Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution][Exceptions] - Add exception flyout from alert details #143015

Closed
11 tasks
yctercero opened this issue Oct 10, 2022 · 1 comment
Closed
11 tasks
Labels
Feature:Rule Exceptions Security Solution Detection Rule Exceptions area Team:Security Solution Platform Security Solution Platform Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.6.0

Comments

@yctercero
Copy link
Contributor

Use cases

  • As a detection engineer or analyst I want to be able to add exception to rule alert associated with.
  • As a detection engineer or analyst I want to be able to add one or more rule exceptions to a shared list.
  • As a detection engineer or analyst I want to be able to add endpoint exception

To Do

  • User can name their exception
  • User can add entries (like our existing UI)
  • User can assign exception item to default rule list
  • User can assign exception to shared exception lists
    • If rule does not have any shared exception lists assigned, option to add to shared list is disabled
  • User can add comment
  • User can select to close single alert
  • User can select to bulk close alerts (if conditions met)

Design

Check figma for latest design.

Screen Shot 2022-10-10 at 12 02 03 PM

Initial strategy

  • Existing flyout can be used and will just need to modify in order to add functionality of assigning to multiple rules and allowing user to add a name
  • All necessary APIs exist
@yctercero yctercero added Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Feature:Rule Exceptions Security Solution Detection Rule Exceptions area Team:Security Solution Platform Security Solution Platform Team v8.6.0 labels Oct 10, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature:Rule Exceptions Security Solution Detection Rule Exceptions area Team:Security Solution Platform Security Solution Platform Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.6.0
Projects
None yet
Development

No branches or pull requests

3 participants