From eef78f1989d308917373d316ef6ef63e42ada603 Mon Sep 17 00:00:00 2001 From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com> Date: Thu, 21 Mar 2024 17:30:14 -0400 Subject: [PATCH] [8.8] Manual prebuilt rule updates support notice (backport #4934) (#4959) * Manual prebuilt rule updates support notice (#4934) * Add statement to relevant pages - Upgrade Elastic Security - Install and manage Elastic prebuilt rules * Update docs/detections/prebuilt-rules-management.asciidoc Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> * Update docs/upgrade/upgrade-security.asciidoc Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/upgrade/upgrade-security.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com> Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> (cherry picked from commit 9ad5d7054bafa40235c2df6888c29b92f87845f3) # Conflicts: # docs/detections/prebuilt-rules-management.asciidoc * Delete docs/detections/prebuilt-rules-management.asciidoc Clean up merge conflict * Update rules-ui-manage.asciidoc Add note * Update docs/upgrade/upgrade-security.asciidoc Another fix --------- Co-authored-by: Joe Peeples --- docs/detections/rules-ui-manage.asciidoc | 6 ++++-- docs/upgrade/upgrade-security.asciidoc | 3 +++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/docs/detections/rules-ui-manage.asciidoc b/docs/detections/rules-ui-manage.asciidoc index 9d9bdc6d3f..a04700f8e4 100644 --- a/docs/detections/rules-ui-manage.asciidoc +++ b/docs/detections/rules-ui-manage.asciidoc @@ -62,10 +62,12 @@ You can then activate whichever rules you want. If you delete any prebuilt rules [NOTE] ============== -Apart from the Elastic Endpoint rule, prebuilt rules are not activated by +* Apart from the Elastic Endpoint rule, prebuilt rules are not activated by default. If you want to modify a prebuilt rule, you must first duplicate it, then make your changes to the duplicated rule. All Elastic prebuilt rules are tagged with the word `Elastic`. - ++ To learn how to enable detection rules in Elastic Security, watch the <> at the end of this topic. + +* Automatic updates of Elastic prebuilt rules are supported for the current {elastic-sec} version and the latest three previous minor releases. For example, if you’re on {elastic-sec} 8.10, you’ll be able to use the Rules UI to update your prebuilt rules until {elastic-sec} 8.14 is released. After that point, you can still manually download and install updated prebuilt rules, but you must upgrade to the latest {elastic-sec} version to receive automatic updates. ============== [float] diff --git a/docs/upgrade/upgrade-security.asciidoc b/docs/upgrade/upgrade-security.asciidoc index a3c26b0382..a4cd51b189 100644 --- a/docs/upgrade/upgrade-security.asciidoc +++ b/docs/upgrade/upgrade-security.asciidoc @@ -37,6 +37,9 @@ IMPORTANT: You can upgrade to pre-release versions for testing, but upgrading from a pre-release to the Generally Available version is unsupported. You should use pre-release versions only for testing in a temporary environment. +[float] +=== Support for Elastic prebuilt detection rule automatic updates +<> are supported for the current {elastic-sec} version and the latest three previous minor releases. For example, if you’re upgrading to {elastic-sec} 8.10, you’ll be able to use the Rules UI to update your prebuilt rules until {elastic-sec} 8.14 is released. After that point, you can still manually download and install updated prebuilt rules, but you must upgrade to the latest {elastic-sec} version to receive automatic updates. [float] [[preventing-migration-failures]]