Add Support for Kibana Security Detection Rules

CHANGELOG.md

@@ -1,5 +1,6 @@
 ## [Unreleased]
 
+- Create `elasticstack_kibana_security_detection_rule` resource to manage Kibana Security Detection Rules. ([#1290](https://github.com/elastic/terraform-provider-elasticstack/pull/1290))
 - Create `elasticstack_kibana_maintenance_window` resource. ([#1224](https://github.com/elastic/terraform-provider-elasticstack/pull/1224))
 - Add support for `solution` field in `elasticstack_kibana_space` resource and data source ([#1102](https://github.com/elastic/terraform-provider-elasticstack/issues/1102))
 - Add `slo_id` validation to `elasticstack_kibana_slo` ([#1221](https://github.com/elastic/terraform-provider-elasticstack/pull/1221))

docs/resources/kibana_security_detection_rule.md

@@ -0,0 +1,65 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "elasticstack_kibana_security_detection_rule Resource - terraform-provider-elasticstack"
+subcategory: ""
+description: |-
+  Creates or updates a Kibana security detection rule. See https://www.elastic.co/guide/en/security/current/rules-api-create.html
+---
+
+# elasticstack_kibana_security_detection_rule (Resource)
+
+Creates or updates a Kibana security detection rule. See https://www.elastic.co/guide/en/security/current/rules-api-create.html
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `description` (String) The description of the detection rule.
+- `name` (String) The name of the detection rule.
+- `severity` (String) The severity of the rule. Valid values are: low, medium, high, critical.
+- `type` (String) The rule type. Valid values are: eql, query, machine_learning, threshold, threat_match, new_terms.
+
+### Optional
+
+- `author` (List of String) String array containing the rule's author(s).
+- `enabled` (Boolean) Determines whether the rule is enabled.
+- `exceptions_list` (List of String) List of exceptions that prevent alerts from being generated.
+- `false_positives` (List of String) String array describing common reasons why the rule may issue false-positive alerts.
+- `from` (String) Time from which data is analyzed each time the rule executes, using date math syntax.
+- `index` (List of String) A list of index patterns to search.
+- `interval` (String) How often the rule executes.
+- `kibana_connection` (Block List) Kibana connection configuration block. (see [below for nested schema](#nestedblock--kibana_connection))
+- `language` (String) The query language. Valid values are: kuery, lucene, eql.
+- `license` (String) The rule's license.
+- `max_signals` (Number) Maximum number of alerts the rule can produce during a single execution.
+- `meta` (String) Optional metadata about the rule as a JSON string.
+- `note` (String) Notes to help investigate alerts produced by the rule.
+- `query` (String) The query that the rule will use to generate alerts.
+- `references` (List of String) String array containing notes about or references to relevant information about the rule.
+- `risk` (Number) A numerical representation of the alert's severity from 1-100.
+- `rule_id` (String) The identifier for the rule. If not provided, an ID is randomly generated.
+- `rule_name_override` (String) Sets the source field for the alert's rule name.
+- `space_id` (String) An identifier for the space. If space_id is not provided, the default space is used.
+- `tags` (List of String) String array containing words and phrases to help categorize, filter, and search rules.
+- `timestamp_override` (String) Sets the time field used to query indices.
+- `to` (String) Time to which data is analyzed each time the rule executes, using date math syntax.
+- `version` (Number) The rule's version number.
+
+### Read-Only
+
+- `id` (String) Internal identifier of the resource
+
+<a id="nestedblock--kibana_connection"></a>
+### Nested Schema for `kibana_connection`
+
+Optional:
+
+- `api_key` (String, Sensitive) API Key to use for authentication to Kibana
+- `ca_certs` (List of String) A list of paths to CA certificates to validate the certificate presented by the Kibana server.
+- `endpoints` (List of String, Sensitive) A comma-separated list of endpoints where the terraform provider will point to, this must include the http(s) schema and port number.
+- `insecure` (Boolean) Disable TLS certificate validation
+- `password` (String, Sensitive) Password to use for API authentication to Kibana.
+- `username` (String) Username to use for API authentication to Kibana.