From 77d4e0c611cb41a092cd1a0d2d862b4be5ec0dad Mon Sep 17 00:00:00 2001
From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com>
Date: Fri, 22 Mar 2024 10:16:01 -0400
Subject: [PATCH] [8.0] Manual prebuilt rule updates support notice (backport
 #4934) (#4968)

* Manual prebuilt rule updates support notice (#4934)

* Add statement to relevant pages

- Upgrade Elastic Security
- Install and manage Elastic prebuilt rules

* Update docs/detections/prebuilt-rules-management.asciidoc

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

* Update docs/upgrade/upgrade-security.asciidoc

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

* Update docs/upgrade/upgrade-security.asciidoc

---------

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>
Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>
(cherry picked from commit 9ad5d7054bafa40235c2df6888c29b92f87845f3)

# Conflicts:
#	docs/detections/prebuilt-rules-management.asciidoc
#	docs/upgrade/upgrade-security.asciidoc

* Fix merge conflict

---------

Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
---
 docs/detections/rules-ui-manage.asciidoc | 6 ++++--
 docs/upgrade/upgrade-security.asciidoc   | 5 +++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/docs/detections/rules-ui-manage.asciidoc b/docs/detections/rules-ui-manage.asciidoc
index fc05ea5bc2..a6101c1b57 100644
--- a/docs/detections/rules-ui-manage.asciidoc
+++ b/docs/detections/rules-ui-manage.asciidoc
@@ -28,10 +28,12 @@ You can then activate whichever rules you want. If you delete any prebuilt rules
 
 [NOTE]
 ==============
-Apart from the Elastic Endpoint rule, prebuilt rules are not activated by
+* Apart from the Elastic Endpoint rule, prebuilt rules are not activated by
 default. If you want to modify a prebuilt rule, you must first duplicate it, then make your changes to the duplicated rule. All Elastic prebuilt rules are tagged with the word `Elastic`.
-
++
 To learn how to enable detection rules in Elastic Security, watch the <<enable-detection-rules, tutorial>> at the end of this topic.
+
+* Automatic updates of Elastic prebuilt rules are supported for the current {elastic-sec} version and the latest three previous minor releases. For example, if you’re on {elastic-sec} 8.10, you’ll be able to use the Rules UI to update your prebuilt rules until {elastic-sec} 8.14 is released. After that point, you can still manually download and install updated prebuilt rules, but you must upgrade to the latest {elastic-sec} version to receive automatic updates.
 ==============
 
 [float]
diff --git a/docs/upgrade/upgrade-security.asciidoc b/docs/upgrade/upgrade-security.asciidoc
index d52a44487c..3d7baaf827 100644
--- a/docs/upgrade/upgrade-security.asciidoc
+++ b/docs/upgrade/upgrade-security.asciidoc
@@ -93,3 +93,8 @@ Changes to the indicator match rule's <<rule-ui-advanced-params, default threat
 * If an indicator match rule's default threat indicator path was not defined before the upgrade, it will default to `threatintel.indicator` after the upgrade. This allows the rule to continue using indicator data ingested by {filebeat} version 7.x. If a custom value was defined before the upgrade, the value will not change.
 * If an existing indicator match rule was configured to use threat indicator indices generated from {filebeat} version 7.x, updating the default threat indicator path to `threat.indicator` after you upgrade to {stack} version 8.0 and {agent} or {filebeat} version 8.0 configures the rule to use threat indicator indices generated by those later versions.
 * You must create separate rules to query threat intelligence indices created by {filebeat} version 7.x and version 8.0 because each version requires a different default threat indicator path value. Review the recommendations for <<query-alert-indices, querying alert indices>>.
+
+[float]
+[[prebuilt-rule-updates]]
+=== Support for Elastic prebuilt detection rule automatic updates
+<<load-prebuilt-rules,Automatic updates of Elastic prebuilt detection rules>> are supported for the current {elastic-sec} version and the latest three previous minor releases. For example, if you’re upgrading to {elastic-sec} 8.10, you’ll be able to use the Rules UI to update your prebuilt rules until {elastic-sec} 8.14 is released. After that point, you can still manually download and install updated prebuilt rules, but you must upgrade to the latest {elastic-sec} version to receive automatic updates.