You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
User has the ability to map source fields to values of severity and risk score when they create a detection rule.
In advanced settings for rules creation, user also has the ability to override Rule Name and Timestamp, as well as check that the rule is a Building Block.
Acceptance Test Criteria
Documentation is required to instruct user to use Severity and Risk score override if they wish to use certain fields to map their rule severity and risk score to.
Use case example: User is using a data source where he wants to use a field called Priority Ranking (with the values of 1, 2, 3, 4, 5 as rank) is used for the SIEM Detection Rule Severity. He would select Priority Ranking as source field, and map severity value 1 to Critical, 2 to High, and so on. Now the user can use the source data to standardize into the SIEM severity mapping.
Notes
Add the "Team:Docs" label to new issues.
Be sure to add any necessary screenshots for clarity.
Include any conditions or caveats that may affect customers.
The text was updated successfully, but these errors were encountered:
Description
**Meta issue: ** elastic/kibana#65941
User has the ability to map source fields to values of severity and risk score when they create a detection rule.
In advanced settings for rules creation, user also has the ability to override Rule Name and Timestamp, as well as check that the rule is a Building Block.
Acceptance Test Criteria
Documentation is required to instruct user to use Severity and Risk score override if they wish to use certain fields to map their rule severity and risk score to.
Use case example: User is using a data source where he wants to use a field called
Priority Ranking
(with the values of 1, 2, 3, 4, 5 as rank) is used for the SIEM Detection Rule Severity. He would selectPriority Ranking
as source field, and map severity value1
to Critical,2
to High, and so on. Now the user can use the source data to standardize into the SIEM severity mapping.Notes
The text was updated successfully, but these errors were encountered: