[SIEM] [Detection engine] from signals to timeline

[XavierM]

Summary

• Be able to select between raw/signal event on timeline
  
• Be able to replace template fields from a timeline data provider. kql and filters ( see below the fields whick can act as a template)

const templateFields = [
 'host.name',
 'host.hostname',
 'host.domain',
 'host.id',
 'host.ip',
 'client.ip',
 'destination.ip',
 'server.ip',
 'source.ip',
 'network.community_id',
 'user.name',
 'process.name',
];

• Add status on All rules page

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

• [ ] This was checked for cross-browser compatibility, including a check against IE11
• [ ] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• [ ] Documentation was added for features that require explanation or tutorials
• [ ] Unit or functional tests were updated or added to match the most common scenarios
• [ ] This was checked for keyboard-only and screenreader accessibility

For maintainers

• [ ] This was checked for breaking API changes and was labeled appropriately
• [ ] This includes a feature addition or change that requires a release note and was labeled appropriately

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[FrankHassanabad]

LGTM! Thanks for all the work and making all the changes requested.

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: cf1b0cd

History

• 💔 Build #20246 failed 87ace1e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream