elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.77k stars 8.17k forks source link

[Security Solution] Support filtering by "custom", "prebuilt customized", and "prebuilt non-customized" #180169

Open jpdjere opened 6 months ago

jpdjere commented 6 months ago

Epics: https://github.com/elastic/security-team/issues/1974 (internal), https://github.com/elastic/kibana/issues/174168 Design Discussion context: https://github.com/elastic/kibana/issues/178211

Summary

elasticmachine commented 6 months ago

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine commented 6 months ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 6 months ago

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

nikitaindik commented 3 months ago

Transitioning this back in "Todo" as I need to switch to another ticket.

Here's some info for future reference. I came up with this KQL query to filter by "prebuilt non-customized":

(alert.attributes.params.immutable: true AND NOT alert.attributes.params.ruleSource.isCustomized: *) OR alert.attributes.params.ruleSource.isCustomized: false