Skip to content

Commit ba7f483

Browse files
[8.18] Logged ES queries now provided for new terms, machine learning, custom query, threshold rule types (#6655)
* First draft * Update rules-ui-create.asciidoc * extra space
1 parent 51a8648 commit ba7f483

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

docs/detections/rules-ui-create.asciidoc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -827,9 +827,9 @@ TIP: Avoid setting long time ranges with short rule intervals, or the rule previ
827827
[[view-rule-es-queries]]
828828
==== View your rule's {es} queries (optional)
829829

830-
NOTE: This option is only offered for {esql} and event correlation rules.
830+
NOTE: This option is offered for all rule types except indicator match rules.
831831

832-
When previewing a rule, you can also learn about its {es} queries, which are submitted when the rule runs. This information can help you identify and troubleshoot potential rule issues. You can also use it to confirm that your rule is retrieving the expected data.
832+
When previewing a rule, you can also examine the {es} queries that are submitted when the rule runs. Use this information to identify and troubleshoot potential rule issues and confirm that your rule is retrieving the expected data.
833833

834834
To learn more about your rule's {es} queries, preview its results and do the following:
835835

@@ -838,6 +838,6 @@ To learn more about your rule's {es} queries, preview its results and do the fol
838838
. Expand each row to learn more about the {es} queries that the rule submits each time it executes. The following details are provided:
839839
** When the rule execution started, and how long it took to complete
840840
** A brief explanation of what the {es} queries do
841-
** The actual {es} queries that the rule submits to indices containing events that are used during the rule execution
841+
** The first two {es} queries that the rule submits to indices containing events that are used during the rule execution
842842
+
843843
TIP: Run the queries in {kibana-ref}/console-kibana.html[Console] to determine if your rule is retrieving the expected data. For example, to test your rule’s exceptions, run the rule’s {es} queries, which will also contain exceptions added to the rule. If your rule’s exceptions are working as intended, the query will not return events that should be ignored.

0 commit comments

Comments
 (0)