-
Notifications
You must be signed in to change notification settings - Fork 191
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Serverless] Document impact of using logsDB for security users (#6221)
* First draft * Fixes ref * Some light edits for grammar and clarity. * Fixing broken ref link * Input from Kseniia and Vitalii * Fix links * Kseniia's initial feedback * Update docs/serverless/rules/detections-logsdb-impact.asciidoc * Removed extra word * Update docs/serverless/rules/detections-logsdb-impact.asciidoc Co-authored-by: Janeen Mikell Roberts <[email protected]> * Update docs/serverless/rules/detections-logsdb-impact.asciidoc Co-authored-by: Janeen Mikell Roberts <[email protected]> * Update docs/serverless/rules/detections-logsdb-impact.asciidoc Co-authored-by: Janeen Mikell Roberts <[email protected]> * Update docs/serverless/rules/detections-logsdb-impact.asciidoc --------- Co-authored-by: Janeen Roberts <[email protected]> Co-authored-by: Janeen Mikell Roberts <[email protected]>
- Loading branch information
1 parent
44b15bd
commit b21848b
Showing
3 changed files
with
70 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,63 @@ | ||
[[detections-logsdb-index-mode-impact]] | ||
= Using logsDB index mode with {sec-serverless} | ||
|
||
LogsDB is enabled by default for {serverless-full}. This topic explains the impact of using logsDB index mode with {sec-serverless}. | ||
|
||
With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. | ||
|
||
When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between user's expectations and how fields are formatted. | ||
|
||
Continue reading to find out how this affects specific {sec-serverless} components. | ||
|
||
[discrete] | ||
[[logsdb-alerts]] | ||
== Alerts | ||
|
||
When alerts are generated, the `_source` event is copied into the alert to retain the original data. When the logsDB index mode is applied, the `_source` event stored in the alert is reconstructed using synthetic `_source`. | ||
|
||
If you're switching to use logsDB index mode, the `_source` field stored in the alert might look different in certain situations: | ||
|
||
* {ref}/mapping-source-field.html#synthetic-source-modifications-leaf-arrays[Arrays can be reconstructed differently or deduplicated] | ||
* {ref}/mapping-source-field.html#synthetic-source-modifications-field-names[Field names] | ||
* `geo_point` data fields (refer to {ref}/mapping-source-field.html#synthetic-source-modifications-ranges[Representation of ranges] and {ref}/mapping-source-field.html#synthetic-source-precision-loss-for-point-types[Reduced precision of `geo_point` values] for more information) | ||
|
||
Alerts generated by the following rule types could be affected: | ||
|
||
* Custom query | ||
* Event correlation (non-sequence only) | ||
* Non-aggregate rule types (for example, {esql} rules that use non-aggregating queries) | ||
|
||
Alerts that are generated by threshold, {ml}, and event correlation sequence rules are not affected since they do not contain copies of the original source. | ||
|
||
[discrete] | ||
[[logsdb-rule-actions]] | ||
== Rule actions | ||
|
||
While we do not recommend using `_source` for actions, in cases where the action relies on the `_source`, the same limitations and changes apply. | ||
|
||
If you send alert notifications by enabling {kibana-ref}/alerting-getting-started.html#alerting-concepts-actions[actions] to the external systems that have workflows or automations based on fields formatted from the original source, they may be affected. In particular, this can happen when the fields used are arrays of objects. | ||
|
||
We recommend checking and adjusting the rule actions using `_source` before switching to logsDB index mode. | ||
|
||
[discrete] | ||
[[logsdb-runtime-fields]] | ||
== Runtime fields | ||
|
||
Runtime fields that reference `_source` may be affected. Some runtime fields might not work and need to be adjusted. For example, if an event was indexed with the value of `agent.name` in the dot-notation form, it will be returned in the nested form and might not work. | ||
|
||
The following is an example of accessing `_source` that works with the logsDB index mode enabled: | ||
|
||
[source,console] | ||
---- | ||
"source": """ emit(params._source.agent.name + "_____" + doc['agent.name'].value ); """ | ||
"source": """ emit(params._source['agent']['name'] + "_____" + doc['agent.name'].value ); """ | ||
"source": """ emit(field('agent.name').get(null) + "_____" + doc['agent.name'].value ); """ | ||
"source": """ emit($('agent.name', null) + "_____" + doc['agent.name'].value ); """ | ||
---- | ||
|
||
The following will not work with synthetic source (logsDB index mode enabled): | ||
|
||
[source,console] | ||
---- | ||
"source": """ emit(params._source['agent.name'] + "_____" + doc['agent.name'].value ); """ | ||
---- |