[Request][8.14] improved ES|QL investigation (highlighted) fields #5182

nastasha-solomon · 2024-05-08T01:52:58Z

Contributes to #5054

Preview:
Made several updates to the Create an ES|QL rule section:

Updated the explanations for the fields that are returned by aggregating and non-aggregating queries.
Added definitions and examples of new fields that can be created for either query type.
Updated the limitations section so it no longer shows that new fields can't be added to a rule's custom highlighted fields.
Created a new, short section about adding new fields to a rule's custom highlighted fields.

Twin Serverless PR: https://github.com/elastic/staging-serverless-security-docs/pull/349

github-actions · 2024-05-08T01:53:14Z

A documentation preview will be available soon.

🔨 Buildkite builds
📚 HTML diff
📙 Preview page

Request a new doc build by commenting

Rebuild this PR: run docs-build
Rebuild this PR and all Elastic docs: run docs-build rebuild

_{run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.}

_{If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.}

docs/detections/rules-ui-create.asciidoc

…lastic/security-docs into issue-5054-improved-esql-investigation

docs/detections/rules-ui-create.asciidoc

benironside

Nice work on this very nuanced topic. Left a few suggestions for your consideration, hope they're helpful!

docs/detections/rules-ui-create.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

docs/detections/rules-ui-create.asciidoc

) * First draft * Additional information * Small edits * Part of Vitalii's feedback * Re-orged info * Re-adding into sen * Update docs/detections/rules-ui-create.asciidoc * Update docs/detections/rules-ui-create.asciidoc * Draft of Vitalii's input * Update docs/detections/rules-ui-create.asciidoc * Expanding definition for new fields * Update docs/detections/rules-ui-create.asciidoc * Update docs/detections/rules-ui-create.asciidoc * Update docs/detections/rules-ui-create.asciidoc Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> * Update docs/detections/rules-ui-create.asciidoc Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> * Update docs/detections/rules-ui-create.asciidoc Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> * Update docs/detections/rules-ui-create.asciidoc Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> * Update docs/detections/rules-ui-create.asciidoc * Update docs/detections/rules-ui-create.asciidoc * Update docs/detections/rules-ui-create.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> (cherry picked from commit 9bb14b7)

…lds (backport #5182) (#5235) * First draft * Additional information * Small edits * Part of Vitalii's feedback * Re-orged info * Re-adding into sen * Update docs/detections/rules-ui-create.asciidoc * Update docs/detections/rules-ui-create.asciidoc * Draft of Vitalii's input * Update docs/detections/rules-ui-create.asciidoc * Expanding definition for new fields * Update docs/detections/rules-ui-create.asciidoc * Update docs/detections/rules-ui-create.asciidoc * Update docs/detections/rules-ui-create.asciidoc Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> * Update docs/detections/rules-ui-create.asciidoc Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> * Update docs/detections/rules-ui-create.asciidoc Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> * Update docs/detections/rules-ui-create.asciidoc Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> * Update docs/detections/rules-ui-create.asciidoc * Update docs/detections/rules-ui-create.asciidoc * Update docs/detections/rules-ui-create.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> (cherry picked from commit 9bb14b7) Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

First draft

eb9de95

nastasha-solomon added Feature: Rules Team: Detection Engine Priority: High Issues that are time-sensitive and/or are of high customer importance Effort: Small Issues that can be resolved quickly v8.14.0 Feature: ES|QL labels May 8, 2024

