[DOCS] Revise workaround for aggregated fields in threshold rules #2074

joepeeples · 2022-06-15T20:32:15Z

Resolves #2016.

Preview: Create a detection rule | Create a threshold rule

madirey · 2022-06-16T16:52:34Z

Thanks for this! Upon reading, I'm thinking we may want to leave some of this information... we could still point out that the generated signals/alerts are synthetic and don't contain all the fields (only those that appear in the Threshold field configuration of the rule). Something like: NOTE: Alerts created by *threshold* rules are synthetic alerts that do not resemble the source documents. The alert itself only contains data about the fields that were aggregated over (the `Group by` fields). Other fields are omitted, because they can vary across all source documents that were counted toward the threshold. Additionally, you can reference the actual count of documents that exceeded the threshold from the `kibana.alert.threshold_result.count` field`.

joepeeples · 2022-06-20T18:05:07Z

Thanks for the suggestion, @madirey! I added the note back in with your revisions; just let me know if anything else needs to be adjusted.

joepeeples · 2022-06-20T18:06:28Z

Adding @elastic/security-docs for a quick review, whoever gets to it first. Full team review prob not necessary.

madirey

Thank you!!

ghost · 2022-06-22T07:45:50Z

Hi @joepeeples ,

We tested the linked doc and found that the doc is correctly updated as per the latest UI. So we are good to go ahead and merge the changes.

Marking this ticket as 'QA validated'.

Thanks!

jmikell821

LGTM!

) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison (cherry picked from commit 6f0d069)

) (#2106) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison (cherry picked from commit 6f0d069) Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

) (#2107) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison (cherry picked from commit 6f0d069) Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

) (#2108) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison (cherry picked from commit 6f0d069) Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

) (#2109) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison (cherry picked from commit 6f0d069) Co-authored-by: Joe Peeples <joe.peeples@elastic.co>

) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison

* First draft * Add placeholder for instructions for self-hosted * updates formatting * updates format and image size * Updates formatting and annotates screenshots * updates to the main intro and some terms here and there * [DOCS] Revise workaround for aggregated fields in threshold rules (#2074) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison * [DOCS][8.3] Updates "Endpoint Security" to "Endpoint and Cloud Security" screenshots (#2075) * Updates screenshots and replaces the old name with the new name. * Updates text, fixes image names * Update docs/getting-started/install-endpoint.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/getting-started/install-endpoint.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Fix bugs found by QA Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Add example response section (#2084) * [DOCS] Add new EQL search configuration options (#2061) * Update eql-rule-query-example.png * Update procedure for creating EQL rule * Update API docs: create rule, update rule * Align minor phrasing * Explain timestamp_field & timestamp_override * Updates based on review feedback * [DOCS] Adds warning about exceptions requiring mappings (#2110) * Move callout about endpoint exceptions to more appropriate section This not was previously at the top-level exceptions section, when it really only applies when adding to the Endpoint rule. * Add note about mappings being required for exceptions Wording is subject to change; just throwing something at the wall for now. * Apply suggestions from code review Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * [DOCS] Removed ref to Stack GS (#2128) * Minor edits to Tin's work * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Matches order of sections to order they're mentioned in the intro * Changes bullets to numbers * Update docs/experimental-features/experimental-features-intro.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/experimental-features-intro.asciidoc * Incorporate Joe's and Janeen's feedback * fixes build error * troubleshoots build error * troubleshoots build error * troubleshoots build erors Co-authored-by: Joe Peeples <joe.peeples@elastic.co> Co-authored-by: Ryland Herrick <ryalnd@gmail.com> Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> Co-authored-by: debadair <debadair@elastic.co> Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com>

* First draft * Add placeholder for instructions for self-hosted * updates formatting * updates format and image size * Updates formatting and annotates screenshots * updates to the main intro and some terms here and there * [DOCS] Revise workaround for aggregated fields in threshold rules (#2074) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison * [DOCS][8.3] Updates "Endpoint Security" to "Endpoint and Cloud Security" screenshots (#2075) * Updates screenshots and replaces the old name with the new name. * Updates text, fixes image names * Update docs/getting-started/install-endpoint.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/getting-started/install-endpoint.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Fix bugs found by QA Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Add example response section (#2084) * [DOCS] Add new EQL search configuration options (#2061) * Update eql-rule-query-example.png * Update procedure for creating EQL rule * Update API docs: create rule, update rule * Align minor phrasing * Explain timestamp_field & timestamp_override * Updates based on review feedback * [DOCS] Adds warning about exceptions requiring mappings (#2110) * Move callout about endpoint exceptions to more appropriate section This not was previously at the top-level exceptions section, when it really only applies when adding to the Endpoint rule. * Add note about mappings being required for exceptions Wording is subject to change; just throwing something at the wall for now. * Apply suggestions from code review Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * [DOCS] Removed ref to Stack GS (#2128) * Minor edits to Tin's work * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Matches order of sections to order they're mentioned in the intro * Changes bullets to numbers * Update docs/experimental-features/experimental-features-intro.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/experimental-features-intro.asciidoc * Incorporate Joe's and Janeen's feedback * fixes build error * troubleshoots build error * troubleshoots build error * troubleshoots build erors Co-authored-by: Joe Peeples <joe.peeples@elastic.co> Co-authored-by: Ryland Herrick <ryalnd@gmail.com> Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> Co-authored-by: debadair <debadair@elastic.co> Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> (cherry picked from commit edeecb9)

* First draft * Add placeholder for instructions for self-hosted * updates formatting * updates format and image size * Updates formatting and annotates screenshots * updates to the main intro and some terms here and there * [DOCS] Revise workaround for aggregated fields in threshold rules (#2074) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison * [DOCS][8.3] Updates "Endpoint Security" to "Endpoint and Cloud Security" screenshots (#2075) * Updates screenshots and replaces the old name with the new name. * Updates text, fixes image names * Update docs/getting-started/install-endpoint.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/getting-started/install-endpoint.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Fix bugs found by QA Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Add example response section (#2084) * [DOCS] Add new EQL search configuration options (#2061) * Update eql-rule-query-example.png * Update procedure for creating EQL rule * Update API docs: create rule, update rule * Align minor phrasing * Explain timestamp_field & timestamp_override * Updates based on review feedback * [DOCS] Adds warning about exceptions requiring mappings (#2110) * Move callout about endpoint exceptions to more appropriate section This not was previously at the top-level exceptions section, when it really only applies when adding to the Endpoint rule. * Add note about mappings being required for exceptions Wording is subject to change; just throwing something at the wall for now. * Apply suggestions from code review Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * [DOCS] Removed ref to Stack GS (#2128) * Minor edits to Tin's work * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Matches order of sections to order they're mentioned in the intro * Changes bullets to numbers * Update docs/experimental-features/experimental-features-intro.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/security-posture-management.asciidoc Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> * Update docs/experimental-features/experimental-features-intro.asciidoc * Incorporate Joe's and Janeen's feedback * fixes build error * troubleshoots build error * troubleshoots build error * troubleshoots build erors Co-authored-by: Joe Peeples <joe.peeples@elastic.co> Co-authored-by: Ryland Herrick <ryalnd@gmail.com> Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> Co-authored-by: debadair <debadair@elastic.co> Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> (cherry picked from commit edeecb9) Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison

Remove workaround from create rule docs

c9c6b85

joepeeples added Team: Docs Team: Detections/Response Detections and Response v8.3.0 Team: Security Solution Feature: Alerts labels Jun 15, 2022

joepeeples self-assigned this Jun 15, 2022

joepeeples marked this pull request as ready for review June 15, 2022 21:07

joepeeples requested a review from madirey June 15, 2022 21:07

joepeeples mentioned this pull request Jun 15, 2022

[DOCS] Threshold Rule actions can target aggregated fields directly #2016

Closed

joepeeples added 2 commits June 20, 2022 13:54

Merge branch 'main' into issue-2016-threshold-rule-agg-actions

3c522b9

Restore admonition, with revisions from Madison

ceb1afa

joepeeples requested a review from a team June 20, 2022 18:05

joepeeples added the readyforQA PRs that are ready for QA review. label Jun 20, 2022

joepeeples changed the title ~~[DOCS] Remove workaround for aggregated fields in threshold rules~~ [DOCS] Revise workaround for aggregated fields in threshold rules Jun 21, 2022

madirey approved these changes Jun 21, 2022

View reviewed changes

joepeeples added v8.0.0 v8.1.0 v8.2.0 labels Jun 21, 2022

ghost added QA:Validated Issue has been Validated by QA Team and removed readyforQA PRs that are ready for QA review. labels Jun 22, 2022

jmikell821 approved these changes Jun 22, 2022

View reviewed changes

Merge branch 'main' into issue-2016-threshold-rule-agg-actions

06f3e92

joepeeples merged commit 6f0d069 into main Jun 22, 2022

mergify bot pushed a commit that referenced this pull request Jun 22, 2022

[DOCS] Revise workaround for aggregated fields in threshold rules (#2074

79d93a2

) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison (cherry picked from commit 6f0d069)

mergify bot mentioned this pull request Jun 22, 2022

[8.3] [DOCS] Revise workaround for aggregated fields in threshold rules (backport #2074) #2106

Merged

mergify bot pushed a commit that referenced this pull request Jun 22, 2022

[DOCS] Revise workaround for aggregated fields in threshold rules (#2074

ca39d59

) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison (cherry picked from commit 6f0d069)

mergify bot mentioned this pull request Jun 22, 2022

[8.2] [DOCS] Revise workaround for aggregated fields in threshold rules (backport #2074) #2107

Merged

mergify bot pushed a commit that referenced this pull request Jun 22, 2022

[DOCS] Revise workaround for aggregated fields in threshold rules (#2074

1726606

) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison (cherry picked from commit 6f0d069)

mergify bot mentioned this pull request Jun 22, 2022

[8.1] [DOCS] Revise workaround for aggregated fields in threshold rules (backport #2074) #2108

Merged

mergify bot pushed a commit that referenced this pull request Jun 22, 2022

[DOCS] Revise workaround for aggregated fields in threshold rules (#2074

6daaa5e

) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison (cherry picked from commit 6f0d069)

mergify bot mentioned this pull request Jun 22, 2022

[8.0] [DOCS] Revise workaround for aggregated fields in threshold rules (backport #2074) #2109

Merged

joepeeples deleted the issue-2016-threshold-rule-agg-actions branch June 22, 2022 20:45

benironside pushed a commit that referenced this pull request Jun 24, 2022

[DOCS] Revise workaround for aggregated fields in threshold rules (#2074

e15f108

) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison

acorretti pushed a commit that referenced this pull request Nov 19, 2024

[DOCS] Revise workaround for aggregated fields in threshold rules (#2074

34db7c6

) * Remove workaround from create rule docs * Restore admonition, with revisions from Madison

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[DOCS] Revise workaround for aggregated fields in threshold rules #2074

[DOCS] Revise workaround for aggregated fields in threshold rules #2074

Uh oh!

joepeeples commented Jun 15, 2022 •

edited

Loading

Uh oh!

madirey commented Jun 16, 2022

Uh oh!

joepeeples commented Jun 20, 2022

Uh oh!

joepeeples commented Jun 20, 2022

Uh oh!

madirey left a comment

Uh oh!

ghost commented Jun 22, 2022

Uh oh!

jmikell821 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

[DOCS] Revise workaround for aggregated fields in threshold rules #2074

[DOCS] Revise workaround for aggregated fields in threshold rules #2074

Uh oh!

Conversation

joepeeples commented Jun 15, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

madirey commented Jun 16, 2022

Uh oh!

joepeeples commented Jun 20, 2022

Uh oh!

joepeeples commented Jun 20, 2022

Uh oh!

madirey left a comment

Choose a reason for hiding this comment

Uh oh!

ghost commented Jun 22, 2022

Uh oh!

jmikell821 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

joepeeples commented Jun 15, 2022 •

edited

Loading