[Security Solution] Expiration Option for Security Detection Rule Exceptions

[MakoWish]

Describe the feature:

Create an option for exceptions on detection rules to expire at a specified date/time.

Describe a specific use case for the feature:

In our environment, documented exceptions to any of our security policies have a maximum validity of one year; no exceptions are permanent. For this reason, I would love to see a feature in Kibana to set an expiration on exceptions to detection rules. This would save a lot of time with cleaning up detection rule exceptions once our internal exceptions to security policies expire.

Let's say a team member requested permission to SSH into a service on the internet for a project that will last 30 days. A Security Policy Exception Request (internal document) was drafted, routed for approvals, and was ultimately approved. I then add an exception for user.name: "janedoe" and destination.ip: "1.2.3.4" to the detection rule SSH (Secure Shell) to the Internet. Once that 30 days has elapsed, we would want to know if Jane is still performing these SSH connections without having to remember to remove the exception from the rule. If we could have set an expiration date on the exception, it would automate the removal of these temporary exceptions.

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[nreese]

@MakoWish please add Team: labels to avoid issues with needs-team label. Otherwise, this adds additional work for kibana maintainers who have to manually go through issues and clean up issues without team tags.

[MakoWish]

Hi @nreese,

How is that done?

[nreese]

How is that done?

Under labels, select Team: label. For example Team: SecuritySolution

[MadameSheema]

Hi @MakoWish!! Hope you are doing great!! Lots of thanks for the suggestion :)

On 8.7.0 version we added the capability to allow users to set expiration dates for rule exceptions and choose whether to include expired exceptions when exporting shared exception lists.

Hope that helps with your described scenario.

cc @peluja1012

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[MakoWish]

How is that done?

Under labels, select Team: label. For example Team: SecuritySolution

I don't have that option. I do not work for Elastic, FYI.

[MakoWish]

Hi @MakoWish!! Hope you are doing great!! Lots of thanks for the suggestion :)

On 8.7.0 version we added the capability to allow users to set expiration dates for rule exceptions and choose whether to include expired exceptions when exporting shared exception lists.

Hope that helps with your described scenario.

cc @peluja1012

That is exactly what I was looking for! Thank you, and I guess we can close this one!