Just a question about a siem rule filter

Elastic Security SIEM
1

Hello,

Just wondering what's the purpose of the extra info / metadata in the filter of for example:

I can't find this info in the SIEM rule when I duplicate it:

image
image866×821 56.5 KB

{
    "$state": {
        "store": "appState"
    },
    "exists": {
        "field": "user_agent.original"
    },
    "meta": {
        "disabled": false,
        "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
        "key": "user_agent.original",
        "negate": true,
        "type": "exists",
        "value": "exists"
    }
}

What does the meta and $state do exactly? And why can't I find this info in the rule configuration?

Grtz

Willem

2

Hi @willemdh,

The meta and $state entries are used to serialize and deserialize the state of the search bar filters shown in the Custom query section of the rule configuration.

Let's explore how the JSON in the previous post maps to the screenshot of the rule configuration:

  • the value of the key entry in the meta section of the JSON:
"key": "user_agent.original"

corresponds with the search bar filter's Field user_agent.original in the screenshot you provided (:eyes: focus on the EDIT FILTER popover):

  • the value for the type entry in the meta section of the JSON:
"type": "exists",

is combined with the negate entry (also in the meta section of the JSON):

"negate": true,

to become Operator does not exist in the screenshot:

Thanks for your question!

3

Hello @Andrew_G,

Thanks a lot for the detailed explanation. Just to get to the bottom of this...

(:eyes: focus on the EDIT FILTER popover):

When I click 'Edit filter' I do not see the meta and $state keys:

image
image951×598 37.9 KB

This is normal right? (The rule has been duplicated and edited, but I did not touch this filter)

I just find it weird that pasting

{
  "exists": {
    "field": "user_agent.original"
  }
}

Seems to have the same result as pasting

{
    "$state": {
        "store": "appState"
    },
    "exists": {
        "field": "user_agent.original"
    },
    "meta": {
        "disabled": false,
        "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index",
        "key": "user_agent.original",
        "negate": true,
        "type": "exists",
        "value": "exists"
    }
}

After saving any of the above and going back to 'Edit filter', I always see:

image
image471×504 20.6 KB

Grtz

Willem

4

Yes, this is normal; the meta and $state fields are internal, and not intended to be editable via the UI.