Skip to content

Commit b171dcd

Browse files
committed
Update docs
1 parent 15ce2c5 commit b171dcd

File tree

1 file changed

+23
-0
lines changed

1 file changed

+23
-0
lines changed

docs/resources/kibana_security_detection_rule.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ resource "elasticstack_kibana_security_detection_rule" "advanced" {
120120
### Optional
121121

122122
- `actions` (Attributes List) Array of automated actions taken when alerts are generated by the rule. (see [below for nested schema](#nestedatt--actions))
123+
- `alert_suppression` (Attributes) Defines alert suppression configuration to reduce duplicate alerts. (see [below for nested schema](#nestedatt--alert_suppression))
123124
- `anomaly_threshold` (Number) Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100. Required for machine_learning rules.
124125
- `author` (List of String) The rule's author.
125126
- `building_block_type` (String) Determines if the rule acts as a building block. If set, value must be `default`. Building-block alerts are not displayed in the UI by default and are used as a foundation for other rules.
@@ -209,6 +210,28 @@ Required:
209210

210211

211212

213+
<a id="nestedatt--alert_suppression"></a>
214+
### Nested Schema for `alert_suppression`
215+
216+
Required:
217+
218+
- `group_by` (List of String) Array of field names to group alerts by for suppression.
219+
220+
Optional:
221+
222+
- `duration` (Attributes) Duration for which alerts are suppressed. (see [below for nested schema](#nestedatt--alert_suppression--duration))
223+
- `missing_fields_strategy` (String) Strategy for handling missing fields in suppression grouping: 'suppress' - only one alert will be created per suppress by bucket, 'doNotSuppress' - per each document a separate alert will be created.
224+
225+
<a id="nestedatt--alert_suppression--duration"></a>
226+
### Nested Schema for `alert_suppression.duration`
227+
228+
Required:
229+
230+
- `unit` (String) Duration unit (s, m, h).
231+
- `value` (Number) Duration value.
232+
233+
234+
212235
<a id="nestedatt--exceptions_list"></a>
213236
### Nested Schema for `exceptions_list`
214237

0 commit comments

Comments
 (0)