[DOCS] Create Threshold-based Rule type #59
Description
Description
Meta issue: elastic/kibana#68409
Mocks: https://www.figma.com/file/yNMzeaGvLkyRvra8Bu2fD2/Threshold-Based-Rules?node-id=140%3A31
In 7.9, user will be given a 3rd type of rule to create in the Elastic Security app - Threshold-Based Rule. Threshold rule lets user select fields and set a threshold count to these fields to be alerted on in the SIEM.
Acceptance Test Criteria
Documentation needed to help instruct users on how to create Threshold-Based Rules with some use case examples.
- User can select Threshold-Based rule when selecting a type of rule to create.
- User will be prompted the steps to enter the Index Pattern, Custom Query, and Field and Count of the threshold rule that it applies to.
- Just like the Detection Rule type, user can select configurations around the rule such as Timeline Template used and Schedule of the frequency of the rule to run on the Rule Engine.
- Use case example: Rule write wants to ensure an alert is generated to detect large number of failed login attempts, so they can select the desired index, query for
registryorauthorizationtypes ofevent.type, and designate those fields to a threshold of 100 counts. This way when an end user attempts to log in 100 times within the time of the rule scheduled, the SIEM will receive an alert about the detected activity.
Notes
- Add the "Team:Docs" label to new issues.
- Be sure to add any necessary screenshots for clarity.
- Include any conditions or caveats that may affect customers.