diff --git a/x-pack/plugins/cloud_security_posture/public/pages/configurations/findings_flyout/findings_detection_rule_counter.tsx b/x-pack/plugins/cloud_security_posture/public/pages/configurations/findings_flyout/findings_detection_rule_counter.tsx
index 5586f2a20126c..f39379f8c4ddd 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/configurations/findings_flyout/findings_detection_rule_counter.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/pages/configurations/findings_flyout/findings_detection_rule_counter.tsx
@@ -9,13 +9,19 @@ import type { HttpSetup } from '@kbn/core/public';
import React from 'react';
import { CspFinding } from '../../../../common/schemas/csp_finding';
import { DetectionRuleCounter } from '../../../components/detection_rule_counter';
-import { createDetectionRuleFromFinding } from '../utils/create_detection_rule_from_finding';
+import {
+ createDetectionRuleFromFinding,
+ getFindingsDetectionRuleSearchTags,
+} from '../utils/create_detection_rule_from_finding';
export const FindingsDetectionRuleCounter = ({ finding }: { finding: CspFinding }) => {
const createMisconfigurationRuleFn = async (http: HttpSetup) =>
await createDetectionRuleFromFinding(http, finding);
return (
-
+
);
};
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/configurations/utils/create_detection_rule_from_finding.ts b/x-pack/plugins/cloud_security_posture/public/pages/configurations/utils/create_detection_rule_from_finding.ts
index 778c222d2f5e1..a1f8ac3fa5fcc 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/configurations/utils/create_detection_rule_from_finding.ts
+++ b/x-pack/plugins/cloud_security_posture/public/pages/configurations/utils/create_detection_rule_from_finding.ts
@@ -50,9 +50,23 @@ const CSP_RULE_TAG_DATA_SOURCE_PREFIX = 'Data Source: ';
const STATIC_RULE_TAGS = [CSP_RULE_TAG, CSP_RULE_TAG_USE_CASE];
+/*
+ * Returns an array of CspFinding tags that can be used to search and filter a detection rule
+ */
+export const getFindingsDetectionRuleSearchTags = ({ rule }: CspFinding) => {
+ // ex: cis_gcp to ['CIS', 'GCP']
+ const benchmarkIdTags = rule.benchmark.id.split('_').map((tag) => tag.toUpperCase());
+ // ex: 'CIS GCP 1.1'
+ const benchmarkRuleNumberTag = `${rule.benchmark.id.replace('_', ' ').toUpperCase()} ${
+ rule.benchmark.rule_number
+ }`;
+
+ return benchmarkIdTags.concat([benchmarkRuleNumberTag]);
+};
+
const generateFindingsTags = (finding: CspFinding) => {
return [STATIC_RULE_TAGS]
- .concat(finding.rule.tags)
+ .concat(getFindingsDetectionRuleSearchTags(finding))
.concat(
finding.rule.benchmark.posture_type
? [