nastasha-solomon self-assigned this May 8, 2024

nastasha-solomon and others added 3 commits May 8, 2024 22:40

Additional information

739359b

Small edits

b0da54d

Merge branch 'main' into issue-5054-improved-esql-investigation

a4eded2

nastasha-solomon requested a review from vitaliidm May 9, 2024 02:57

vitaliidm reviewed May 9, 2024

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

Merge branch 'main' into issue-5054-improved-esql-investigation

1ee4a17

nastasha-solomon mentioned this pull request May 10, 2024

[Request] improved ES|QL investigation(highlighted) fields #5054

Closed

nastasha-solomon and others added 4 commits May 11, 2024 16:49

Part of Vitalii's feedback

ab386a5

Merge branch 'main' into issue-5054-improved-esql-investigation

c0e0a4a

Re-orged info

4743784

Re-adding into sen

69e7f00

nastasha-solomon commented May 12, 2024

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

Update docs/detections/rules-ui-create.asciidoc

75b4818

vitaliidm reviewed May 13, 2024

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

nastasha-solomon and others added 3 commits May 13, 2024 08:49

Update docs/detections/rules-ui-create.asciidoc

26de3a4

Merge branch 'main' into issue-5054-improved-esql-investigation

c723497

Draft of Vitalii's input

c64371a

nastasha-solomon commented May 14, 2024

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

nastasha-solomon and others added 3 commits May 13, 2024 21:24

Update docs/detections/rules-ui-create.asciidoc

df9eabe

Expanding definition for new fields

5846790

Merge branch 'issue-5054-improved-esql-investigation' of github.com:e…

d325351

…lastic/security-docs into issue-5054-improved-esql-investigation

nastasha-solomon requested a review from vitaliidm May 14, 2024 13:18

vitaliidm reviewed May 14, 2024

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

nastasha-solomon commented May 14, 2024

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

nastasha-solomon added 2 commits May 14, 2024 10:08

Update docs/detections/rules-ui-create.asciidoc

664f620

Update docs/detections/rules-ui-create.asciidoc

0fadccc

benironside reviewed May 14, 2024

View reviewed changes

nastasha-solomon and others added 5 commits May 14, 2024 16:32

Merge branch 'main' into issue-5054-improved-esql-investigation

08631d6

Update docs/detections/rules-ui-create.asciidoc

23d529a

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

Update docs/detections/rules-ui-create.asciidoc

47fb98e

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

Update docs/detections/rules-ui-create.asciidoc

b52728c

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

Update docs/detections/rules-ui-create.asciidoc

fbdc6dc

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

nastasha-solomon changed the title ~~[Request] improved ES|QL investigation(highlighted) fields~~ [Request][8.14] improved ES|QL investigation (highlighted) fields May 14, 2024

vitaliidm previously approved these changes May 16, 2024

View reviewed changes

Merge branch 'main' into issue-5054-improved-esql-investigation

2d1339e

nastasha-solomon mentioned this pull request May 16, 2024

What's new in 8.14 #5101

Closed

22 tasks

Update docs/detections/rules-ui-create.asciidoc

218e0d3

nastasha-solomon dismissed vitaliidm’s stale review via 218e0d3 May 17, 2024 20:08

nastasha-solomon commented May 17, 2024

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

Update docs/detections/rules-ui-create.asciidoc

d24c3d2

nastasha-solomon commented May 17, 2024

View reviewed changes

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved

Update docs/detections/rules-ui-create.asciidoc

814166b

nastasha-solomon requested a review from benironside May 17, 2024 20:57

nastasha-solomon added 3 commits May 17, 2024 17:13

Merge branch 'main' into issue-5054-improved-esql-investigation

6e76bfe

Merge branch 'main' into issue-5054-improved-esql-investigation

68b306e

Merge branch 'main' into issue-5054-improved-esql-investigation

1fdd04b

benironside approved these changes May 20, 2024

View reviewed changes

nastasha-solomon merged commit 9bb14b7 into main May 20, 2024
3 checks passed

mergify bot mentioned this pull request May 20, 2024

[8.14] [Request][8.14] improved ES|QL investigation (highlighted) fields (backport #5182) #5235

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Request][8.14] improved ES|QL investigation (highlighted) fields #5182

[Request][8.14] improved ES|QL investigation (highlighted) fields #5182

nastasha-solomon commented May 8, 2024 •

edited

Loading

github-actions bot commented May 8, 2024

benironside left a comment

[Request][8.14] improved ES|QL investigation (highlighted) fields #5182

[Request][8.14] improved ES|QL investigation (highlighted) fields #5182

Conversation

nastasha-solomon commented May 8, 2024 • edited Loading

github-actions bot commented May 8, 2024

benironside left a comment

Choose a reason for hiding this comment

nastasha-solomon commented May 8, 2024 •

edited

Loading