[Request] New feature docs - Bulk Action for Rule Custom Highlighted Fields

[e40pud]

Description

We're introducing a new feature - Bulk Action for Rule Custom Highlighted Fields. Right now there is no option to update custom highlighted fields for multiple rules which makes our customers life harder. With these changes we will address this customer request elastic/kibana#164301 (also covered in this ticket https://github.com/elastic/security-team/issues/8958).

How it works:

1. Select multiple rules
2. Open bulk actions menu
3. Select "Custom highlighted fields" menu item
4. User can add new or delete existing custom highlighted fields

NOTE: The feature works similarly to existing Bulk Index and Bulk Tags rule actions.

Background & resources

• PRs: [Security Solution] Bulk editing rule custom highlighted fields kibana#179312
• Issues/metas: https://github.com/elastic/security-team/issues/8958 and [Security Solution] Add custom highlighted fields through the bulk edit feature kibana#164301
• Point of contact: @e40pud @approksiu @yctercero

Which documentation set does this change impact?

ESS and serverless

ESS release

8.15

Serverless release

Monday, July 15, 2024

Feature differences

This feature is identical in ESS and Serverless

API docs impact

We need to update Possible BulkEditAction object values here https://www.elastic.co/guide/en/security/current/bulk-actions-rules-api.html#bulk-edit-object-schema. There are three new values need to be added to the table:

type field	value field	Description
add_investigation_fields	{ field_names: String[] }	Add custom highlighted fields to rules
delete_investigation_fields	{ field_names: String[] }	Delete rules' custom highlighted fields
set_investigation_fields	{ field_names: String[] }	Overwrite rules' custom highlighted fields

Prerequisites, privileges, feature flags

No pre-reqs for users in Serverless or ESS.

Required doc updates

NOTE: To enable the feature in a test deployment (ESS), will need to add the bulkCustomHighlightedFieldsEnabled: bulkCustomHighlightedFieldsEnabled feature flag to the Kibana’s configuration settings.

• Manage detection rules | Modify existing rules settings: Add bullet to second item in step 2 (put after Tags option).
  • ESS
  • Serverless
• BulkEditAction object | Possible BulkEditAction object values: See notes above about new params to add.
  • ESS
• Create a detection rule | Configure advanced rule settings: Improve docs for the Custom highlighted fields field. Need to note that users can choose from any of the fields included in the default security indices.
  • ESS
  • Serverless

[nastasha-solomon]

Notes for self:

• Follow up with Zhenia on the API params (the field names are for bulk assigning indices) when he's back from PTO.
• The feature is merged into main and is behind a FF. I should be able to enable the FF and test it in a future BC.