[BUG]: Information for Prebuilt packs are loaded and activated information needs to be updated.

[amolnater-qasource]

Description:
Information for Prebuilt packs are loaded and activated information needs to be updated.

• Prebuilt packs are first loaded and not automatically activated.
• To select from query packs that have been loaded, the pack needs not be activated.

PR Ticket:
#2561

URL link or topic name:
https://security-docs_2561.docs-preview.app.elstc.co/guide/en/security/master/osquery-response-action.html#add-osquery-response-action
https://security-docs_2561.docs-preview.app.elstc.co/guide/en/security/master/alerts-run-osquery.html#alerts-run-osquery

Screenshots/ Recordings:
Expected:

Packs.-.Osquery.-.Elastic.-.Google.Chrome.2022-10-19.12-09-43.mp4

Packs.-.Osquery.-.Elastic.-.Google.Chrome.2022-10-19.12-23-05.mp4

Actual:

[amolnater-qasource]

@manishgupta-qasource Please review.

[manishgupta-qasource]

Reviewed & assigned to @jmikell821

[nastasha-solomon]

Thanks for filing this, @amolnater-qasource ! I'm following up on this and will get back to you soon.

[nastasha-solomon]

@amolnater-qasource the Security doc updates are ready for your review at #2561. I applied the same corrections to the Kibana Osquery docs at elastic/kibana#143242 (changes are here) and added some extra information about working with active and inactive packs (see the first bullet in the second step here.)

cc: @patrykkopycinski

[nastasha-solomon]

Merged #2561

[arvindersingh-qasource]

Hi @nastasha-solomon ,

Thanks for looking into the issue.

We have validated this issue on the Kibana Guide [8.5] and found that issue is Fixed.

Guide Link

• https://www.elastic.co/guide/en/security/8.5/alerts-run-osquery.html

Please find the below observations

• Add Osquery Response Actions
  

• Run Osquery from Alerts
  

Thanks