Skip to content

Commit a13bdb2

Browse files
committed
add index info, updates file name
1 parent 4a0cc5e commit a13bdb2

File tree

3 files changed

+11
-4
lines changed

3 files changed

+11
-4
lines changed

solutions/security/get-started.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ This section describes how to set up {{elastic-sec}}, install {{agent}} and the
1414
* [Detect threats in my data with SIEM](https://www.elastic.co/getting-started/security/detect-threats-in-my-data-with-siem)
1515

1616
::::{note}
17-
If you're migrating to Elastic's SIEM from Splunk, you can use our [SIEM migration tool](../security/get-started/siem-migration.md).
17+
If you're migrating to Elastic's SIEM from Splunk, you can use [Automatic Migration](../security/get-started/automatic-migration.md).
1818
::::
1919

2020
* [Secure my hosts with endpoint security](https://www.elastic.co/getting-started/security/secure-my-hosts-with-endpoint-security)

solutions/security/get-started/siem-migration.md renamed to solutions/security/get-started/automatic-migration.md

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44
This feature is in technical preview. It may change in the future, and you should exercise caution when using it in production environments. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of GA features.
55
::::
66

7-
Automatic Migration for detection rules helps you quickly convert SIEM rules from the Splunk Processing Language (SPL) to the Elasticsearch Query Language ({{esql}}). It simplifies onboarding by matching your rules to Elastic-authored rules, if comparable rules exist. Otherwise, it automatically translates rules on the fly so you can verify and edit them instead of rewriting them from scratch.
7+
Automatic Migration for detection rules helps you quickly convert SIEM rules from the Splunk Processing Language (SPL) to the Elasticsearch Query Language ({{esql}}). If comparable Elastic-authored rules exist, it simplifies onboarding by mapping your rules to them. Otherwise, it creates custom rules on the fly so you can verify and edit them instead of writing them from scratch.
88

9-
You can ingest your data before migrating your rules, or migrate your rules first, in which case the tool will recommend which data sources you need to power your migrated rules.
9+
You can ingest your data before migrating your rules, or migrate your rules first in which case the tool will recommend which data sources you need to power your migrated rules.
1010

1111
::::{admonition} Requirements
1212
* The `SIEM migrations: All` Security sub-feature privilege.
@@ -123,6 +123,9 @@ If you haven't yet ingested your data, you will likely encounter `Unknown index`
123123

124124
The rule details flyout which appears when you click on a rule's name in the **Translate rules** table has two other tabs, **Overview** and **Summary**. The **Overview** tab displays information such as the rule's severity, risk score, rule type, and how frequently it runs. The **Summary** tab explains the logic behind how the rule was translated, such as why specific {{esql}} commands were used, or why a source rule was mapped to a particular Elastic authored rule.
125125

126+
::::{important}
127+
All the details about your migrations is stored in the `.kibana-siem-rule-migrations-rules-default` index. You can use [Discover](/explore-analyze/discover.md) to review a variety of metrics, analyze metrics, and more.
128+
::::
126129

127130
# FAQ (Frequently asked questions)
128131

@@ -141,3 +144,7 @@ Yes, Automatic Migration can handle nested macros.
141144
**How can we ensure rules stay up to date?**
142145

143146
Automatic Migration maps your rules to Elastic-authored rules whenever possible, which are updated automatically. Like all custom rules, rules created by Automatic Migration must be maintained by you.
147+
148+
**What index does information about each migration appear in?**
149+
150+
No matter how many times you use Automatic Migration, migration data will continue to appear in `.kibana-siem-rule-migrations-rules-default`.

solutions/toc.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -456,7 +456,7 @@ toc:
456456
- file: security/get-started/ingest-data-to-elastic-security.md
457457
children:
458458
- file: security/get-started/enable-threat-intelligence-integrations.md
459-
- file: security/get-started/siem-migration.md
459+
- file: security/get-started/automatic-migration.md
460460
- file: security/get-started/automatic-import.md
461461
- file: security/get-started/agentless-integrations.md
462462
- file: security/get-started/spaces-elastic-security.md

0 commit comments

Comments
 (0)