Open xeniatup opened 11 months ago
Keep in mind that Index Patterns are dashboards saved objects, so if you're creating a detector via the API, you wouldn't have awareness of index patterns. This may need to be an associated index pattern (similar to how we do associated detectors in a visualization). For the index pattern, I suggest exploring "Select existing" and "Create new" as options as well. There may be an index pattern in the system that already covers the given index in the detector.
We currently detect the associated index patterns automatically (selecting the first available one) and proceed from there. The modal appears when there is no index pattern associated.
Is your feature request related to a problem? A user who is investigating a security finding should not have to provide an index pattern to see surrounding documents. Creating an index pattern can be handled upstream, at the time of creating a detector.
Current experience![Kapture 2023-09-18 at 15 55 31](https://github.com/opensearch-project/security-analytics-dashboards-plugin/assets/105245012/c11ea456-dd88-48aa-9c70-018c5bdca2ee)
What solution would you like? An index pattern should be created automatically for the data source (indexes or wildcard pattern) selected at the time of creating a threat detector. There are three potential cases:
What alternatives have you considered? Creating an index pattern with the default name and time fields as part of "View findings details -> View surrounding documents" workflow.