Hey,
I was excited to read about prebuilt rule customization, which would alleviate my pain of duplicating prebuilt rules just to add some minute detail.
However, I was shocked to see this not just not in the free version, but is behind the enterprise subscription tier. I would like to discuss the reasoning behind this decision. When you start putting quality of life features behind your highest subscription tier, I don't understand it anymore. To me this is akin to locking dark mode or bulk editing behind enterprise tier. Elastic is already shamefully on the sso.tax list for locking SSO behind subscriptions, but this is a new level IMO.
