Skip to content

Commit f45fa4b

Browse files
[8.6] Manual prebuilt rule updates support notice (backport #4934) (#4961)
* Manual prebuilt rule updates support notice (#4934) * Add statement to relevant pages - Upgrade Elastic Security - Install and manage Elastic prebuilt rules * Update docs/detections/prebuilt-rules-management.asciidoc Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/upgrade/upgrade-security.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/upgrade/upgrade-security.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]> Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 9ad5d70) # Conflicts: # docs/upgrade/upgrade-security.asciidoc * Fix merge conflict --------- Co-authored-by: Joe Peeples <[email protected]>
1 parent 9414446 commit f45fa4b

File tree

3 files changed

+14
-2
lines changed

3 files changed

+14
-2
lines changed

docs/detections/prebuilt-rules-management.asciidoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ Follow these guidelines to start using the {es-sec-app}'s <<prebuilt-rules, preb
1919
* Prebuilt rules don't start running by default. You must first install the rules, then enable them. After installation, only a few prebuilt rules will be enabled by default, such as the Endpoint Security rule.
2020
2121
* You can't modify most settings on Elastic prebuilt rules. You can only edit <<rule-notifications, rule actions>> and <<add-exceptions, add exceptions>>. If you want to modify other settings on a prebuilt rule, you must first duplicate it, then make your changes to the duplicated rule. However, your customized rule is entirely separate from the original prebuilt rule, and will not get updates from Elastic if the prebuilt rule is updated.
22+
23+
* Automatic updates of Elastic prebuilt rules are supported for the current {elastic-sec} version and the latest three previous minor releases. For example, if you’re on {elastic-sec} 8.10, you’ll be able to use the Rules UI to update your prebuilt rules until {elastic-sec} 8.14 is released. After that point, you can still manually download and install updated prebuilt rules, but you must upgrade to the latest {elastic-sec} version to receive automatic updates.
2224
====
2325

2426
[float]

docs/detections/rules-ui-manage.asciidoc

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,10 +59,12 @@ You can then activate whichever rules you want. If you delete any prebuilt rules
5959

6060
[NOTE]
6161
==============
62-
Apart from the Elastic Endpoint rule, prebuilt rules are not activated by
62+
* Apart from the Elastic Endpoint rule, prebuilt rules are not activated by
6363
default. If you want to modify a prebuilt rule, you must first duplicate it, then make your changes to the duplicated rule. All Elastic prebuilt rules are tagged with the word `Elastic`.
64-
64+
+
6565
To learn how to enable detection rules in Elastic Security, watch the <<enable-detection-rules, tutorial>> at the end of this topic.
66+
67+
* Automatic updates of Elastic prebuilt rules are supported for the current {elastic-sec} version and the latest three previous minor releases. For example, if you’re on {elastic-sec} 8.10, you’ll be able to use the Rules UI to update your prebuilt rules until {elastic-sec} 8.14 is released. After that point, you can still manually download and install updated prebuilt rules, but you must upgrade to the latest {elastic-sec} version to receive automatic updates.
6668
==============
6769

6870
[float]

docs/upgrade/upgrade-security.asciidoc

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,14 @@ For large deployments with more than 10 {kib} instances, and more than 10,000 sa
4040
you can reduce the upgrade downtime by bringing up a single {kib} instance and waiting for it to
4141
complete the upgrade migration before bringing up the remaining instances.
4242

43+
IMPORTANT: You can upgrade to pre-release versions for testing,
44+
but upgrading from a pre-release to the Generally Available version is unsupported.
45+
You should use pre-release versions only for testing in a temporary environment.
46+
47+
[float]
48+
=== Support for Elastic prebuilt detection rule automatic updates
49+
<<load-prebuilt-rules,Automatic updates of Elastic prebuilt detection rules>> are supported for the current {elastic-sec} version and the latest three previous minor releases. For example, if you’re upgrading to {elastic-sec} 8.10, you’ll be able to use the Rules UI to update your prebuilt rules until {elastic-sec} 8.14 is released. After that point, you can still manually download and install updated prebuilt rules, but you must upgrade to the latest {elastic-sec} version to receive automatic updates.
50+
4351
[float]
4452
[[preventing-migration-failures]]
4553
=== Preparing for migration

0 commit comments

Comments
 (0)