You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When you create a project, you select the project type applicable to your use case, so only the relevant and impactful applications and features are easily accessible to you.
|![observability](../../images/64x64_Color_observability-logo-color-64px.png"observability =50%")|**Observability**<br> Monitor applications and systems with Elastic Observability.<br><br>[**View guide →**](/solutions/observability/get-started.md)<br> |
22
-
|![security](../../images/64x64_Color_security-logo-color-64px.png"security =50%")|**Security**<br> Detect, investigate, and respond to threats with Elastic Security.<br><br>[**View guide →**](/solutions/security/get-started/create-security-project.md)<br> |
22
+
|![security](../../images/64x64_Color_security-logo-color-64px.png"security =50%")|**Security**<br> Detect, investigate, and respond to threats with Elastic Security.<br><br>[**View guide →**](/solutions/security/get-started.md#create-sec-serverless-project)<br> |
Copy file name to clipboardExpand all lines: deploy-manage/deploy/elastic-cloud/serverless.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,7 +29,7 @@ Elastic provides three serverless solutions available on {{ecloud}}. Follow thes
29
29
30
30
***[{{es-serverless}}](/solutions/search/get-started.md)**: Build powerful applications and search experiences using a rich ecosystem of vector search capabilities, APIs, and libraries.
31
31
***[{{obs-serverless}}](../../../solutions/observability/get-started.md)**: Monitor your own platforms and services using powerful machine learning and analytics tools with your logs, metrics, traces, and APM data.
32
-
***[{{sec-serverless}}](../../../solutions/security/get-started/create-security-project.md)**: Detect, investigate, and respond to threats with SIEM, endpoint protection, and AI-powered analytics capabilities.
32
+
***[{{sec-serverless}}](../../../solutions/security/get-started.md#create-sec-serverless-project)**: Detect, investigate, and respond to threats with SIEM, endpoint protection, and AI-powered analytics capabilities.
Copy file name to clipboardExpand all lines: deploy-manage/users-roles/cloud-organization/user-roles.md
+13-13Lines changed: 13 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -96,20 +96,20 @@ You can optionally [create custom roles in a project](/deploy-manage/users-roles
96
96
97
97
| Name | Description | Available |
98
98
| --- | --- | --- |
99
-
| Admin | Has full access to project management, properties, and security privileges. Admins log into projects with superuser role privileges. |[![Elasticsearch](/deploy-manage/images/serverless-es-badge.svg"")](../../../solutions/search.md)[![Observability](/deploy-manage/images/serverless-obs-badge.svg"")](../../../solutions/observability.md)[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)|
99
+
| Admin | Has full access to project management, properties, and security privileges. Admins log into projects with superuser role privileges. |[![Elasticsearch](/deploy-manage/images/serverless-es-badge.svg"")](../../../solutions/search.md)[![Observability](/deploy-manage/images/serverless-obs-badge.svg"")](../../../solutions/observability.md)[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security.md)|
100
100
| Developer | Creates API keys, indices, data streams, adds connectors, and builds visualizations. |[![Elasticsearch](/deploy-manage/images/serverless-es-badge.svg"")](../../../solutions/search.md)|
101
-
| Viewer | Has read-only access to project details, data, and features. |[![Elasticsearch](/deploy-manage/images/serverless-es-badge.svg"")](../../../solutions/search.md)[![Observability](/deploy-manage/images/serverless-obs-badge.svg"")](../../../solutions/observability.md)[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)|
102
-
| Editor | Configures all Observability or Security projects. Has read-only access to data indices. Has full access to all project features. |[![Observability](/deploy-manage/images/serverless-obs-badge.svg"")](../../../solutions/observability.md)[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)|
103
-
| Tier 1 analyst | Ideal for initial alert triage. General read access, can create dashboards and visualizations. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)|
104
-
| Tier 2 analyst | Ideal for alert triage and beginning the investigation process. Can create cases. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)|
105
-
| Tier 3 analyst | Deeper investigation capabilities. Access to rules, lists, cases, Osquery, and response actions. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)|
106
-
| Threat intelligence analyst | Access to alerts, investigation tools, and intelligence pages. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)|
107
-
| Rule author | Access to detection engineering and rule creation. Can create rules from available data sources and add exceptions to reduce false positives. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)|
108
-
| SOC manager | Access to alerts, cases, investigation tools, endpoint policy management, and response actions. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)|
109
-
