[Security Solution] Show count field on Rule details page for threshold rules

[vitaliidm]

Describe the bug:

Threshold's rule count field is not displaying on Rule details page

Kibana/Elasticsearch Stack version:
Every version

Steps to reproduce:

1. Create threshold rule with Count field populated
2. Open rule details, field count is not displayed

Current behavior:
Threshold's rule count field is not displaying on Rule details page

Expected behavior:

Threshold's rule count field should be displayed on Rule details page

Screenshots (if relevant):

Edit page

Details page

Any additional context (logs, chat logs, magical formulas, etc.):

Function that displays threshold configuration, doesn't process threshold.cardinality property, only threshold.value and threshold.field properties from threshold object configuration

    "threshold": {
        "field": [
            "event.type"
        ],
        "value": 10,
        "cardinality": [
            {
                "field": "network.bytes",
                "value": 1000
            }
       ]
}

https://github.com/elastic/kibana/blob/8.8/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.tsx#L420-L433

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[banderror]

For anyone who's tracking this issue: at the moment, this issue is being tracked by the team, but unfortunately due to lack of capacity and other priorities it’s not being considered for development in the near future. We will consider revisiting this in a few months, and hopefully, we'll fix it in one of the next stack releases.

[shayfeld]

Hi @banderror @vitaliidm ,
Would you be able to provide any update on this case?
As my SOC operation has been waiting for a long time.

[banderror]

@shayfeld No update on this one, unfortunately. Our team is working on a large new feature a lot of users have been waiting for a long time + a few other things we cannot deprioritize for other reasons. No capacity for this in 8.14. I'll add an 8.15 label and try to squeeze it in.

But I hope the large feature we're working on -- customizing prebuilt rules -- is something you might find useful as well. Public issue for tracking: #174168.

[shayfeld]

@banderror , Do you think the feature will be released on 8.17 and not delayed?

[banderror]

@shayfeld There is a chance that we will have some freed up resources to work on that closer to the end of this year. I'm keeping this ticket in our mid-term plan, but we haven't yet committed to fix this bug in a specific version.