[8.6] Document a known issue about detection rules being duplicated u…

…pon update (backport #4022) (#4081) Co-authored-by: Nastasha Solomon <[email protected]> Co-authored-by: nastasha.solomon <[email protected]>
elastic · Oct 19, 2023 · 5cdea47 · 5cdea47
1 parent be2e710
commit 5cdea47
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/docs/release-notes/8.6.asciidoc b/docs/release-notes/8.6.asciidoc
@@ -5,6 +5,11 @@
 [[release-notes-8.6.2]]
 == 8.6.2
 
+[discrete]
+[[known-issue-8.6.2]]
+==== Known issues
+* After upgrading Elastic prebuilt rules, some rules are erroneously duplicated as custom rules. To remove them, go to the Rules page (**Manage** -> **Rules**), click the **Custom rules** filter next to the search bar, then select and delete the duplicate rules. 
+
 [discrete]
 [[bug-fixes-8.6.2]]
 ==== Bug fixes and enhancements
@@ -15,6 +20,11 @@
 [[release-notes-8.6.1]]
 == 8.6.1
 
+[discrete]
+[[known-issue-8.6.1]]
+==== Known issues
+* After upgrading Elastic prebuilt rules, some rules are erroneously duplicated as custom rules. To remove them, go to the Rules page (**Manage** -> **Rules**), click the **Custom rules** filter next to the search bar, then select and delete the duplicate rules. 
+
 [discrete]
 [[bug-fixes-8.6.1]]
 ==== Bug fixes and enhancements
@@ -29,6 +39,7 @@
 [discrete]
 [[known-issue-8.6.0]]
 ==== Known issues
+* After upgrading Elastic prebuilt rules, some rules are erroneously duplicated as custom rules. To remove them, go to the Rules page (**Manage** -> **Rules**), click the **Custom rules** filter next to the search bar, then select and delete the duplicate rules. 
 * When using the Osquery Manager integration with {agent}, Osquery results aren't properly written to {es} and, therefore, cannot be viewed in Kibana (https://github.com/elastic/beats/issues/34250)[#34250]). We recommend that Osquery users skip {stack} version 8.6.0 and upgrade to {stack} version 8.6.1 or later when available.
 * Investigation guides for some prebuilt rules may not render correctly if they include an escaped character (such as `\"`). To resolve this, update your prebuilt rules once you receive a rule update prompt on the Rules page (https://github.com/elastic/detection-rules/pull/2447[#2447]).