[Detection Engine] Improve index access warning message #213457
Labels
Feature:Detection Rules
Security Solution rules and Detection Engine
Team:Detection Engine
Security Solution Detection Engine Area
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Summary
In response to feedback, we are looking to improve the warning message we show users when they do not have access to all the indices specified by a rule index pattern.
As an example, if a rule has an index pattern of
filebeat-*
and the user has a role which excludes some indices fromfilebeat-*
we show the following error:The feedback from users was that this gives the impression that there is something wrong, like maybe no indices were queried within
filebeat-*
. We discussed doing 2 things:The text was updated successfully, but these errors were encountered: