Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DOCS] Document the new rule execution status filter #3570

Merged
merged 4 commits into from
Jul 18, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file modified docs/detections/images/all-rules.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified docs/detections/images/monitor-table.png
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like the mouse pointer got captured on this one -- near the top above Add Elastic rules.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oops, I thought I deleted that. I'll fix it now - thanks!

Copy link
Contributor

@joepeeples joepeeples Jul 18, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No problem! Once that image is fixed, this is probably good to merge -- we've had three writers working on/reviewing this, and it's such a small change that we probably don't need a tech/dev/product review.

Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
4 changes: 3 additions & 1 deletion docs/detections/rules-ui-manage.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ To filter the rules list, enter a search term in the search bar and press **Retu

NOTE: Searches for index patterns and MITRE ATT&CK tactics and techniques must match exactly, are case sensitive, and do _not_ support wildcards. For example, to find rules using the `filebeat-*` index pattern, the search term `filebeat-*` is valid, but `filebeat` and `file*` are not because they don't exactly match the index pattern. Likewise, the MITRE ATT&CK tactic `Defense Evasion` is valid, but `Defense`, `defense evasion`, and `Defense*` are not.

You can also filter the rules list by selecting the *Tags*, *Elastic rules*, *Custom rules*, *Enabled rules*, and *Disabled rules* filters next to the search bar.
You can also filter the rules list by selecting the *Tags*, *Last response*, *Elastic rules*, *Custom rules*, *Enabled rules*, and *Disabled rules* filters next to the search bar.

The rules list retains your sorting and filtering settings when you navigate away and return to the page. These settings are also preserved when you copy the page's URL and paste into another browser. Select *Clear filters* above the table to revert to the default view.

Expand All @@ -51,6 +51,8 @@ The *Last response* column displays the current status of each rule, based on th

For {ml} rules, an indicator icon (image:images/rules-table-error-icon.png[Error icon from Rules table,15,15]) also appears in this column if a required {ml} job isn't running. Click the icon to list the affected jobs, then click *Visit rule details page to investigate* to open the rule's details page, where you can start the {ml} job.

You can filter rules by status using the *Last response* filter.

[float]
[[load-prebuilt-rules]]
=== Load and activate Elastic prebuilt rules
Expand Down