You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
% What needs to be done: Align serverless/stateful
9
+
% Need to revisit these paras
10
+
% {{elastic-sec}} is an inbuilt part of {{kib}}. To use {{elastic-sec}}, you only need an {{stack}} deployment (an {{es}} cluster and {{kib}}).
10
11
11
-
% Use migrated content from existing pages that map to this page:
12
+
% {{ecloud}} offers all of the features of {{es}}, {{kib}}, and {{elastic-sec}} as a hosted service available on AWS, GCP, and Azure. To get started, sign up for a [free {{ecloud}} trial](https://cloud.elastic.co/registration?page=docs&placement=docs-body).
% For information about installing and managing the {{stack}} yourself, see [Installing the {{stack}}](/get-started/the-stack.md).
15
15
16
-
{{elastic-sec}} is an inbuilt part of {{kib}}. To use {{elastic-sec}}, you only need an {{stack}} deployment (an {{es}} cluster and {{kib}}).
17
-
18
-
{{ecloud}} offers all of the features of {{es}}, {{kib}}, and {{elastic-sec}} as a hosted service available on AWS, GCP, and Azure. To get started, sign up for a [free {{ecloud}} trial](https://cloud.elastic.co/registration?page=docs&placement=docs-body).
19
-
20
-
For information about installing and managing the {{stack}} yourself, see [Installing the {{stack}}](/get-started/the-stack.md).
21
-
22
-
The [Support Matrix](https://www.elastic.co/support/matrix) page lists officially supported operating systems, platforms, and browsers on which {{es}}, {{kib}}, {{beats}}, and Elastic Endpoint have been tested.
16
+
The [Support Matrix](https://www.elastic.co/support/matrix) page lists officially supported operating systems, platforms, and browsers on which components such as {{beats}}, {{agent}}, {{elastic-defend}}, and {{elastic-endpoint}} have been tested.
23
17
24
18
25
19
## Node role requirements [node-role-requirements]
26
20
27
-
To use Elastic Security, at least one node in your Elasticsearch cluster must have the [`transform` role](asciidocalypse://docs/elasticsearch/docs/reference/elasticsearch/configuration-reference/transforms-settings.md). Nodes are automatically given this role when they’re created, so changes are not required if default role settings remain the same. This applies to on-premise and cloud deployments.
21
+
```yaml {applies_to}
22
+
stack:
23
+
```
24
+
25
+
To use {{elastic-sec}}, at least one node in your Elasticsearch cluster must have the [`transform` role](asciidocalypse://docs/elasticsearch/docs/reference/elasticsearch/configuration-reference/transforms-settings.md). Nodes are automatically given this role when they’re created, so changes are not required if default role settings remain the same. This applies to on-premise and cloud deployments.
28
26
29
27
Changes might be required if your nodes have customized roles. When updating node roles, nodes are only assigned the roles you specify, and default roles are removed. If you need to reassign the `transform` role to a node, [create a dedicated transform node](asciidocalypse://docs/elasticsearch/docs/reference/elasticsearch/configuration-reference/node-settings.md#transform-node).
30
28
31
29
32
30
## Space and index privileges [_space_and_index_privileges]
33
31
32
+
34
33
To use {{elastic-sec}}, your role must have at least:
35
34
36
35
* `Read` privilege for the `Security` feature in the [space](/deploy-manage/manage-spaces.md). This grants you `Read` access to all features in {{elastic-sec}} except cases. You need additional [minimum privileges](/solutions/security/investigate/cases-requirements.md) to use cases.
37
36
* `Read` and `view_index_metadata` privileges for all {{elastic-sec}} indices, such as `filebeat-*`, `packetbeat-*`, `logs-*`, and `endgame-*` indices.
38
37
39
38
::::{note}
40
-
[*Configure advanced settings*](/solutions/security/get-started/configure-advanced-settings.md) describes how to modify {{elastic-sec}} indices.
39
+
[Configure advanced settings](/solutions/security/get-started/configure-advanced-settings.md) describes how to modify {{elastic-sec}} indices.
41
40
::::
42
41
43
42
44
43
For more information about index privileges, refer to [{{es}} security privileges](/deploy-manage/users-roles/cluster-or-deployment-auth/elasticsearch-privileges.md).
All features are available as part of the free Basic plan **except**:
62
65
@@ -67,22 +70,26 @@ All features are available as part of the free Basic plan **except**:
67
70
[Elastic Stack subscriptions](https://www.elastic.co/subscriptions) lists the required subscription plans for all features.
68
71
69
72
70
-
## Advanced configuration and UI options [_advanced_configuration_and_ui_options]
73
+
## Advanced configuration and UI options [security-requirements-overview-advanced-configuration-and-ui-options]
71
74
72
-
[*Configure advanced settings*](/solutions/security/get-started/configure-advanced-settings.md) describes how to modify advanced settings, such as the {{elastic-sec}} indices, default time intervals used in filters, and IP reputation links.
75
+
[Configure advanced settings](/solutions/security/get-started/configure-advanced-settings.md) describes how to modify advanced settings, such as the {{elastic-sec}} indices, default time intervals used in filters, and IP reputation links.
73
76
74
77
75
-
## Third-party collectors mapped to ECS [_third_party_collectors_mapped_to_ecs]
78
+
## Third-party collectors mapped to ECS [security-requirements-overview-third-party-collectors-mapped-to-ecs]
76
79
77
80
The [Elastic Common Schema (ECS)](https://www.elastic.co/guide/en/ecs/current) defines a common set of fields to be used for storing event data in Elasticsearch. ECS helps users normalize their event data to better analyze, visualize, and correlate the data represented in their events. {{elastic-sec}} can ingest and normalize events from any ECS-compliant data source.
78
81
79
82
::::{important}
80
-
{{elastic-sec}} requires [ECS-compliant data](https://www.elastic.co/guide/en/ecs/current). If you use third-party data collectors to ship data to {{es}}, the data must be mapped to ECS. [*Elastic Security ECS field reference*](asciidocalypse://docs/docs-content/docs/reference/security/fields-and-object-schemas/siem-field-reference.md) lists ECS fields used in {{elastic-sec}}.
83
+
{{elastic-sec}} requires [ECS-compliant data](https://www.elastic.co/guide/en/ecs/current). If you use third-party data collectors to ship data to {{es}}, the data must be mapped to ECS. [{{elastic-sec}} ECS field reference](asciidocalypse://docs/docs-content/docs/reference/security/fields-and-object-schemas/siem-field-reference.md) lists ECS fields used in {{elastic-sec}}.
0 commit comments