-
Notifications
You must be signed in to change notification settings - Fork 8.6k
[Security Solution] Implement query filters diff algorithm #190241
Copy link
Copy link
Open
Labels
Feature:Prebuilt Detection RulesSecurity Solution Prebuilt Detection Rules areaSecurity Solution Prebuilt Detection Rules areaTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeamSecurity Detection Response TeamenhancementNew value added to drive a business resultNew value added to drive a business result
Description
Metadata
Metadata
Assignees
Labels
Feature:Prebuilt Detection RulesSecurity Solution Prebuilt Detection Rules areaSecurity Solution Prebuilt Detection Rules areaTeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detection Rule ManagementSecurity Detection Rule Management TeamSecurity Detection Rule Management TeamTeam:Detections and RespSecurity Detection Response TeamSecurity Detection Response TeamenhancementNew value added to drive a business resultNew value added to drive a business result
Type
Fields
Give feedbackNo fields configured for Enhancement.
Summary
Implement an algorithm for diffing and merging changes in the array of
filterswhich is used in the query fields:kql_query,eql_query, andesql_query. The array is currently diffed using a simple diffing approach.Context from the Rule Customization RFC:
To do
filtersarray that makes sense from the UX perspective.filterswithin thekql_query,eql_query, andesql_queryalgorithms.