Skip to content

Commit cc1a62a

Browse files
[8.1] Manual prebuilt rule updates support notice (backport #4934) (#4966)
* Manual prebuilt rule updates support notice (#4934) * Add statement to relevant pages - Upgrade Elastic Security - Install and manage Elastic prebuilt rules * Update docs/detections/prebuilt-rules-management.asciidoc Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> * Update docs/upgrade/upgrade-security.asciidoc Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/upgrade/upgrade-security.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> (cherry picked from commit 9ad5d70) # Conflicts: # docs/detections/prebuilt-rules-management.asciidoc # docs/upgrade/upgrade-security.asciidoc * Fix merge conflict --------- Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
1 parent e572f70 commit cc1a62a

File tree

2 files changed

+9
-2
lines changed

2 files changed

+9
-2
lines changed

docs/detections/rules-ui-manage.asciidoc

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,12 @@ You can then activate whichever rules you want. If you delete any prebuilt rules
3131

3232
[NOTE]
3333
==============
34-
Apart from the Elastic Endpoint rule, prebuilt rules are not activated by
34+
* Apart from the Elastic Endpoint rule, prebuilt rules are not activated by
3535
default. If you want to modify a prebuilt rule, you must first duplicate it, then make your changes to the duplicated rule. All Elastic prebuilt rules are tagged with the word `Elastic`.
36-
36+
+
3737
To learn how to enable detection rules in Elastic Security, watch the <<enable-detection-rules, tutorial>> at the end of this topic.
38+
39+
* Automatic updates of Elastic prebuilt rules are supported for the current {elastic-sec} version and the latest three previous minor releases. For example, if you’re on {elastic-sec} 8.10, you’ll be able to use the Rules UI to update your prebuilt rules until {elastic-sec} 8.14 is released. After that point, you can still manually download and install updated prebuilt rules, but you must upgrade to the latest {elastic-sec} version to receive automatic updates.
3840
==============
3941

4042
[float]

docs/upgrade/upgrade-security.asciidoc

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,3 +112,8 @@ Changes to the indicator match rule's <<rule-ui-advanced-params, default threat
112112
* If an indicator match rule's default threat indicator path was not defined before the upgrade, it will default to `threatintel.indicator` after the upgrade. This allows the rule to continue using indicator data ingested by {filebeat} version 7.x. If a custom value was defined before the upgrade, the value will not change.
113113
* If an existing indicator match rule was configured to use threat indicator indices generated from {filebeat} version 7.x, updating the default threat indicator path to `threat.indicator` after you upgrade to {stack} version 8.0 and {agent} or {filebeat} version 8.0 configures the rule to use threat indicator indices generated by those later versions.
114114
* You must create separate rules to query threat intelligence indices created by {filebeat} version 7.x and version 8.0 because each version requires a different default threat indicator path value. Review the recommendations for <<query-alert-indices, querying alert indices>>.
115+
116+
[float]
117+
[[prebuilt-rule-updates]]
118+
=== Support for Elastic prebuilt detection rule automatic updates
119+
<<load-prebuilt-rules,Automatic updates of Elastic prebuilt detection rules>> are supported for the current {elastic-sec} version and the latest three previous minor releases. For example, if you’re upgrading to {elastic-sec} 8.10, you’ll be able to use the Rules UI to update your prebuilt rules until {elastic-sec} 8.14 is released. After that point, you can still manually download and install updated prebuilt rules, but you must upgrade to the latest {elastic-sec} version to receive automatic updates.

0 commit comments

Comments
 (0)