[SIEM][Detection Engine] Lists Meta Ticket

[FrankHassanabad]

Meta Ticket for all work towards lists and queries within Detection Engine:

• Create a global query filter capability
• Append to Query in Detections Rules
• Value based lists
  • Allow simple value based lists in the REST interface

Doing this work is questionable at the moment and we are actively trying to avoid it for now as it has a large wider range of consequences and unknowns and LOE is higher:

• Add list syntax to KQL/lucene

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[FrankHassanabad]

"Reviewed by Frank Hassanabad on 7/29/2020", This looks complete and will be shippable at this point. Going to close this and associated tickets. Any new bugs/features should be new tickets. Note this work is superseded by exception lists being a join data type.