[Security Solution] Add support for more complex field overrides

[spong]

As detailed in this discuss post, there is a user need for more sophisticated field overrides. So for example, instead of a simple field to value mapping for severity like user.name === 'Testuser -> High Severity, something like multi-value support user.name === user.name1, user.name2 -> High Severity.

While expanding the value selector to be a multi-select would satisfy this enhancement request, a full-featured approach here that could be adapted to all field overrides would be a nice improvement. When originally implementing the field overrides, I had envisioned an advanced input that provided the alert data as the context, and then would allow the user to either use the Kibana Expression Language or another scripting language (painless?) to write complex evaluations using the alert context. This could then be adapted for use with Severity/Risk Score Override, and Rule Name Override as well.

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[defendable-forfot]

Seems like this issue has been relatively quit recently and we want to bring further attention to it. While more complex field overrides as described above may help solve our issue, I still want to highlight another use case where we have ran into issues with the current severity override.

We are ingesting data from various security solutions which use a different numeric scale to determine severity. The existing severity override being explicit event.severity == 1 -> Low leaves no room to standardize event.severity that follows a [1-10] range, where event.severity == [1-4] -> Low could be a use case. Determining a severity override across a range of values (relative overrides) is something I would believe would be a basic feature within a SIEM solution such as Elastic Security. However, this does sadly not seem to be case through the severity override capabilities.

Implementation of complex overrides would allow us to at least specify which numeric values we want mapped to a certain severity, but being able to use a relative range could also be a useful feature. While we would want to see the latter, we see how complex overrides would be a more straightforward and universal solution to provide.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)