Skip to content

[DOCS] Updates Create Rule API docs for Threshold and Indicator Match Rules #522

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
spong merged 4 commits into from
Mar 9, 2021
Merged

[DOCS] Updates Create Rule API docs for Threshold and Indicator Match Rules #522

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
df4e51d
Adds updated fields for threshold and threat match rules
spong Feb 19, 2021
b3aa287
Update docs/detections/api/rules/rules-api-create.asciidoc
spong Feb 24, 2021
ce07b79
Threshold cardinality updates
madirey Mar 8, 2021
b64f3ff
Typo
madirey Mar 8, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions docs/detections/api/rules/rules-api-create.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,9 +160,14 @@ whether an alert is generated.
|threshold |Object a|Defines the field and threshold value for when alerts
are generated, where:

* `field` (string, required): The field on which the threshold is applied. If
* `cardinality_field` (string, required): The field on which the cardinality is applied. If
Comment thread
spong marked this conversation as resolved.
Outdated
you specify an empty field (`""`), alerts are generated when the query returns
at least the number of results specified in the `value` field.
* `cardinality_value` (integer, required): The threshold value from which an alert is
generated based on unique number of values of cardinality_field.
* `field` (string or string[], required): The field on which the threshold is applied. If
you specify an empty array (`[]`), alerts are generated when the query returns
at least the number of results specified in the `value` field.
* `value` (integer, required): The threshold value from which an alert is
generated.

Expand Down Expand Up @@ -336,9 +341,12 @@ a detection rule exception (`detection`) or an endpoint exception (`endpoint`).
|==============================================
|Name |Type |Description

|threat_filter |Object[]
|threat_filters |Object[]
|{ref}/query-filter-context.html[Query and filter context] array used to filter
documents from the {es} index containing the threat values.

|threat_indicator_path |String
|Much like an ingest processor, users can use this field to define where their threat indicator can be found on their indicator documents.
Comment thread
spong marked this conversation as resolved.
Outdated
Comment thread
spong marked this conversation as resolved.
Outdated
|==============================================

[[opt-fields-query-threshold]]
Expand Down