| Endpoint operations analyst | Access to endpoint response actions. Can manage endpoint policies, {{fleet}}, and integrations. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)|
110
-
| Platform engineer | Access to {{fleet}}, integrations, endpoints, and detection content. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)|
111
-
| Detections admin | All available detection engine permissions to include creating rule actions, such as notifications to third-party systems. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)|
112
-
| Endpoint policy manager | Access to endpoint policy management and related artifacts. Can manage {{fleet}} and integrations. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)|
101
+
| Viewer | Has read-only access to project details, data, and features. |[![Elasticsearch](/deploy-manage/images/serverless-es-badge.svg"")](../../../solutions/search.md)[![Observability](/deploy-manage/images/serverless-obs-badge.svg"")](../../../solutions/observability.md)[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security.md)|
102
+
| Editor | Configures all Observability or Security projects. Has read-only access to data indices. Has full access to all project features. |[![Observability](/deploy-manage/images/serverless-obs-badge.svg"")](../../../solutions/observability.md)[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security.md)|
103
+
| Tier 1 analyst | Ideal for initial alert triage. General read access, can create dashboards and visualizations. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security.md)|
104
+
| Tier 2 analyst | Ideal for alert triage and beginning the investigation process. Can create cases. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security.md)|
105
+
| Tier 3 analyst | Deeper investigation capabilities. Access to rules, lists, cases, Osquery, and response actions. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security.md)|
106
+
| Threat intelligence analyst | Access to alerts, investigation tools, and intelligence pages. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security.md)|
107
+
| Rule author | Access to detection engineering and rule creation. Can create rules from available data sources and add exceptions to reduce false positives. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security.md)|
108
+
| SOC manager | Access to alerts, cases, investigation tools, endpoint policy management, and response actions. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security.md)|
109
+
| Endpoint operations analyst | Access to endpoint response actions. Can manage endpoint policies, {{fleet}}, and integrations. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security.md)|
110
+
| Platform engineer | Access to {{fleet}}, integrations, endpoints, and detection content. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security.md)|
111
+
| Detections admin | All available detection engine permissions to include creating rule actions, such as notifications to third-party systems. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security.md)|
112
+
| Endpoint policy manager | Access to endpoint policy management and related artifacts. Can manage {{fleet}} and integrations. |[![Security](/deploy-manage/images/serverless-sec-badge.svg"")](../../../solutions/security.md)|
Copy file name to clipboardExpand all lines: explore-analyze/alerts-cases/alerts/maintenance-windows.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ products:
12
12
13
13
# Maintenance windows
14
14
15
-
This content applies to: [![Observability](/explore-analyze/images/serverless-obs-badge.svg"")](../../../solutions/observability.md)[![Security](/explore-analyze/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)
15
+
This content applies to: [![Observability](/explore-analyze/images/serverless-obs-badge.svg"")](../../../solutions/observability.md)[![Security](/explore-analyze/images/serverless-sec-badge.svg"")](../../../solutions/security.md)
16
16
17
17
18
18
You can schedule single or recurring maintenance windows to temporarily reduce rule notifications. For example, a maintenance window prevents false alarms during planned outages.
Copy file name to clipboardExpand all lines: manage-data/ingest/transform-enrich/logstash-pipelines.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ products:
10
10
11
11
# Logstash pipelines [logstash-pipelines]
12
12
13
-
This content applies to: [![Elasticsearch](/manage-data/images/serverless-es-badge.svg"")](../../../solutions/search.md)[![Observability](/manage-data/images/serverless-obs-badge.svg"")](../../../solutions/observability.md)[![Security](/manage-data/images/serverless-sec-badge.svg"")](../../../solutions/security/elastic-security-serverless.md)
13
+
This content applies to: [![Elasticsearch](/manage-data/images/serverless-es-badge.svg"")](../../../solutions/search.md)[![Observability](/manage-data/images/serverless-obs-badge.svg"")](../../../solutions/observability.md)[![Security](/manage-data/images/serverless-sec-badge.svg"")](../../../solutions/security.md)
14
14
15
15
On the **{{ls-pipelines-app}}** management page, you can control multiple {{ls}} instances and pipeline configurations.
