Create documents based on pre-built rules in Kibana

[charlie-pichette]

There have been requests from a couple teams to have Geneve generate documents that will trigger alerts based on the pre-built rules in Kibana. This would enable developers to create documents that will result in a specific alert being created, or multiple alerts being created.

This enhancement would assist the development teams in designing, building and testing new features.

[spong]

Note: in 8.7 we've removed the filesystem rules bundled with Kibana in favor of a bundled fleet package. The flow stays pretty much the same (first now we install the package which then loads the security_rule assets, and finally install prebuilt rules in the given space), but please see elastic/kibana#139926 for all the details.

If necessary, the version of the security_detection_rules package can be verified in the fleet_packages.json in kibana root (or via the Fleet API once installed). Then installed via the /api/detection_engine/rules/prepackaged route (API Docs), and fetched via the /api/detection_engine/rules route (API Docs).

If wanting to fetch via Rule Name instead of id or rule_id, you can use the /api/detection_engine/rules/_find route (API Docs) that the Rules Table in the Security app uses.

Sample route to return the Potential Shell via Web Server rule would be:

http://localhost:5601/kbn/api/detection_engine/rules/_find?filter=(alert.attributes.name%3A%20%22%5C%22Potential%20Shell%20via%20Web%20Server%22%20)

And of course, can always fetch the latest directly from the detection-rules repo as well.

Please reach out if you have any question, happy to help! 🙂

[cavokz]

Thanks for the heads up, my idea was to use the Kibana API to fetch the rules.

[cavokz]

@spong, @charlie-pichette I see that before the above API can find any rule the prebuilt ones need to be loaded from UI. Is it acceptable for Geneve to not be able to load any rule before they are loaded by the user?

[spong]

@cavokz - there's no need to hit the UI to install the prebuilt rules, they can be installed via the API for any given space using the /api/detection_engine/rules/prepackaged route (docs).

Is it acceptable for Geneve to not be able to load any rule before they are loaded by the user?

That said, I think it is acceptable for Geneve to not have to load the prebuilt rules. A nice to have maybe, but seems fine to rely on the user to install them within Kibana.