-
Notifications
You must be signed in to change notification settings - Fork 206
Closed
Labels
Feature: RulesTeam: Detections/ResponseDetections and ResponseDetections and ResponseTeam: Docsv8.4.0
Description
Description
PR elastic/kibana#132507 adds filters to event correlations within the Security Detection rules.
From issue elastic/kibana#101047:
Describe the feature: Add filters to event correlations within the Security Detection rules, this is possible inside EQL but does not seem to be supported inside Detections.
Describe a specific use case for the feature: If I need to search for the same values across multiple documents, with only a couple of those fields changing each time but more than one field across the documents staying the same, the EQL is less efficient than the DSL is.
Notes
- Filters are applied to both rule preview (while creating rule) and during actual rule execution.
Metadata
Metadata
Assignees
Labels
Feature: RulesTeam: Detections/ResponseDetections and ResponseDetections and ResponseTeam: Docsv8.4.0
