You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
% The advanced settings are located in a different place in Serverless. See line 27 in the raw migrated Serverless file for more info. Also remember to annotate the Serverless and ESS content appropriately.
63
-
64
35
To access advanced settings, go to **Stack Management** → **Advanced Settings**, then scroll down to **Security Solution** settings.
@@ -71,6 +42,8 @@ To access advanced settings, go to **Stack Management** → **Advanced Settings*
71
42
72
43
## Update default Elastic Security indices [update-sec-indices]
73
44
45
+
The `securitySolution:defaultIndex` field defines which {{es}} indices the {{security-app}} uses to collect data. By default, index patterns are used to match sets of {{es}} indices.
46
+
74
47
The `securitySolution:defaultIndex` field defines which {{es}} indices the {{security-app}} uses to collect data. By default, index patterns are used to match sets of {{es}} indices:
75
48
76
49
*`apm-*-transaction*`
@@ -105,7 +78,7 @@ If you leave the `-*elastic-cloud-logs-*` index pattern selected, all Elastic cl
105
78
106
79
The `securitySolution:defaultThreatIndex` advanced setting specifies threat intelligence indices that {{elastic-sec}} features query for ingested threat indicators. This setting affects features that query threat intelligence indices, such as the Threat Intelligence view on the Overview page, indicator match rules, and the alert enrichment query.
107
80
108
-
% The max limit of threat intel indices is different in the Serverless docs -- not sure why. See line 80 in the raw migrated Serverless file for more info. If add the Serverless content, remember to annotate the Serverless and ESS content appropriately.
81
+
109
82
110
83
You can specify one or more threat intelligence indices; multiple indices must be separated by commas. By default, only the `logs-ti*` index pattern is specified. Do not remove or overwrite this index pattern, as it is used by {{agent}} integrations.
0 commit comments