Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(Doc+) SIEM + frozen tier compatibility #5564

Merged
merged 7 commits into from
Aug 9, 2024
Merged

(Doc+) SIEM + frozen tier compatibility #5564

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
e7328dc
(Doc+) Frozen tier compatibility
stefnestor Jul 15, 2024
773a8d2
feedback
stefnestor Aug 5, 2024
590a582
feedback p2
stefnestor Aug 5, 2024
d5bc9dc
Update docs/detections/detection-engine-intro.asciidoc
nastasha-solomon Aug 5, 2024
5ab1b02
Merge branch 'main' into stef_coldFrozenTiers
nastasha-solomon Aug 5, 2024
f0ecd9a
feedback
stefnestor Aug 9, 2024
cbcd9bc
Merge branch 'main' into stef_coldFrozenTiers
nastasha-solomon Aug 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions docs/detections/detection-engine-intro.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,19 +63,20 @@ To make sure you can access Detections and manage rules, see

[float]
[[cold-tier-detections]]
== Compatibility with cold tier nodes
== Compatibility with cold and frozen tier nodes

Cold tier is a {ref}/data-tiers.html[data tier] that holds time series data that is accessed only occasionally. In {stack} version >=7.11.0, {elastic-sec} supports cold tier data for the following {es} indices:
Cold and frozen {ref}/data-tiers.html[data tiers] hold time series data that is only accessed occasionally. In {stack} version >=7.11.0, {elastic-sec} supports cold but not frozen tier data for the following {es} indices:

* Index patterns specified in `securitySolution:defaultIndex`
* Index patterns specified in the definitions of detection rules
* Index patterns specified in the definitions of detection rules, except for indicator match rules
* Index patterns specified in the data sources selector on various {security-app} pages

{elastic-sec} does *NOT* support cold tier data for the following {es} indices:
{elastic-sec} does *NOT* support either cold or frozen tier data for the following {es} indices:

* Index patterns controlled by {elastic-sec}, including alerts and list indices
* Index patterns specified in the definition of indicator match rules

Using cold tier data for unsupported indices may result in detection rule timeouts and overall performance degradation.
Using either cold or frozen tier data for unsupported indices may result in detection rule timeouts and overall performance degradation.

[float]
[[support-indicator-rules]]
Expand All @@ -85,7 +86,7 @@ Indicator match rules provide a powerful capability to search your security data

In addition, the following support restrictions are in place:

* {elastic-sec} does not support the use of frozen tier data with indicator match rules.
* {elastic-sec} does not support the use of either cold or frozen {ref}/data-tiers.html[tier data] with indicator match rules.
* Indicator match rules with an additional look-back time value greater than 24 hours are not supported.

[float]
Expand Down