Issue 4008 812 #5827

shashank-elastic · 2024-09-13T07:43:14Z

As part of [Bug] Development Rules Should not be part of Prebuilt Rule Reference detection-rules#4008 we plan to remove all prebuilt rule references for development rules.
This PR targets the 8.12 documents.

Co-authored-by: Janeen Mikell Roberts <[email protected]> Co-authored-by: Nastasha Solomon <[email protected]>

* EA updates * Adds comma (cherry picked from commit faf84c7) Co-authored-by: natasha-moore-elastic <[email protected]>

Co-authored-by: Nastasha Solomon <[email protected]>

(cherry picked from commit 55982e5) Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* BP to 8.7 * BP to 8.7 (cherry picked from commit 1ca174a) Co-authored-by: Brandon Morelli <[email protected]>

Co-authored-by: Nastasha Solomon <[email protected]>

) (#4436) Co-authored-by: Benjamin Ironside Goldstein <[email protected]> Co-authored-by: Nastasha Solomon <[email protected]>

* Save timeline as new (#4437) (cherry picked from commit 7122ae6) # Conflicts: # docs/events/timeline-ui-overview.asciidoc * Update docs/events/timeline-ui-overview.asciidoc --------- Co-authored-by: natasha-moore-elastic <[email protected]>

* First draft with prelim image * Update screenshot * Apply suggestions from Nikita's review (cherry picked from commit 42bd201) Co-authored-by: Joe Peeples <[email protected]>

(cherry picked from commit 8ea8cd1) Co-authored-by: Nastasha Solomon <[email protected]>

(cherry picked from commit 5a5efd7) Co-authored-by: natasha-moore-elastic <[email protected]>

…4470) (#4503) (cherry picked from commit aeed1af) Co-authored-by: natasha-moore-elastic <[email protected]>

…#4439) (#4505) * Adds new page about allowlisting Elastic Endpoint * Update docs/management/admin/allowlist-endpoint-3rd-party-av.asciidoc Co-authored-by: Daniel Ferullo <[email protected]> * Update docs/management/admin/allowlist-endpoint-3rd-party-av.asciidoc Co-authored-by: Daniel Ferullo <[email protected]> * incorporates feedback * incorporates Gabriel Landau's feedback --------- Co-authored-by: Daniel Ferullo <[email protected]> (cherry picked from commit 08a7c08) Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* updates screenshots and text * fix sentence case (cherry picked from commit 93f9a0a) Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

…g ES|QL tab in timeline (backport #4499) (#4521) * Updating one indicator image * Refreshing last image * Updated hash value in example (cherry picked from commit 560ce5f) Co-authored-by: Nastasha Solomon <[email protected]>

…reenshot (backport #4497) (#4522) (cherry picked from commit 80de46e) Co-authored-by: Nastasha Solomon <[email protected]>

(cherry picked from commit ff28e9d) Co-authored-by: natasha-moore-elastic <[email protected]>

…#4483) (#4537) * First draft * Adding more text changes * Fixed terminology * Updating IG page * Refreshing * Adding Nat's edits * Update docs/events/timeline-ui-overview.asciidoc * Update docs/events/timeline-templates.asciidoc Co-authored-by: natasha-moore-elastic <[email protected]> * Update docs/events/timeline-templates.asciidoc Co-authored-by: natasha-moore-elastic <[email protected]> * Removing borders * Removed breadcrumb trail * Update docs/events/timeline-templates.asciidoc * Update docs/events/timeline-ui-overview.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/events/timeline-ui-overview.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/events/timeline-ui-overview.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> --------- Co-authored-by: natasha-moore-elastic <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 68daf4d) Co-authored-by: Nastasha Solomon <[email protected]>

