[Detection Rules] Add 7.10 rules - v3

[brokensound77]

Summary

Pull updates to detection rules from https://github.com/elastic/detection-rules/tree/7.10.

The is the 3rd and final PR for 7.10, with updates to #81676

Checklist

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support

[brokensound77]

@elasticmachine merge upstream

[brokensound77]

@elasticmachine merge upstream

[spong]

Checked out, tested locally, and was able to install and run all pre-packaged rules. LGTM! 👍 Thanks for pairing on this one @brokensound77!

Testing notes:

Only failure (ignoring ML rules/jobs) was with the External Alerts rule, which was the result of the source indices not having event.ingested (an existing error to be resolved via #75382).

Bulk Indexing of signals failed: reason: "No mapping found for [event.ingested] in order to sort on" type: "query_shard_exception" name: "External Alerts" id: "b2b237cb-f06e-40f7-b12b-1201bc85fcb4" rule id: "eb079c62-4481-4d6e-9643-3ca499df7aaa" signals index: ".siem-signals-spong-default"

Also tested the new timeline templates and those appear to be working as well, although I'm not sure how well they help in certain situations. For example, here's the Investigate in timeline action for the RDP (Remote Desktop Protocol) from the Internet rule with and without the template. Without, you get the single alert, but with, since it's only constraining to src/dest ip exists, and the rule execution time window, you'll get all alerts/events for the window, with no way to find the specific alert you clicked from via the table. This is working as designed, but wanted to call out this behavior. cc @XavierM @MikePaquette @shimonmodi

Without Timeline Template

With (Generic Network) Timeline Template

[brokensound77]

Thanks @spong, I created this issue to track the timeline review. We can always reference any other issues created to track/discuss from a product perspective.

[bm11100]

I agree with @spong. I think the timelines will cause more confusion than benefit. I thought the generic templates were just adjusting which columns we're displayed, not the actual fields to filter on. Approving for the updated rule logic, but think something should be done to make the timelines more usable.

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 6eda115

Metrics [docs]

distributable file count

id	before	after	diff
default	42564	42558	-6

History

• 💚 Build #85423 succeeded 686ef38
• 💔 Build #85408 failed 009f204
• 💔 Build #85280 failed 9130a57
• 💔 Build #85061 failed 7eabd84
• 💔 Build #84997 failed c6a44c4

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream