Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Detection Engine] update lists API #4067

Merged
merged 15 commits into from
Nov 3, 2023
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ entities:
image::images/exceptions-logic.png[]

IMPORTANT: Before you can create exceptions, you must create `.lists` and
`.items` indices for the {kib} space (see <<lists-index-api-overview>>).
`.items` data streams for the {kib} space (see <<lists-index-api-overview>>).

[float]
=== Kibana role requirements
Expand All @@ -47,7 +47,7 @@ To create list containers and items, the user role for the {kib} space must
have:

* `read` and `write` index privileges for the
`.lists` and `.items` indices (the system index used for storing exception lists).
`.lists` and `.items` data streams (the system data stream used for storing exception lists).
* {kib} space `All` privileges for the `Security` and `Saved Objects Management`
features (see
{kibana-ref}/xpack-spaces.html#spaces-control-user-access[Feature access based on user privileges]).
Expand Down
28 changes: 14 additions & 14 deletions docs/detections/api/exceptions/lists-index-api-overview.asciidoc
Original file line number Diff line number Diff line change
@@ -1,17 +1,17 @@
[[lists-index-api-overview]]
=== Lists index endpoint
=== Lists data stream endpoint

Before using exceptions and lists, use the `index` endpoint to create `.lists`
and `.items` system indices in the relevant
and `.items` system data streams in the relevant
{kibana-ref}/xpack-spaces.html[{kib} space].

For information about the permissions and privileges required to create
`.lists` and `.items` indices, see <<enable-detections-ui>>.
`.lists` and `.items` data streams, see <<enable-detections-ui>>.

[discrete]
=== Create index
=== Create data stream

Creates `.lists` and `.items` indices. The indices naming convention is
Creates `.lists` and `.items` data streams. The data streams naming convention is
`.lists-<space name>` and `.items-<space name>`.

[discrete]
Expand All @@ -22,7 +22,7 @@ Creates `.lists` and `.items` indices. The indices naming convention is
[discrete]
===== Example request

Creates `.lists` and `.items` indices.
Creates `.lists` and `.items` data streams.

[source,console]
--------------------------------------------------
Expand All @@ -39,7 +39,7 @@ POST api/lists/index
[discrete]
=== Get index

Verifies `.lists` and `.items` indices exist.
Verifies `.lists` and `.items` data streams exist.

[discrete]
==== Request URL
Expand All @@ -49,7 +49,7 @@ Verifies `.lists` and `.items` indices exist.
[discrete]
===== Example request

Verifies the `lists` index for the {kib} `security` exists:
Verifies the `lists` data stream for the {kib} `security` exists:

[source,console]
--------------------------------------------------
Expand All @@ -63,12 +63,12 @@ GET api/lists/index
`200`::
Indicates a successful call.
`404`::
Indicates no index exists.
Indicates no data stream exists.

[discrete]
===== Example responses

Example response when the indices exist:
Example response when the data streams exist:

[source,json]
--------------------------------------------------
Expand All @@ -83,15 +83,15 @@ Example response when the indices do not exist:
[source,json]
--------------------------------------------------
{
"message": "index .lists-default and index .items-default does not exist",
"message": "data stream .lists-default and data stream .items-default does not exist",
"status_code": 404
}
--------------------------------------------------

[discrete]
=== Delete index
=== Delete data streams

Deletes the `.lists` and `.items` indices.
Deletes the `.lists` and `.items` data streams.

[discrete]
==== Request URL
Expand All @@ -101,7 +101,7 @@ Deletes the `.lists` and `.items` indices.
[discrete]
===== Example request

Deletes the `.lists` and `.items` indices:
Deletes the `.lists` and `.items` data streams:

[source, js]
--------------------------------------------------
Expand Down
4 changes: 2 additions & 2 deletions docs/detections/api/lists/lists-api-overview.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ operator and associate it with an <<exceptions-api-create-container, exception c
You can then add the exception container to a rule's `exceptions_list` object.

IMPORTANT: Before you can create lists, you must create `.lists` and `.items`
indices for the {kib} space (see <<lists-index-api-overview>>).
data streams for the {kib} space (see <<lists-index-api-overview>>).

[float]
=== Kibana role requirements
Expand All @@ -64,7 +64,7 @@ To create list containers and items, the user role for the {kib} space must
have:

* `read` and `write` index privileges for the
`.lists` and `.items` indices (the system index used for storing exception lists).
`.lists` and `.items` data streams (the system data stream used for storing exception lists).
* {kib} space `All` privileges for the `Security` and `Saved Objects Management`
features (see
{kibana-ref}/xpack-spaces.html#spaces-control-user-access[Feature access based on user privileges]).
Expand Down
2 changes: 1 addition & 1 deletion docs/getting-started/detections-req.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ named `.alerts-security.alerts-default`. If you're upgrading to 8.0.0 or later,
|Enable the Detections feature in your Kibana space
|The `manage` privilege

a|The `manage`, `write`,`read`, and `view_index_metadata` index privileges for the following system indices, where `<space-id>` is the {kib} space name:
a|The `manage`, `write`,`read`, and `view_index_metadata` index privileges for the following system indices and data streams, where `<space-id>` is the {kib} space name:

* `.alerts-security.alerts-<space-id>`
* `.siem-signals-<space-id>` ^1^
Expand Down