search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.73k stars 8.14k forks source link

[SecuritySolution] Rule exceptions are not added as filters when investigating alerts in timeline #183723

Open angorayc opened 4 months ago

angorayc commented 4 months ago

Kibana version: 8.13.2

Bug description: When generating alerts with Threshold rule, it wouldn't add rule exception as timeline filters when investigating an alert with the row action. The timeline filters added by investigating in timeline row action are not specific alert id, it's the fields that the threshold is aggregating on. Without the bringing the rule exception filters, there will be too many alerts appear in the timeline.

Expected: It should always add rule exceptions as filters when adding alerts to timeline unless it is only investigated by alert id.

Steps to reproduce (on 8.14 dev environment):

https://drive.google.com/drive/folders/1YTkViUjmgxUGZWGgilI6HWcxmpJFxoge?usp=sharing

elasticmachine commented 4 months ago

Pinging @elastic/security-detection-engine (Team:Detection Engine)