like you've already got them! Thank you much for the detailed and thorough docs here @jmikell821! Our users will be quite happy! 🙂

* Adds EQL and threat-match rule types * updates terminology * adds warning about eql seq exceptions * Update docs/detections/detections-ui-exceptions.asciidoc Co-authored-by: Ryland Herrick <ryalnd@gmail.com> * Testing addition of preview rule. * comitting so I don't lose. * Committing rule updates so I don't lose. * Merging feedback and testing formatting. * Fixing build error, updating image * formatting changes and updates. * Fix build error. * Attempt build error fix. * Fix missing anchor link * small fixes. * merging feedback. * build fix * and...another build fix. * [DOCS] Terminates important admonition block * merging feedback. Co-authored-by: Ben Skelker <ben.skelker@elastic.co> Co-authored-by: Nate Archer <12628964+DonNateR@users.noreply.github.com> Co-authored-by: Ryland Herrick <ryalnd@gmail.com> Co-authored-by: DonNateR <nathaniel.archer@elastic.co> Co-authored-by: lcawl <lcawley@elastic.co>

* Adds EQL and threat-match rule types * updates terminology * adds warning about eql seq exceptions * Update docs/detections/detections-ui-exceptions.asciidoc Co-authored-by: Ryland Herrick <ryalnd@gmail.com> * Testing addition of preview rule. * comitting so I don't lose. * Committing rule updates so I don't lose. * Merging feedback and testing formatting. * Fixing build error, updating image * formatting changes and updates. * Fix build error. * Attempt build error fix. * Fix missing anchor link * small fixes. * merging feedback. * build fix * and...another build fix. * [DOCS] Terminates important admonition block * merging feedback. Co-authored-by: Ben Skelker <ben.skelker@elastic.co> Co-authored-by: Nate Archer <12628964+DonNateR@users.noreply.github.com> Co-authored-by: Ryland Herrick <ryalnd@gmail.com> Co-authored-by: DonNateR <nathaniel.archer@elastic.co> Co-authored-by: lcawl <lcawley@elastic.co> Co-authored-by: Ben Skelker <ben.skelker@elastic.co> Co-authored-by: Nate Archer <12628964+DonNateR@users.noreply.github.com> Co-authored-by: Ryland Herrick <ryalnd@gmail.com> Co-authored-by: DonNateR <nathaniel.archer@elastic.co> Co-authored-by: lcawl <lcawley@elastic.co>

Ben Skelker and others added 7 commits October 7, 2020 12:23

Adds EQL and threat-match rule types

ae18da2

updates terminology

efb939f

adds warning about eql seq exceptions

806cbaa

Update docs/detections/detections-ui-exceptions.asciidoc

72934f3

Co-authored-by: Ryland Herrick <ryalnd@gmail.com>

Testing addition of preview rule.

6d8b1d8

comitting so I don't lose.

41f9f91

Committing rule updates so I don't lose.

020942e

peluja1012 reviewed Nov 2, 2020

View reviewed changes

docs/detections/rules-ui-create.asciidoc Show resolved Hide resolved

peluja1012 reviewed Nov 2, 2020

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

peluja1012 reviewed Nov 2, 2020

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

jmikell821 mentioned this pull request Nov 2, 2020

[Docs]Adds EQL and threat-match rule types UI #272

Closed

peluja1012 reviewed Nov 2, 2020

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

peluja1012 reviewed Nov 2, 2020

View reviewed changes

rylnd reviewed Nov 2, 2020

View reviewed changes

docs/detections/rules-ui-create.asciidoc Show resolved Hide resolved

docs/detections/detection-engine-intro.asciidoc Outdated Show resolved Hide resolved

docs/detections/detection-engine-intro.asciidoc Outdated Show resolved Hide resolved

jmikell821 added 2 commits November 9, 2020 17:07

Merging feedback and testing formatting.

b069873

Fixing build error, updating image

7aeca3d

lcawl mentioned this pull request Nov 9, 2020

Drafts addition of open blocks #351

Closed

jmikell821 and others added 5 commits November 10, 2020 09:53

formatting changes and updates.

78f9bdc

Fix build error.

2ae3508

Attempt build error fix.

1e3b203

Fix missing anchor link

1b95e8f

small fixes.

f34f201

peluja1012 reviewed Nov 10, 2020

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

peluja1012 reviewed Nov 10, 2020

View reviewed changes

docs/detections/detections-ui-exceptions.asciidoc Outdated Show resolved Hide resolved

peluja1012 reviewed Nov 10, 2020

View reviewed changes

docs/detections/detections-ui-exceptions.asciidoc Outdated Show resolved Hide resolved

jmikell821 added 2 commits November 10, 2020 16:14

merging feedback.

ee335b9

build fix

ceb0797

spong reviewed Nov 10, 2020

View reviewed changes

jmikell821 and others added 2 commits November 10, 2020 16:34

and...another build fix.

d79adc3

[DOCS] Terminates important admonition block

f212c05

spong reviewed Nov 10, 2020

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

spong reviewed Nov 10, 2020

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

spong reviewed Nov 10, 2020

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

spong reviewed Nov 10, 2020

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

spong approved these changes Nov 10, 2020

View reviewed changes

merging feedback.

e236981

jmikell821 merged commit 8254566 into master Nov 10, 2020

This was referenced Nov 10, 2020

[DOCS] Name/workflow change for threat match rules > indicator match rules #338

Closed

[DOCS] Threat Matching Rules for 7.10 #264

Closed

jmikell821 mentioned this pull request Nov 10, 2020

[7.x] [DOCS] Create rule updates - 7.10 (#336) #357

Merged

jmikell821 mentioned this pull request Nov 10, 2020

[7.10] [DOCS] Create rule updates - 7.10 (#336) #358

Merged

nastasha-solomon deleted the create-rule-7.10 branch July 18, 2022 15:17

joepeeples pushed a commit that referenced this pull request May 21, 2024

Updates and single-sources Benchmarks page (#336)

368ce14

joepeeples pushed a commit that referenced this pull request May 22, 2024

Updates and single-sources Benchmarks page (#336)

7b8f8d7

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[DOCS] Create rule updates - 7.10 #336

[DOCS] Create rule updates - 7.10 #336

jmikell821 commented Oct 22, 2020 •

edited

Loading

peluja1012 Nov 2, 2020

jmikell821 Nov 9, 2020

peluja1012 Nov 10, 2020 •

edited

Loading

rylnd left a comment

spong Nov 10, 2020

spong left a comment

[DOCS] Create rule updates - 7.10 #336

[DOCS] Create rule updates - 7.10 #336

Conversation

jmikell821 commented Oct 22, 2020 • edited Loading

peluja1012 Nov 2, 2020

Choose a reason for hiding this comment

jmikell821 Nov 9, 2020

Choose a reason for hiding this comment

peluja1012 Nov 10, 2020 • edited Loading

Choose a reason for hiding this comment

rylnd left a comment

Choose a reason for hiding this comment

spong Nov 10, 2020

Choose a reason for hiding this comment

spong left a comment

Choose a reason for hiding this comment

jmikell821 commented Oct 22, 2020 •

edited

Loading

peluja1012 Nov 10, 2020 •

edited

Loading