Create rule from timeline

[nastasha-solomon]

Description

Two new options (Create query rule from timeline and Create EQL rule from timeline) that allow users to create a rule from Timeline are being added to the overflow menu in the Timelines table. Users will have the option to create a query or EQL rule from a custom Timeline or from a Timeline template.

Related:

• [Security Solution] Create rule from timeline kibana#145010
• [Security Solution] Create rule from timeline kibana#143020

Required doc updates

• Update sections for managing existing timelines and managing existing Timeline templates.

Notes

• Will be available by default (GA) in 8.7.
• If Timeline has a custom query and an EQL query, both options appear in the overflow menu.
• @stephmilovic is checking out possible bug that prevents users from creating a rule from a Timeline template. Issue/PR incoming.

To-do

• Verify what the final copy for these options are. In 8.7.0 BC3, the option for creating a query rule is Create rule from timeline. In siem.dev, the copy is Create query rule from timeline.
• Check whether there will also be an option to create a rule from within the Timeline view. - there is none