…les (#4474) * Update latest docs * fixed broken links; added update description * fixing dot notated docs * fixed underscores * removed 'suspicious-execution-short-program-name' * removed 'suspicious-network-connection-attempt-by-root' * adjusted 'linux-restricted-shell-breakout-via-linux-binarys' * adjusted 'potential-shell-via-web-server' * adjusted 'potential-dll-sideloading-via-trusted-microsoft-programs' * adjusted 'threat-detected-by-okta-threatinsight' * adjusted 'potential-dns-tunneling-via-iodine' * adjusted 'prebuilt-rule-8-12-1-prebuilt-rules-8-12-5-summary' * adjusted 'prebuilt-rule-8-12-1-prebuilt-rules-8-12-5-summary' --------- Co-authored-by: terrancedejesus <[email protected]> Co-authored-by: Terrance DeJesus <[email protected]>

…les (#4544) * Update latest docs * fixed broken links; added update description * removed deprecated rules * removed deprecation link * adjusted 'attempt-to-deactivate-mfa-for-an-okta-user-account' --------- Co-authored-by: terrancedejesus <[email protected]>

* First draft for classic docs * Revise language away from "matching" More like "qualifying" or "meets the rule's criteria" * Add option of empty "Group by" * Edit word choice (cherry picked from commit f48ae9f) Co-authored-by: Joe Peeples <[email protected]>

* Adds info about RAG for alerts * adds section tag * Adds an image * tweaks formatting * first pass at incorporating Joe's feedback * second pass at Joe's feedback * minor formatting fix * changes headers * Update docs/assistant/security-assistant.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/assistant/security-assistant.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/assistant/security-assistant.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 938e687) Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

…environmentsFirst draft (backport #4554) (#4555) (cherry picked from commit c05968a) Co-authored-by: Nastasha Solomon <[email protected]>

…) (#4559) * adds missing alert suppression API references * fixes * add preview * fixes * add example * update * unique ids * Fix syntax, some edits * Another edit * Remove callout syntax in Example * Apply suggestions from Natasha's review Co-authored-by: natasha-moore-elastic <[email protected]> * Apply `duration` edits from Natasha's review Co-authored-by: natasha-moore-elastic <[email protected]> --------- Co-authored-by: Joe Peeples <[email protected]> Co-authored-by: natasha-moore-elastic <[email protected]> (cherry picked from commit 6023056) Co-authored-by: Vitalii Dmyterko <[email protected]>

(cherry picked from commit 7cdb208) Co-authored-by: natasha-moore-elastic <[email protected]>

* Adds new page about triaging alerts with AI Assistant * troubleshoots ToC * troubleshoots build error * updates section title * Update docs/assistant/ai-alert-triage.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/assistant/ai-alert-triage.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/assistant/ai-alert-triage.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/assistant/ai-alert-triage.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/assistant/ai-alert-triage.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/assistant/ai-alert-triage.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/assistant/ai-alert-triage.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/assistant/ai-alert-triage.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/assistant/ai-alert-triage.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Incorporates rest of Nastasha's feedback * save work * updates triage page with RAG for alerts info * fixes anchor tag * Update docs/assistant/ai-alert-triage.asciidoc Co-authored-by: natasha-moore-elastic <[email protected]> * Update docs/assistant/ai-alert-triage.asciidoc Co-authored-by: natasha-moore-elastic <[email protected]> * Update docs/assistant/ai-alert-triage.asciidoc * Update docs/assistant/ai-alert-triage.asciidoc --------- Co-authored-by: Nastasha Solomon <[email protected]> Co-authored-by: natasha-moore-elastic <[email protected]> (cherry picked from commit b930aa6) Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* First draft * Fixed anchor * Updated expand-details-button.png * Minor fixes * Adding icons * Removing line break * Removed extra lines * Update alerts-view-details.asciidoc * Remove extra paren * Adding missing colons * Fixing inline images * Removing borders * Update docs/reference/alert-schema.asciidoc * Update docs/detections/alerts-ui-manage.asciidoc * Moving note. (cherry picked from commit aa17f9d) Co-authored-by: Nastasha Solomon <[email protected]>

