search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.67k stars 8.23k forks source link

[Security Solution][Alerts] Log actual queries executed by detection engine #141463

Open marshallmain opened 2 years ago

marshallmain commented 2 years ago

In some cases the detection engine dynamically loads data by reference that becomes part of the rule's query logic. Current examples include saved queries and exceptions. We don't keep detailed records of the generated queries in the alerts for each rule execution, instead the alerts only contain the IDs that reference the dynamically loaded data.

As a result, it's impossible to accurately reproduce a detection rule query from an alert document if the saved query/exception items have changed since the alert was generated. It would be good to build a record of the actual generated query, including the dynamically loaded portions.

elasticmachine commented 2 years ago

Pinging @elastic/security-solution (Team: SecuritySolution)