Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[DOCS] Add new EQL search configuration options #2061

Merged
merged 11 commits into from
Jun 23, 2022
Merged

[DOCS] Add new EQL search configuration options #2061

merged 11 commits into from
Jun 23, 2022

Conversation

joepeeples
Copy link
Contributor

@joepeeples joepeeples commented Jun 13, 2022 •
edited
Loading

@joepeeples joepeeples self-assigned this Jun 13, 2022
@joepeeples joepeeples marked this pull request as ready for review June 15, 2022 15:18
benironside
benironside reviewed Jun 15, 2022
View reviewed changes
Copy link
Contributor

@benironside benironside left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, left one minor comment/question.

docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved
@e40pud
Copy link
Contributor

e40pud commented Jun 16, 2022

LGTM! thank you!

nastasha-solomon
nastasha-solomon reviewed Jun 20, 2022
View reviewed changes
Copy link
Contributor

@nastasha-solomon nastasha-solomon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left one minor comment that applies to all other areas that mention ascending order. Otherwise, LGTM!

docs/detections/api/rules/rules-api-create.asciidoc Outdated Show resolved Hide resolved
jmikell821
jmikell821 reviewed Jun 22, 2022
View reviewed changes
Copy link
Contributor

@jmikell821 jmikell821 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just added my two cents to what was already mentioned. LGTM though - thanks! 🎉

docs/detections/api/rules/rules-api-create.asciidoc Outdated Show resolved Hide resolved
docs/detections/rules-ui-create.asciidoc Outdated Show resolved Hide resolved
@joepeeples joepeeples added the readyforQA PRs that are ready for QA review. label Jun 22, 2022
@ghost
Copy link

ghost commented Jun 23, 2022

Hi @joepeeples ,

We tested the linked docs and found that all the docs are correctly updated as per the latest UI. So we are good to go ahead and merge the changes.

Screenshots:
Create a detection rule | Create an event correlation rule

image

Create rule API | Optional fields for event correlation rules

image

Update rule API | Optional fields for EQL rules

image

Hence, we are marking this ticket as 'QA validated'.

Thanks!

@ghost ghost added QA:Validated Issue has been Validated by QA Team and removed readyforQA PRs that are ready for QA review. labels Jun 23, 2022
@joepeeples joepeeples mentioned this pull request Jun 23, 2022
Closed
15 tasks
@joepeeples joepeeples merged commit 3f2f653 into main Jun 23, 2022
mergify bot pushed a commit that referenced this pull request Jun 23, 2022
@joepeeples @mergify
[DOCS] Add new EQL search configuration options (#2061)
0406a6d 
* Update eql-rule-query-example.png

* Update procedure for creating EQL rule

* Update API docs: create rule, update rule

* Align minor phrasing

* Explain timestamp_field & timestamp_override

* Updates based on review feedback

(cherry picked from commit 3f2f653)
@mergify mergify bot mentioned this pull request Jun 23, 2022
Merged
joepeeples added a commit that referenced this pull request Jun 23, 2022
@mergify @joepeeples
[DOCS] Add new EQL search configuration options (#2061) (#2114)
7e79f2e 
* Update eql-rule-query-example.png

* Update procedure for creating EQL rule

* Update API docs: create rule, update rule

* Align minor phrasing

* Explain timestamp_field & timestamp_override

* Updates based on review feedback

(cherry picked from commit 3f2f653)

Co-authored-by: Joe Peeples <[email protected]>
@joepeeples joepeeples deleted the issue-2018-EQL-rule-config-options branch June 23, 2022 20:42
rylnd added a commit that referenced this pull request Jun 23, 2022
@rylnd
Merge branch 'main' into adds_exceptions_mapping_warning
e0f5d6a 
* main:
  [DOCS] Add new EQL search configuration options (#2061)
  Add example response section (#2084)
  [DOCS][8.3] Updates "Endpoint Security" to "Endpoint and Cloud Security" screenshots (#2075)
benironside pushed a commit that referenced this pull request Jun 24, 2022
@joepeeples @benironside
[DOCS] Add new EQL search configuration options (#2061)
ea9c4c7 
* Update eql-rule-query-example.png

* Update procedure for creating EQL rule

* Update API docs: create rule, update rule

* Align minor phrasing

* Explain timestamp_field & timestamp_override

* Updates based on review feedback
benironside added a commit that referenced this pull request Jun 28, 2022
@benironside @joepeeples
@rylnd @nastasha-solomon @debadair @jmikell821
[DOCS][8.3] Create CSPM / KSPM page (#2089)
edeecb9 
* First draft

* Add placeholder for instructions for self-hosted

* updates formatting

* updates format and image size

* Updates formatting and annotates screenshots

* updates to the main intro and some terms here and there

* [DOCS] Revise workaround for aggregated fields in threshold rules (#2074)

* Remove workaround from create rule docs

* Restore admonition, with revisions from Madison

* [DOCS][8.3] Updates "Endpoint Security" to "Endpoint and Cloud Security" screenshots (#2075)

* Updates screenshots and replaces the old name with the new name.

* Updates text, fixes image names

* Update docs/getting-started/install-endpoint.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/getting-started/install-endpoint.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Fix bugs found by QA

Co-authored-by: Joe Peeples <[email protected]>

* Add example response section (#2084)

* [DOCS] Add new EQL search configuration options (#2061)

* Update eql-rule-query-example.png

* Update procedure for creating EQL rule

* Update API docs: create rule, update rule

* Align minor phrasing

* Explain timestamp_field & timestamp_override

* Updates based on review feedback

* [DOCS] Adds warning about exceptions requiring mappings (#2110)

* Move callout about endpoint exceptions to more appropriate section

This not was previously at the top-level exceptions section, when it
really only applies when adding to the Endpoint rule.

* Add note about mappings being required for exceptions

Wording is subject to change; just throwing something at the wall for
now.

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <[email protected]>

Co-authored-by: nastasha-solomon <[email protected]>

* [DOCS] Removed ref to Stack GS (#2128)

* Minor edits to Tin's work

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Matches order of sections to order they're mentioned in the intro

* Changes bullets to numbers

* Update docs/experimental-features/experimental-features-intro.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/experimental-features-intro.asciidoc

* Incorporate Joe's and Janeen's feedback

* fixes build error

* troubleshoots build error

* troubleshoots build error

* troubleshoots build erors

Co-authored-by: Joe Peeples <[email protected]>
Co-authored-by: Ryland Herrick <[email protected]>
Co-authored-by: nastasha-solomon <[email protected]>
Co-authored-by: debadair <[email protected]>
Co-authored-by: Janeen Mikell-Straughn <[email protected]>
mergify bot pushed a commit that referenced this pull request Jun 28, 2022
@benironside @mergify
[DOCS][8.3] Create CSPM / KSPM page (#2089)
d538a20 
* First draft

* Add placeholder for instructions for self-hosted

* updates formatting

* updates format and image size

* Updates formatting and annotates screenshots

* updates to the main intro and some terms here and there

* [DOCS] Revise workaround for aggregated fields in threshold rules (#2074)

* Remove workaround from create rule docs

* Restore admonition, with revisions from Madison

* [DOCS][8.3] Updates "Endpoint Security" to "Endpoint and Cloud Security" screenshots (#2075)

* Updates screenshots and replaces the old name with the new name.

* Updates text, fixes image names

* Update docs/getting-started/install-endpoint.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/getting-started/install-endpoint.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Fix bugs found by QA

Co-authored-by: Joe Peeples <[email protected]>

* Add example response section (#2084)

* [DOCS] Add new EQL search configuration options (#2061)

* Update eql-rule-query-example.png

* Update procedure for creating EQL rule

* Update API docs: create rule, update rule

* Align minor phrasing

* Explain timestamp_field & timestamp_override

* Updates based on review feedback

* [DOCS] Adds warning about exceptions requiring mappings (#2110)

* Move callout about endpoint exceptions to more appropriate section

This not was previously at the top-level exceptions section, when it
really only applies when adding to the Endpoint rule.

* Add note about mappings being required for exceptions

Wording is subject to change; just throwing something at the wall for
now.

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <[email protected]>

Co-authored-by: nastasha-solomon <[email protected]>

* [DOCS] Removed ref to Stack GS (#2128)

* Minor edits to Tin's work

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Matches order of sections to order they're mentioned in the intro

* Changes bullets to numbers

* Update docs/experimental-features/experimental-features-intro.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/experimental-features-intro.asciidoc

* Incorporate Joe's and Janeen's feedback

* fixes build error

* troubleshoots build error

* troubleshoots build error

* troubleshoots build erors

Co-authored-by: Joe Peeples <[email protected]>
Co-authored-by: Ryland Herrick <[email protected]>
Co-authored-by: nastasha-solomon <[email protected]>
Co-authored-by: debadair <[email protected]>
Co-authored-by: Janeen Mikell-Straughn <[email protected]>
(cherry picked from commit edeecb9)
benironside added a commit that referenced this pull request Jun 28, 2022
@mergify @benironside
[DOCS][8.3] Create CSPM / KSPM page (#2089) (#2154)
09df482 
* First draft

* Add placeholder for instructions for self-hosted

* updates formatting

* updates format and image size

* Updates formatting and annotates screenshots

* updates to the main intro and some terms here and there

* [DOCS] Revise workaround for aggregated fields in threshold rules (#2074)

* Remove workaround from create rule docs

* Restore admonition, with revisions from Madison

* [DOCS][8.3] Updates "Endpoint Security" to "Endpoint and Cloud Security" screenshots (#2075)

* Updates screenshots and replaces the old name with the new name.

* Updates text, fixes image names

* Update docs/getting-started/install-endpoint.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/getting-started/install-endpoint.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Fix bugs found by QA

Co-authored-by: Joe Peeples <[email protected]>

* Add example response section (#2084)

* [DOCS] Add new EQL search configuration options (#2061)

* Update eql-rule-query-example.png

* Update procedure for creating EQL rule

* Update API docs: create rule, update rule

* Align minor phrasing

* Explain timestamp_field & timestamp_override

* Updates based on review feedback

* [DOCS] Adds warning about exceptions requiring mappings (#2110)

* Move callout about endpoint exceptions to more appropriate section

This not was previously at the top-level exceptions section, when it
really only applies when adding to the Endpoint rule.

* Add note about mappings being required for exceptions

Wording is subject to change; just throwing something at the wall for
now.

* Apply suggestions from code review

Co-authored-by: nastasha-solomon <[email protected]>

Co-authored-by: nastasha-solomon <[email protected]>

* [DOCS] Removed ref to Stack GS (#2128)

* Minor edits to Tin's work

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: nastasha-solomon <[email protected]>

* Matches order of sections to order they're mentioned in the intro

* Changes bullets to numbers

* Update docs/experimental-features/experimental-features-intro.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Joe Peeples <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/security-posture-management.asciidoc

Co-authored-by: Janeen Mikell-Straughn <[email protected]>

* Update docs/experimental-features/experimental-features-intro.asciidoc

* Incorporate Joe's and Janeen's feedback

* fixes build error

* troubleshoots build error

* troubleshoots build error

* troubleshoots build erors

Co-authored-by: Joe Peeples <[email protected]>
Co-authored-by: Ryland Herrick <[email protected]>
Co-authored-by: nastasha-solomon <[email protected]>
Co-authored-by: debadair <[email protected]>
Co-authored-by: Janeen Mikell-Straughn <[email protected]>
(cherry picked from commit edeecb9)

Co-authored-by: Benjamin Ironside Goldstein <[email protected]>
acorretti pushed a commit that referenced this pull request Nov 19, 2024
@joepeeples @benironside
[DOCS] Add new EQL search configuration options (#2061)
1118789 
* Update eql-rule-query-example.png

* Update procedure for creating EQL rule

* Update API docs: create rule, update rule

* Align minor phrasing

* Explain timestamp_field & timestamp_override

* Updates based on review feedback
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@benironside benironside benironside left review comments

@nastasha-solomon nastasha-solomon nastasha-solomon left review comments

@jmikell821 jmikell821 jmikell821 left review comments

@e40pud e40pud e40pud approved these changes

@marshallmain marshallmain Awaiting requested review from marshallmain

Assignees

@joepeeples joepeeples

Labels
Feature: Rules QA:Validated Issue has been Validated by QA Team Team: Detections/Response Detections and Response Team: Docs v8.3.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[DOCS] Add new EQL search configuration options
5 participants
@joepeeples @e40pud @jmikell821 @nastasha-solomon @benironside