…4475) (#4566) * First draft * Moved docs to correct location * Removed space * Update title * Minor change * request schema * Update docs/detections/api/rules/signals-api-overview.asciidoc Co-authored-by: natasha-moore-elastic <[email protected]> * Update docs/detections/api/rules/signals-api-overview.asciidoc Co-authored-by: natasha-moore-elastic <[email protected]> * Update docs/detections/api/rules/signals-api-overview.asciidoc Co-authored-by: natasha-moore-elastic <[email protected]> * Update docs/detections/api/rules/signals-api-overview.asciidoc Co-authored-by: natasha-moore-elastic <[email protected]> * Styled text --------- Co-authored-by: natasha-moore-elastic <[email protected]> (cherry picked from commit 474ac29) Co-authored-by: Nastasha Solomon <[email protected]>

(cherry picked from commit 418ddf5) Co-authored-by: natasha-moore-elastic <[email protected]>

…ules (#5368)

* fix: remove ndjson.org (#5376) * fix: replace ndjson.org with ndjson spec the original website expired and it's currently serving malicious content. * Removing link * capitalization fix --------- Co-authored-by: nastasha.solomon <[email protected]> Co-authored-by: Joe Peeples <[email protected]> (cherry picked from commit 5beed29) # Conflicts: # docs/serverless/investigate/timeline-templates-ui.mdx # docs/serverless/investigate/timelines-ui.mdx * Delete docs/serverless directory and its contents --------- Co-authored-by: kruskall <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

) * Fixes comments description in Update exception item API * Update docs/detections/api/exceptions/api-update-exception-item.asciidoc Co-authored-by: Yara Tercero <[email protected]> --------- Co-authored-by: Yara Tercero <[email protected]> (cherry picked from commit 7317510) Co-authored-by: natasha-moore-elastic <[email protected]>

* Update link in 8.8 release notes (#5463) This link points to a setting that's in the wrong area of the Fleet & Agent docs, so before I can fix that I'd like to update this link, in order not to bust the docs build. This link originates in version 8.8 so I hope it's okay to backport to there. (cherry picked from commit 32e56e2) # Conflicts: # docs/release-notes/8.8.asciidoc * Resolved conflict * Pull attribute --------- Co-authored-by: David Kilfoyle <[email protected]> Co-authored-by: nastasha.solomon <[email protected]>

(cherry picked from commit 13eaeb0) Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* Adds notes about CNVM architecture support * Update docs/cloud-native-security/vuln-management-faq.asciidoc * Update docs/cloud-native-security/vuln-management-get-started.asciidoc (cherry picked from commit d1cd713) Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* Adds callout to legacy risk score troubleshooting docs * Updates the callout * Apply suggestions from code review Co-authored-by: Joe Peeples <[email protected]> --------- Co-authored-by: Joe Peeples <[email protected]> (cherry picked from commit 8311166) Co-authored-by: natasha-moore-elastic <[email protected]>

* remove deprecation notice * remove deprecation notice (cherry picked from commit f76b34f) Co-authored-by: Uri Weisman <[email protected]>

…ules (#5609)

…page to serverless docs (backport #5639) (#5643) * Adds Allowlist Elastic Endpoint in third-party antivirus apps page to serverless docs (#5639) * Adds Allowlist Elastic Endpoint in third-party antivirus apps page to serverless docs * Adds page description * Apply suggestions from code review Co-authored-by: Joe Peeples <[email protected]> * Removes div id * Adds note to allowlist pages --------- Co-authored-by: Joe Peeples <[email protected]> (cherry picked from commit f8e7ca6) # Conflicts: # docs/serverless/edr-manage/trusted-apps-ov.mdx # docs/serverless/serverless-security.docnav.json * Delete docs/serverless directory and its contents --------- Co-authored-by: natasha-moore-elastic <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

