diff --git a/docs/detections/images/all-rules.png b/docs/detections/images/all-rules.png index 2e63df5d02..26eeefa0b0 100644 Binary files a/docs/detections/images/all-rules.png and b/docs/detections/images/all-rules.png differ diff --git a/docs/detections/images/monitor-table.png b/docs/detections/images/monitor-table.png index 3897d4be5c..4a1ad1dda5 100644 Binary files a/docs/detections/images/monitor-table.png and b/docs/detections/images/monitor-table.png differ diff --git a/docs/detections/rules-ui-manage.asciidoc b/docs/detections/rules-ui-manage.asciidoc index 224061686b..c9ac6b9694 100644 --- a/docs/detections/rules-ui-manage.asciidoc +++ b/docs/detections/rules-ui-manage.asciidoc @@ -35,7 +35,7 @@ To filter the rules list, enter a search term in the search bar and press **Retu NOTE: Searches for index patterns and MITRE ATT&CK tactics and techniques must match exactly, are case sensitive, and do _not_ support wildcards. For example, to find rules using the `filebeat-*` index pattern, the search term `filebeat-*` is valid, but `filebeat` and `file*` are not because they don't exactly match the index pattern. Likewise, the MITRE ATT&CK tactic `Defense Evasion` is valid, but `Defense`, `defense evasion`, and `Defense*` are not. -You can also filter the rules list by selecting the *Tags*, *Elastic rules*, *Custom rules*, *Enabled rules*, and *Disabled rules* filters next to the search bar. +You can also filter the rules list by selecting the *Tags*, *Last response*, *Elastic rules*, *Custom rules*, *Enabled rules*, and *Disabled rules* filters next to the search bar. The rules list retains your sorting and filtering settings when you navigate away and return to the page. These settings are also preserved when you copy the page's URL and paste into another browser. Select *Clear filters* above the table to revert to the default view. @@ -51,6 +51,8 @@ The *Last response* column displays the current status of each rule, based on th For {ml} rules, an indicator icon (image:images/rules-table-error-icon.png[Error icon from Rules table,15,15]) also appears in this column if a required {ml} job isn't running. Click the icon to list the affected jobs, then click *Visit rule details page to investigate* to open the rule's details page, where you can start the {ml} job. +You can filter rules by status using the *Last response* filter. + [float] [[load-prebuilt-rules]] === Load and activate Elastic prebuilt rules