[8.15] (Doc+) SIEM + frozen tier compatibility (backport #5564) (#5696)

* (Doc+) Frozen tier compatibility * feedback Co-authored-by: Nastasha Solomon <[email protected]> * feedback p2 * Update docs/detections/detection-engine-intro.asciidoc * feedback --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 9d06354) Co-authored-by: Stef Nestor <[email protected]> Co-authored-by: Nastasha Solomon <[email protected]>
elastic · Aug 13, 2024 · 5edea4f · 5edea4f
1 parent 7fdbc28
commit 5edea4f
Showing 1 changed file with 7 additions and 6 deletions.
diff --git a/docs/detections/detection-engine-intro.asciidoc b/docs/detections/detection-engine-intro.asciidoc
@@ -63,19 +63,20 @@ To make sure you can access Detections and manage rules, see
 
 [float]
 [[cold-tier-detections]]
-== Compatibility with cold tier nodes
+== Compatibility with cold and frozen tier nodes
 
-Cold tier is a {ref}/data-tiers.html[data tier] that holds time series data that is accessed only occasionally. In {stack} version >=7.11.0, {elastic-sec} supports cold tier data for the following {es} indices:
+Cold and frozen {ref}/data-tiers.html[data tiers] hold time series data that is only accessed occasionally. In {stack} version >=7.11.0, {elastic-sec} supports cold but not frozen tier data for the following {es} indices:
 
 * Index patterns specified in `securitySolution:defaultIndex`
-* Index patterns specified in the definitions of detection rules
+* Index patterns specified in the definitions of detection rules, except for indicator match rules 
 * Index patterns specified in the data sources selector on various {security-app} pages
 
-{elastic-sec} does *NOT* support cold tier data for the following {es} indices:
+{elastic-sec} does *NOT* support either cold or frozen tier data for the following {es} indices:
 
 * Index patterns controlled by {elastic-sec}, including alerts and list indices
+* Index patterns specified in the definition of indicator match rules 
 
-Using cold tier data for unsupported indices may result in detection rule timeouts and overall performance degradation.
+Using either cold or frozen tier data for unsupported indices may result in detection rule timeouts and overall performance degradation.
 
 [float]
 [[support-indicator-rules]]
@@ -85,7 +86,7 @@ Indicator match rules provide a powerful capability to search your security data
 
 In addition, the following support restrictions are in place:
 
-* {elastic-sec} does not support the use of frozen tier data with indicator match rules.
+* {elastic-sec} does not support the use of either cold or frozen {ref}/data-tiers.html[tier data] with indicator match rules.
 * Indicator match rules with an additional look-back time value greater than 24 hours are not supported.
 
 [float]