[Feature] Support for Kibana Security Detection rule

[othmane399]

Is your feature request related to a problem? Please describe.
Today we cannot use elasticstack_kibana_alerting_rule for Security Detection rules according to #480

Describe the resource you would like to have implemented.
https://www.elastic.co/guide/en/security/current/rules-api-create.html

Describe the solution you'd like
A new elasticstack_kibana_security_detection_rule resource similar to the elasticstack_kibana_alerting_rule

[morgan-atwood]

Hey update on this? We have several customers looking for this to manage siem detection rules.

[dmaasland]

You can actually kinda do this already (I haven't tested with a null notify_when):

terraform {
  required_providers {
    elasticstack = {
      source  = "elastic/elasticstack"
      version = "0.11.4"
    }
  }
}

provider "elasticstack" {
  kibana {
    endpoints = ["endpoint:9243"]
    api_key   = "apikey"
  }
}

resource "elasticstack_kibana_alerting_rule" "example" {
  name = "Terraform Test Rule"
  tags = [
    "Inspect",
    "Account",
    "Account Manipulation",
    "Account Access Removal",
    "Create Account",
    "Users & Accounts"
  ]
  rule_type_id = "siem.eqlRule"
  consumer     = "siem"
  interval     = "5m"
  notify_when  = "onActiveAlert"
  space_id     = "some-space"


  params = jsonencode({
    "author" : [],
    "description" : "Some description",
    "falsePositives" : [],
    "from" : "now-2100s",
    "ruleId" : "1984fee0-45f3-45b7-892d-0599d1f3f01b",
    "immutable" : false,
    "ruleSource" : {
      "type" : "internal"
    },
    "license" : "",
    "outputIndex" : "",
    "timelineId" : "76e52245-7519-4251-91ab-262fb1a1728c",
    "timelineTitle" : "Generic Process Timeline",
    "maxSignals" : 100,
    "riskScore" : 55,
    "riskScoreMapping" : [],
    "ruleNameOverride" : "",
    "severity" : "medium",
    "severityMapping" : [],
    "timestampOverride" : "event.ingested",
    "timestampOverrideFallbackDisabled" : false,
    "threat" : [],
    "to" : "now",
    "references" : [
      "https://attack.mitre.org/techniques/T1136/",
      "https://attack.mitre.org/techniques/T1098/",
      "https://attack.mitre.org/techniques/T1531/",
      "https://attack.mitre.org/techniques/T1548/",
      "https://attack.mitre.org/techniques/T1562/",
      "https://attack.mitre.org/techniques/T1556/",
      "https://attack.mitre.org/techniques/T1528/"
    ],
    "version" : 1,
    "exceptionsList" : [],
    "relatedIntegrations" : [],
    "requiredFields" : [],
    "setup" : "",
    "type" : "eql",
    "language" : "eql",
    "index" : [
      "logs-eset_protect.*"
    ],
    "query" : "any where eset_protect.event.rulename : (\"*[B1003]*\", \"*[B0201]*\", \"*[D0104]*\", \"*[D0105]*\", \"*[E0443]*\", \"*[A1001]*\", \"*[M1000]*\") and eset_protect.event.type != \"Audit_Event\"",
    "filters" : []
    },
  )
}

I just took all the fields in params from the chrome inspector tab so you can probably omit most of them.

Although I agree I would love a dedicated resource for this.

[richlv]

Heya, not to rush anybody, just to clarify expectations - any guesses when could this (and 0.12) be expected?
Asking as in various issues initially June has been mentioned for 0.12, and two weeks ago "in two weeks" was estimated.

[tobio]

@richlv #1292 addresses this issue and is being actively worked on. I'd expect it to be merged pretty soon (i.e days) and 0.12 immediately follow that.

[richlv]

That is wonderful news, thank you so much. Happy to see that all rule types and features like highlighted/investigation fields are included.
Although vibe-coding it does give me major chills, especially given that it might take more time this way than just implementing it right away ;)

At least investigation_fields, exceptions_list (actually a bunch of nested types). I suppose maybe copilot just threw its hands in the air with the nested types?

Didn't spot actions and some other features (rule name or timestamp override etc), presumably those are still pending?

[nick-benoit]

Didn't spot actions and some other features (rule name or timestamp override etc), presumably those are still pending?

@richlv Yes those fields are still a work in progress. I was able to add support for a few of them today. At this point we are planning to support all fields.