[SIEM][Detections] Create Endpoint/Alert pre-packaged promotion rules

[spong]

This issue if for creating the Elastic Endpoint and External Alerts pre-packaged promotion rules that will enable external alerts to be used in investigations. This effort will need to be coordinated with @elastic/security-intelligence-analytics as they manage pre-packaged rule additions.

This will require the additional Detection Rule fields from #65941.

Update: @peluja1012 and I met with the I&A folks on 13-MAY to outline these changes and the overall workflow around the promotion rules. Once #65941 is complete, we'll open an issue in the elastic/siem-rules repo detailing the configuration for the above promotion rules and we'll follow the existing workflow for getting rules into the Detection Engine.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[jonathan-buttner]

@spong I'm working on some functionality for resolver. We'd like to be able to show the enriched information for an alert in the resolver UI. In the kibana backend how would I go about querying for the enriched information like who the alert is assigned to, whether it is archived, etc?

Would all that information be stored in .siem-signals-default?

[spong]

Correct @jonathan-buttner, all that enriched information will be stored on the alert in the .siem-signals-[space] index. Note: the index name can be overridden using the following kibana.yml config: xpack.securitySolution.signalsIndex. For enrichment, we don't currently have assigned_to, but there is status that can be marked as open or closed, and we're adding support for in_progress as part of this issue (internal).

While it's just a data index (so you can query with the Elasticsearch DSL), we do have some helper API's for fetching Alerts and updating their status. Just a heads up that while the front end has been migrated from signals->alerts, the server still uses signals for the time being.

• Signals API readme
• Signals API test scripts
• Signals API docs

[spong]

First half if this has been completed as part of elastic/detection-rules#42 to get the rules into the detection-rules repo. Next step will be the PR from the I&A team for getting this into Kibana which is located here: #71332

[spong]

Closing as #71332 has been merged! 🙂