Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Detection Engine][Exceptions] - Update docs for single and shared exceptions #4021

Open
wants to merge 42 commits into
base: main
Choose a base branch
from

Conversation

nastasha-solomon
Copy link
Contributor

@nastasha-solomon nastasha-solomon commented Oct 9, 2023

Fixes #3491.

Previews:

  • Elastic Security APIs: Refreshed the description for the Detections API since it technically allows users to manage rule exceptions for individual rules
  • Detections API: Added endpoints for creating a default exception list and creating exception items for a single rule
  • Create a default exception list for a rule: New page that shows how to create an exception list for a single rule (a default exception list)
  • Create exceptions for individual rules: New page that shows how to create exception items that you can add to a default exception list
  • Create exception container | Request body: Added the rule_default value to the type parameter description. Users would enter this value if they wanted the exception container to hold single-rule exception lists (i.e., the default exception list for a rule).
  • Create exceptions used by multiple rules: Made several changes:
    • Updated the title and intro para to show that this endpoint should be used to create exception items that are shared between multiple rules.
    • Added note to the intro that allows users to find docs for creating single rule exception items and exception items created from lists.
    • Fixed or refreshed docs for the following request params: comments, namespace_type, os_types, tags, and list

@github-actions
Copy link

github-actions bot commented Oct 9, 2023

Documentation previews:

@nastasha-solomon
Copy link
Contributor Author

nastasha-solomon commented Apr 3, 2024

Hey, @yctercero! These docs are ready for your review when you have a chance. As you're reviewing the docs, there are questions for you here about finding rule IDs and here about an example request. I was also hoping you could tell me whether the following endpoints could also be used to manage exception items added to rule default lists:

If they can, I might need to tweak their intros, plus the descriptions for the detections and exception APIs here.

@nastasha-solomon nastasha-solomon marked this pull request as ready for review April 3, 2024 21:33
@nastasha-solomon nastasha-solomon requested a review from a team as a code owner April 3, 2024 21:33
* `process.entity_id`
* `process.parent.entity_id`
* `process.ancestry`
** `file.Ext.quarantine_path`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@caitlinbetz is this still accurate? I know we opened endpoint exceptions up to have less field restrictions, not sure if these still hold.

docs/siem-apis.asciidoc Outdated Show resolved Hide resolved
@benironside benironside force-pushed the issue-3491-exception-item-list branch from 7d01e2c to bf3a09f Compare November 19, 2024 19:11
yctercero
yctercero previously approved these changes Jan 13, 2025
Copy link
Contributor

@yctercero yctercero left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks so much for these updates - this is great. Left a super minor comment.

Copy link
Contributor

@benironside benironside left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great work on the new pages. I left a few comments, hope they're helpful. Let me know if you'd like me to take another look.

nastasha-solomon and others added 6 commits January 14, 2025 09:22
…ion-list.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>
…ion-list.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>
…on-item.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>
yctercero
yctercero previously approved these changes Jan 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Detection Engine][Exceptions] - Document exception item list types API side
4 participants