[Security Solution] "threat.indicator.matched.type" field is displayed as "indicator_match_rule" value for threat indicator Rule.

[ghost]

Describe the bug
threat.indicator.matched.type field is displayed as "indicator_match_rule" value for threat indicator Rule.

Build Details:

VERSION: 7.14.0 BC2
BUILD: 42401
COMMIT: 9826a943dc2e47f26ec6de94816e7d297b752994
ARTIFACT: https://staging.elastic.co/7.14.0-e99135ef/summary-7.14.0.html

Browser Details:
N/A

Browser Details
All

Preconditions
1.Kibana users should be logged in.
2. Filebeat should be installed.

Steps to Reproduce

1. Navigate to Dev tools add the following:

Create an index

PUT /mydata/

PUT /mydata/_mapping
{
"properties":{
"@timestamp":{
"type":"date"
},
"hash":{
"properties":{
"md5":{
"ignore_above":1024,
"type":"keyword"
}
}
}
}
}

POST /mydata/_doc/
{
"@timestamp": "2021-02-22T21:00:49.337Z",

    "hash": {
      "md5": "eec5c6c219535fba3a0492ea8118b397"
    }
}

2. Navigate to create a new rule under security app.
3. Click on the Indicator match rule.
4. In Index pattern add the "mydata" index.
5. Custom query: ":"
6. Indicator index patterns : filebeat-*
7. Indicator index query: ":"
8. In Indicator mapping add: field: hash.md5 and Indicator index field: threatintel.indicator.file.hash.md5
9. In about Section add the rule name.
10. In the schedule section add run every: 10 seconds and Additional look-back time: 30000 hours
11. Create and activate the rule.
12. Generate the alerts.
13. Add the field "threat.indicator.matched.type" in alerts table.
14. Observe that threat.indicator.matched.type field is displayed as "indicator_match_rule" value for threat indicator Rule.

Actual Result
threat.indicator.matched.type field is displayed as "indicator_match_rule" value for threat indicator Rule.

Expected Result
threat.indicator.matched.type field should display as "file" value for threat indicator Rule.

What's Working

• This issue is not occurring on 7.13.0.
  

What's Not Working

• N/A

Screen-Shot

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[ghost]

@manishgupta-qasource Please review!!

[manishgupta-qasource]

Reviewed & Assigned to @MadameSheema

[MadameSheema]

@ecezalp @rylnd can you please take a look at this? thanks :)

[ecezalp]

the observed behavior is intentional and is partly relevant to the conversation here.

To summarize, the information convened in threat.indicator.matched.type is intentionally overridden with the name of the matching strategy used within the security_solution, and it can have the values indicator_match_rule or investigation_time. The information that was previously displayed with threat.indicator.matched.type can be found under threat.indicator.type.

Considering that no changes are planned for this behavior, I am closing the issue. Please reopen if there are any additional concerns.