Copy file name to clipboardExpand all lines: reference/fleet/manage-integrations.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -43,6 +43,7 @@ You can perform a variety of actions in the **Integrations** app in {{kib}}. Som
43
43
|[Install and uninstall integration assets](/reference/fleet/install-uninstall-integration-assets.md)| Install, uninstall, and reinstall integration assets in {{kib}}. |
44
44
|[View integration assets](/reference/fleet/view-integration-assets.md)| View the {{kib}} assets installed for a specific integration. |
45
45
|[Upgrade an integration](/reference/fleet/upgrade-integration.md)| Upgrade an integration to the latest version. |
46
+
|[Roll back an integration](/reference/fleet/roll-back-integration.md) {applies_to}`stack: ga 9.3`| Roll back an integration to the previously installed version if issues occur after an upgrade. |
description: Roll back an Elastic Agent integration to the previously installed version, restoring the integration policies and configurations of the previous version.
4
+
applies_to:
5
+
stack: ga 9.3
6
+
serverless: ga
7
+
products:
8
+
- id: fleet
9
+
- id: elastic-agent
10
+
---
11
+
12
+
# Roll back an {{agent}} integration
13
+
14
+
::::{note}
15
+
This feature is available only for certain subscription levels. For more information, refer to [Elastic subscriptions]({{subscriptions}}).
16
+
::::
17
+
18
+
If you encounter issues after upgrading an integration, you can roll back the integration to the version installed before the upgrade. During the rollback action, the integration package and all associated integration policies and their configurations are automatically restored to the previously installed version.
19
+
20
+
Consider rolling back an integration if:
21
+
22
+
- The upgraded integration introduces breaking changes that affect your data collection.
23
+
- The new version causes unexpected behavior or errors in your environment.
24
+
- You need to revert to a previous version for compatibility reasons.
25
+
26
+
:::{note}
27
+
By default, the rollback action is available for 7 days following the integration upgrade. After the rollback window expires, you can no longer roll back the integration to the previously installed version.
28
+
29
+
You can [configure the rollback time-to-live (TTL)](#configure-rollback-ttl) in {{ech}} or self-managed deployments.
30
+
:::
31
+
32
+
## Requirements
33
+
34
+
To successfully roll back an integration, you must have access to all of its integration policies across **all spaces**. If you don't have access to the related spaces, the rollback action will not succeed.
35
+
36
+
## Roll back an integration
37
+
38
+
1. In {{kib}}, go to **Integrations** > **Installed integrations**.
39
+
2. Select the integration you want to roll back, then open the integration's **Settings** tab.
40
+
3. Click **Rollback <integration>**.
41
+
42
+
If the button is disabled for an integration, this may indicate:
43
+
- The 7-day rollback window has expired.
44
+
- You don't have access to all integration policies across all spaces.
45
+
- No previous version is available to roll back to.
46
+
- The integration was never upgraded.
47
+
- The integration is not installed from the {{package-registry}}.
48
+
49
+
4. In the confirmation window, click **Rollback integration**. A confirmation appears if the rollback is successful.
50
+
51
+
After the rollback of the integration is complete, the associated integration policies, their configurations and related assets are restored to the integration's previous version.
52
+
53
+
::::{tip}
54
+
You can also roll back an integration from **Integrations** > **Installed integrations**:
55
+
56
+
1. Click the actions button at the end of the integration's row.
57
+
2. Select **Rollback integration**, then confirm the action.
58
+
::::
59
+
60
+
:::{note}
61
+
The automatic upgrade of rolled back integrations is disabled until the integrations are manually upgraded.
62
+
:::
63
+
64
+
## Configure the rollback TTL [configure-rollback-ttl]
65
+
66
+
The default duration of the rollback window is 7 days. To configure the rollback TTL duration, add the `xpack.fleet.integrationRollbackTTL` setting in the user settings of your {{ech}} deployment or in the `kibana.yml` configuration file of your self-managed deployment.
67
+
68
+
For example, to extend the rollback window to 14 days, set:
69
+
70
+
```yml
71
+
xpack.fleet.integrationRollbackTTL: 14d
72
+
```
73
+
74
+
For more information, refer to [{{fleet}} settings in {{kib}}](kibana://reference/configuration-reference/fleet-settings.md).
0 commit comments