[SIEM] Autojump to duplicated a detection rule

[philippkahr]

Describe the feature:

1. When using built-in detection rules, and trying to modify them you need to duplicate those.
2. When hitting the Duplicate rule... button
   2.1. The current rule should be deactivated (open for discussion)
3. you should jump directly to the newly created and duplicated rule.

Hitting the duplicate button, then having to go back a page, select another filter within the table and then selecting the newly created rule feels a bit tedious.

I think it fits on the action item list from #53782

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[randomuserid]

I think this is a good workflow idea & one that some other rule interfaces do

[spong]

Thanks for taking some time to use the Detection Engine @PhilippBaranovskiy -- appreciate the feedback! 🙂

This had come up in our post feature freeze design review, and will likely be taken care of in the near term.

As for deactivating a rule on duplication -- that'd be a nice improvement for this flow. Perhaps we could make the Duplication action a split button with a Duplicate and deactivate option or even a separate action entirely that is only present if the rule is currently activated. Thoughts @MichaelMarcialis?

[MichaelMarcialis]

As for deactivating a rule on duplication -- that'd be a nice improvement for this flow. Perhaps we could make the Duplication action a split button with a Duplicate and deactivate option or even a separate action entirely that is only present if the rule is currently activated. Thoughts @MichaelMarcialis?

Yeah, I like that idea. When the rule that is desired to be duplicated is active, the user can select "Duplicate" or "Deactivate & Duplicate" from that rule's overflow menu.

[xcrzx]

Related issues: #82566, #82100

[PhilippBaranovskiy]

Thanks go to @philippkahr, appreciate your feedback!

[spong]

Linking #96520 as a related enhancement for removing the appended [Duplicate] title text in favor of a Duplicate tag.

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[spong]

Closing, resolved via #96760