* Adds note about DaemonSet support (#5675) * Adds note about DaemonSet support * Update docs/getting-started/install-endpoint.asciidoc Co-authored-by: Joe Peeples <[email protected]> * Update docs/release-notes/8.10.asciidoc Co-authored-by: Joe Peeples <[email protected]> * Update docs/serverless/edr-install-config/install-elastic-defend.mdx Co-authored-by: Joe Peeples <[email protected]> * updates wording --------- Co-authored-by: Joe Peeples <[email protected]> (cherry picked from commit a662e9e) # Conflicts: # docs/serverless/edr-install-config/install-elastic-defend.mdx * Delete docs/serverless directory and its contents --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

…ules (#5719)

…) (#5743) * Update setting name (#5740) in both serverless and ESS (cherry picked from commit 24fafb5) # Conflicts: # docs/serverless/endpoint-response-actions/response-actions.mdx * Delete docs/serverless directory and its contents --------- Co-authored-by: Joe Peeples <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

(cherry picked from commit 333e84c) Co-authored-by: Joe Peeples <[email protected]>

* fixes typo (#5805) (cherry picked from commit 2815edd) # Conflicts: # docs/serverless/cloud-native-security/cspm-get-started-gcp.mdx # docs/serverless/cloud-native-security/cspm-get-started.mdx * Delete docs/serverless directory and its contents --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

github-actions · 2024-09-13T07:43:30Z

A documentation preview will be available soon.

🔨 Buildkite builds
📚 HTML diff
📙 Preview page

Request a new doc build by commenting

Rebuild this PR: run docs-build
Rebuild this PR and all Elastic docs: run docs-build rebuild

_{run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.}

_{If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.}

mergify · 2024-09-13T07:43:59Z

This pull request is now in conflicts. Could you fix it @shashank-elastic? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b issue-4008-812 upstream/issue-4008-812
git merge upstream/main
git push upstream issue-4008-812

mergify · 2024-09-13T07:43:59Z

This pull request does not have a backport label. Could you fix it @shashank-elastic? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

v7.x is the label to automatically backport to the 7.x branch.
v7./d./d is the label to automatically backport to the 7./d branch. /d is the digit

NOTE: backport-skip has been added to this pull request.

mergify bot and others added 30 commits December 6, 2023 22:23

[8.12] 8.11.2 Release notes (backport #4376) (#4414)

a969dd2

Co-authored-by: Janeen Mikell Roberts <[email protected]> Co-authored-by: Nastasha Solomon <[email protected]>

EA updates (#4394) (#4416)

9c15bda

* EA updates * Adds comma (cherry picked from commit faf84c7) Co-authored-by: natasha-moore-elastic <[email protected]>

[8.12] Timeline opens as a modal (backport #4298) (#4431)

3aff72c

Co-authored-by: Nastasha Solomon <[email protected]>

defend for containers docs tweaks (#4413) (#4432)

b7c4c4e

(cherry picked from commit 55982e5) Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

Fix duplicate images (#4441) (#4444)

a584569

* BP to 8.7 * BP to 8.7 (cherry picked from commit 1ca174a) Co-authored-by: Brandon Morelli <[email protected]>

[8.12] 8.11.3 Release notes (backport #4435) (#4457)

c7db158

Co-authored-by: Nastasha Solomon <[email protected]>

[8.12] Timeline autosave removed in favor of manual save (backport #4299

a219ed1

) (#4436) Co-authored-by: Benjamin Ironside Goldstein <[email protected]> Co-authored-by: Nastasha Solomon <[email protected]>

Prebuilt rule customization — JSON diff [Classic] (#4463) (#4482)

2209702

* First draft with prelim image * Update screenshot * Apply suggestions from Nikita's review (cherry picked from commit 42bd201) Co-authored-by: Joe Peeples <[email protected]>

[8.12] [ESS] Default ES|QL query updated (backport #4492) (#4495)

8dea177

(cherry picked from commit 8ea8cd1) Co-authored-by: Nastasha Solomon <[email protected]>

Match phrasing with serverless docs (#4494) (#4501)

4b5da82

(cherry picked from commit 5a5efd7) Co-authored-by: natasha-moore-elastic <[email protected]>

Fixes requirement statement on Behavioral detection use cases page (#…

8345c6a

…4470) (#4503) (cherry picked from commit aeed1af) Co-authored-by: natasha-moore-elastic <[email protected]>

Alert status auditing updates (#4412) (#4518)

c910c61

* updates screenshots and text * fix sentence case (cherry picked from commit 93f9a0a) Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

[8.12] [Bug][ESS][8.11 & 8.12]Missing ES|QL query rule type in the sc…

af9855a

…reenshot (backport #4497) (#4522) (cherry picked from commit 80de46e) Co-authored-by: Nastasha Solomon <[email protected]>

Exclude cold and frozen tiers advanced setting (#4484) (#4519)

7cf4448

(cherry picked from commit ff28e9d) Co-authored-by: natasha-moore-elastic <[email protected]>

[8.12] [Request][REDO] Add warning against using ES|QL on production …

65709e0

…environmentsFirst draft (backport #4554) (#4555) (cherry picked from commit c05968a) Co-authored-by: Nastasha Solomon <[email protected]>

Fixes get file API typo (#4526) (#4560)

0e1dffd

(cherry picked from commit 7cdb208) Co-authored-by: natasha-moore-elastic <[email protected]>

Fixes data type inconsitency in Apply alert tags API (#4581) (#4583)

e27c930

(cherry picked from commit 418ddf5) Co-authored-by: natasha-moore-elastic <[email protected]>

[Cases] Copy file hashes (#4580) (#4587)

16820f6

protectionsmachine and others added 21 commits June 12, 2024 01:02

[Detection Rules] Adding Documents for v8.12.14 Pre-Built Detection R…

f8c73ed

…ules (#5368)

Update latest docs (#5478)

af35f83

Update latest docs (#5485)

b2f61f7

Adds beta tag (#5519) (#5524)

094fbb8

(cherry picked from commit 13eaeb0) Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

Update latest docs (#5535)

499535e

Remove cloud shell editor deprecation notification (#5554) (#5574)

52bb225

* remove deprecation notice * remove deprecation notice (cherry picked from commit f76b34f) Co-authored-by: Uri Weisman <[email protected]>

[Detection Rules] Adding Documents for v8.12.18 Pre-Built Detection R…

51709d8

…ules (#5609)

Update latest docs (#5663)

9c7fdd7

[Detection Rules] Adding Documents for v8.12.20 Pre-Built Detection R…

4835f63

…ules (#5719)

First draft (#5447) (#5754)

49252b7

(cherry picked from commit 333e84c) Co-authored-by: Joe Peeples <[email protected]>

Update latest docs (#5767)

4013a7d

Remove Development Rules from 8.12 security docs

6b8217e

shashank-elastic requested a review from approksiu September 13, 2024 07:43

shashank-elastic self-assigned this Sep 13, 2024

shashank-elastic requested a review from a team as a code owner September 13, 2024 07:43

mergify bot added the backport-skip label Sep 13, 2024

mergify bot mentioned this pull request Sep 13, 2024

Remove Development Rules from 8.12 security docs #5828

Merged

shashank-elastic closed this Sep 13, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Issue 4008 812 #5827

Issue 4008 812 #5827

shashank-elastic commented Sep 13, 2024

github-actions bot commented Sep 13, 2024

mergify bot commented Sep 13, 2024

mergify bot commented Sep 13, 2024

Issue 4008 812 #5827

Issue 4008 812 #5827

Conversation

shashank-elastic commented Sep 13, 2024

github-actions bot commented Sep 13, 2024

mergify bot commented Sep 13, 2024

mergify bot commented Sep 13, 2024