[Security Solution][Detections] Rule context.results_link can become stale with no clear way to update

[spong]

It's been reported that the context.results_link within Rule Actions can become stale and there is no clear or documented way for users to update it, resulting in broken links within actions.

The context.results_link field is stored in {meta: {kibana_siem_app_url: "url}} on individual rules, and is only updated when a rule is edited. This field is not exposed to the user in the UI, and so it is not clear that this action will update the results_link field.

This is especially problematic for a deployment changing domains, as the only way via the UI to ensure all their rules are using the updated results_link is to manually edit each rule. Alternatively, this could be automated via the API or performed as a bulk find/replace by exporting, editing, and re-importing all the rules.

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[LaZyDK]

I have this issue.

[chadnormanimpact]

I have this issue

[yctercero]

@banderror was this field addressed as part of the prebuilt rule customization effort? Wondering if it is now exposed?

[banderror]

@yctercero I don't think we've touched the meta object during the work on rule customization. @jpdjere Could you confirm?

[jpdjere]

Hi @yctercero and @banderror

We haven't done any changes to this field, it can still be updated by our PATCH and PUT endpoints.

Also, it has been left out of the upgrade workflow: the field is not part of the APIs to upgrade a rule - during upgrade it will be always be forcefully "updated" to whatever the current value for the field is.

[yctercero]

Thanks @jpdjere ! What would be the effort to surface it in the UI? It seems to be an issue a number of users hit. cc @approksiu

[banderror]

@yctercero I don't think it's possible to give a good answer to the question "What would be the effort to surface it in the UI?" without first discussing it with the product/UX team in order to understand what we'd like to have in that UI.