Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
update rule query clarification (#2985)
The example 2 provided in the documentation has a few typos and is using an incorrect parameter. Also the documentation on the "params" in the action schema could use an example. https://www.elastic.co/guide/en/security/current/bulk-actions-rules-api.html#actions-object-schema-bulk  It can be difficult to apprehend that you need to define it as a list with a single item that is an array. An example would have made it a lot more clear. Like for example: ``` POST api/detection_engine/rules/_bulk_action "query": "alert.attributes.params.severity: \"critical\"", "action": "edit", "edit": [ { "type": "set_rule_actions", "value": { "actions": [ { "id": "id", "group": "default", "params": { "subAction": "pushToService", "subActionParams": { "incident": { "issueType": "10009", "priority": "Critical", "description": "{{#context.alerts}}\n*Host:* {{host.name}} ({{source.ip}}) *OS:* {{host.os.name}} {{host.os.version}}\n*Time:* {{event.start}} - {{event.end}}\n*Reason:* {{signal.reason}}\n\n*------------------ Optional Fields ------------------*\n*Username:* {{winlog.user.name}} - {{user.name}}\n*File name:* {{file.name}}\n*Process Name:* {{process.name}} \n*Parent Process:* {{parent.process.name}}\n*-----------------------------------------------------*\n{{/context.alerts}}\n\n*Count of events:* {{state.signals_count}}\n\n*Link:* TENANTURL{{{context.results_link}}}", "summary": "{{context.rule.name}} - {{context.rule.severity}}" }, "comments": [ { "commentId": "1", "comment": "*Description:* {{context.rule.description}}\n\n*Rule Severity:* {{context.rule.severity}}\n\n*References:* {{context.rule.references}}\n\n*Possible false positive reason:* {{context.rule.false_positives}}\n\n*MITRE ATT&CK and ID:* {{context.rule.threat}}" } ] } } }, { "group": "default", "id": "id", "params": { "message": "# **{{context.rule.name}}**\n\n**Alerts:** {{state.signals_count}}\n\n**Severity:** {{context.rule.severity}}\n\n**Kibana URL:** TENANTURL{{{context.results_link}}}" } } ], "throttle": "rule" } } ] ```
- Loading branch information