From 7532e40e464e477c42d360786850f1590635844d Mon Sep 17 00:00:00 2001
From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>
Date: Thu, 15 Feb 2024 16:04:19 -0500
Subject: [PATCH] [Known Issue] Add docs to describe a known issue/limitation
 of EQL rule cross-cluster search (#4813)

(cherry picked from commit 01ec37b913d729a49985a6d7d518ce0e3057fb8e)

# Conflicts:
#	docs/detections/api/rules/rules-api-create.asciidoc
#	docs/detections/rules-ui-create.asciidoc
---
 docs/detections/api/rules/rules-api-create.asciidoc |  9 +++++++++
 docs/detections/rules-ui-create.asciidoc            | 10 ++++++++++
 2 files changed, 19 insertions(+)

diff --git a/docs/detections/api/rules/rules-api-create.asciidoc b/docs/detections/api/rules/rules-api-create.asciidoc
index f24bc1766b..8585ecdf5d 100644
--- a/docs/detections/api/rules/rules-api-create.asciidoc
+++ b/docs/detections/api/rules/rules-api-create.asciidoc
@@ -387,6 +387,15 @@ Security Solution indices defined on the {kib} Advanced Settings page
 (*Kibana* → *Stack Management* → *Advanced Settings* →
 `securitySolution:defaultIndex`).
 
+<<<<<<< HEAD
+=======
+[NOTE]
+======
+- This field is not supported for ES\|QL rules.
+- Event correlation rules have a limitation that prevents them from querying multiple indices from different clusters (local and remote). To enable this, a user with the {ref}/built-in-roles.html[`superuser`] role must modify the EQL rules that are configured to use <<rules-cross-cluster-search,cross-cluster search>>. This updates the rule's API key to use `superuser` privileges and allows the rule to use cross-cluster search.
+======
+
+>>>>>>> 01ec37b ([Known Issue] Add docs to describe a known issue/limitation of EQL rule cross-cluster search (#4813))
 |risk_score_mapping |Object[] a|Overrides generated alerts' `risk_score` with
 a value from the source event:
 
diff --git a/docs/detections/rules-ui-create.asciidoc b/docs/detections/rules-ui-create.asciidoc
index f8849094a0..779d4c63d8 100644
--- a/docs/detections/rules-ui-create.asciidoc
+++ b/docs/detections/rules-ui-create.asciidoc
@@ -172,8 +172,18 @@ IMPORTANT: Alerts created by threshold rules are synthetic alerts that do not re
 [[create-eql-rule]]
 ==== Create an event correlation rule
 . To create an event correlation rule using EQL, select *Event Correlation*, then:
+<<<<<<< HEAD
 .. Define which {es} indices the rule searches for alerts.
 .. Add an {ref}/eql-syntax.html[EQL statement] used to detect alerts.
+=======
+.. Define which {es} indices or data view the rule searches when querying for events.
++
+NOTE: Event correlation rules have a limitation that prevents them from querying multiple indices from different clusters (local and remote). To enable this, a user with the {ref}/built-in-roles.html[`superuser`] role must modify the EQL rules that are configured to use <<rules-cross-cluster-search,cross-cluster search>>. This updates the rule's API key to use `superuser` privileges and allows the rule to use cross-cluster search.
+
+.. Write an {ref}/eql-syntax.html[EQL query] that searches for matching events or a series of matching events.
++
+TIP: To find events that are missing in a sequence, use the {ref}/eql-syntax.html#eql-missing-events[missing events] syntax.  
+>>>>>>> 01ec37b ([Known Issue] Add docs to describe a known issue/limitation of EQL rule cross-cluster search (#4813))
 +
 For example, the following rule detects when `msxsl.exe` makes an outbound
 network connection: