[Cloud Security] [Findings] [Vulnerabilities] [Alerts] - Create detection rule

[opauloh]

Summary

It closes #162112

This PR adds the option to create a detection rule from a Vulnerabilities Flyout using the defaults established here.

it also:

• moves the vulnerabilities finding an object to the common schema folder
• moves the reference link logic to a custom function

Screenshot

Take Action Button

Success notification

Rule page after clicking the View rule button

[elasticmachine]

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

[JordanSh]

LGTM 👑, added some comments

[JordanSh]

just wondering, why are we not using the latest-findings/vuln?

[opauloh]

great question, as we plan to deprecate the transforms, having existing rules using the transformed index would make it harder for us to apply backward compatibility in the future. Our transforms routines run every 5 minutes with a 60 seconds delay, and the rule routine runs every hour, there's a small possibility that during this 4 minutes window where data came right after the transform runs, and the rule routine runs, an alert can be triggered before the finding can be seen in the UI, but that's just a couple of minutes delay and worth not having to deal with Backward compatibility later.

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 3902398

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
cloudSecurityPosture	220	222	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
cloudSecurityPosture	255.1KB	257.1KB	+2.0KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
cloudSecurityPosture	13.1KB	13.3KB	+258.0B

History

• 💔 Build #150335 failed d791b61
• 💔 Build #150296 failed 7bec744
• 💚 Build #149826 succeeded 237a085
• 💚 Build #149452 succeeded 1d2f484
• 💚 Build #149054 succeeded 3b6b2a1

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream