Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new terms rule type to Detections API create/update rule docs #3914

Merged
merged 7 commits into from
Sep 20, 2023

Conversation

marshallmain
Copy link
Contributor

@marshallmain marshallmain commented Sep 11, 2023

Adds API docs for the new terms rule type, introduced in elastic/kibana#134526 (stack v8.4.0). Support for multiple values in new_terms_fields was added in 8.6 (elastic/kibana#143943), so if we backport as far as 8.4 and 8.5 we should modify the Must contain 1-3 field names. text to reflect the limitation (something like Must contain 1 field name. instead).

@github-actions
Copy link

Documentation previews:

@mergify
Copy link
Contributor

mergify bot commented Sep 11, 2023

This pull request does not have a backport label. Could you fix it @marshallmain? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • v7.x is the label to automatically backport to the 7.x branch.
  • v7./d./d is the label to automatically backport to the 7./d branch. /d is the digit

NOTE: backport-skip has been added to this pull request.

Copy link
Contributor

@natasha-moore-elastic natasha-moore-elastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for raising the PR, @marshallmain! LGTM, just a couple of suggestions:

  1. Can we add the following text to the list of rule types at the start of the rules-api-create page (on line 36, after Machine learning rules):

New terms: Generates an alert for each new term detected in source documents within a specified time range.

  1. Can we add request and response examples for creating a new terms rule to the rules-api-create page? Just to keep the consistency, as the page contains examples for all other rule types.

docs/detections/api/rules/rules-api-create.asciidoc Outdated Show resolved Hide resolved
docs/detections/api/rules/rules-api-update.asciidoc Outdated Show resolved Hide resolved
docs/detections/api/rules/rules-api-create.asciidoc Outdated Show resolved Hide resolved
@natasha-moore-elastic
Copy link
Contributor

Adds API docs for the new terms rule type, introduced in elastic/kibana#134526 (stack v8.4.0). Support for multiple values in new_terms_fields was added in 8.6 (elastic/kibana#143943), so if we backport as far as 8.4 and 8.5 we should modify the Must contain 1-3 field names. text to reflect the limitation (something like Must contain 1 field name. instead).

Thanks for the heads-up – once we merge this PR, I can raise a separate one to update the description to Must contain 1 field name. and backport that update to 8.4 and 8.5 only.

Co-authored-by: natasha-moore-elastic <[email protected]>
@marshallmain marshallmain marked this pull request as ready for review September 13, 2023 18:46
@natasha-moore-elastic
Copy link
Contributor

Thanks for raising the PR, @marshallmain! LGTM, just a couple of suggestions:

  1. Can we add the following text to the list of rule types at the start of the rules-api-create page (on line 36, after Machine learning rules):

New terms: Generates an alert for each new term detected in source documents within a specified time range.

  1. Can we add request and response examples for creating a new terms rule to the rules-api-create page? Just to keep the consistency, as the page contains examples for all other rule types.

Hey @marshallmain, just flagging these two points again in case you missed them.

@natasha-moore-elastic natasha-moore-elastic requested a review from a team September 18, 2023 15:55
@marshallmain marshallmain merged commit cbd0155 into elastic:main Sep 20, 2023
1 check passed
mergify bot pushed a commit that referenced this pull request Sep 20, 2023
)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit cbd0155)
mergify bot pushed a commit that referenced this pull request Sep 20, 2023
)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit cbd0155)
mergify bot pushed a commit that referenced this pull request Sep 20, 2023
)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit cbd0155)
mergify bot pushed a commit that referenced this pull request Sep 20, 2023
)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit cbd0155)
mergify bot pushed a commit that referenced this pull request Sep 20, 2023
)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit cbd0155)
mergify bot pushed a commit that referenced this pull request Sep 20, 2023
)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit cbd0155)
mergify bot pushed a commit that referenced this pull request Sep 20, 2023
)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit cbd0155)
marshallmain added a commit that referenced this pull request Sep 26, 2023
) (#3975)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit cbd0155)

Co-authored-by: Marshall Main <[email protected]>
marshallmain added a commit that referenced this pull request Sep 26, 2023
) (#3976)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit cbd0155)

Co-authored-by: Marshall Main <[email protected]>
marshallmain added a commit that referenced this pull request Sep 26, 2023
) (#3977)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit cbd0155)

Co-authored-by: Marshall Main <[email protected]>
marshallmain added a commit that referenced this pull request Sep 26, 2023
) (#3978)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit cbd0155)

Co-authored-by: Marshall Main <[email protected]>
marshallmain added a commit that referenced this pull request Sep 26, 2023
) (#3979)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit cbd0155)

Co-authored-by: Marshall Main <[email protected]>
marshallmain added a commit that referenced this pull request Sep 26, 2023
) (#3980)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit cbd0155)

Co-authored-by: Marshall Main <[email protected]>
marshallmain added a commit that referenced this pull request Sep 26, 2023
) (#3981)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit cbd0155)

Co-authored-by: Marshall Main <[email protected]>
joepeeples added a commit that referenced this pull request May 22, 2024
* Add alert suppression clarification note

Per /pull/3879

* Clarify note in new terms rule create

Per /pull/3943

* Update images for QA bugs

Per /pull/3946

* Add new terms rule type to create rule API docs

Per /pull/3914

* Add new terms rule type to *update* rule API docs

Per /pull/3914
acorretti pushed a commit that referenced this pull request Nov 19, 2024
) (#3978)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit 67448e0)

Co-authored-by: Marshall Main <[email protected]>
acorretti pushed a commit that referenced this pull request Nov 19, 2024
) (#3979)

* Add new terms rule type to Detections API create/update rule docs

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Update copy for history_window_start recommended format

* Apply suggestions from code review

Co-authored-by: natasha-moore-elastic <[email protected]>

* Add example request and response for new terms rule

* Fix copy paste errors

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit 67448e0)

Co-authored-by: Marshall Main <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants