Central management for the detection actions

[PurpleV0id]

Centralised visibility/management of the detections rules and the actions applied.

At the moment setting actions of a SIEM detection requires editing every rule that we would want a action applied, for us this is anything over medium severity. However, from the SIEM Detections list there is no sort for anything other than Activated and no view within that of which have actions applied.

Currently on-premise we use elastalert, this is configured with a rule to alert via email for any detection of >= medium. This also allows us to suppress any alerts that might trigger on a system multiple times within a short period of time so that we receive less repetition.

I did consider creating an index pattern of .siem-signals-, a detection for any alerts over medium with an action, then realised this would write back to the detection and cause a loop. If there is a method of creating a detection without it writing back to .siem-signals- then it may help.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[peluja1012]

Bulk adding rule actions/notifications is available in 8.5 #138900