You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: solutions/security/get-started/automatic-migration.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,14 +20,14 @@ You can ingest your data before migrating your rules, or migrate your rules firs
20
20
* {{stack}} users: an [Enterprise](https://www.elastic.co/pricing) subscription.
21
21
* {{Stack}} users: {{ml}} must be enabled.
22
22
* {{serverless-short}} users: a [Security Complete](../../../deploy-manage/deploy/elastic-cloud/project-settings.md) subscription.
23
-
* {{ecloud}} users: {{ml}} must be enabled. We recommend a minimum size of 4GB of RAM per {ml} zone.
23
+
* {{ecloud}} users: {{ml}} must be enabled. We recommend a minimum size of 4GB of RAM per {{ml}} zone.
24
24
25
25
::::
26
26
27
27
## Get started with Automatic Migration
28
28
29
29
1. Find **Get started** in the navigation menu or use the [global search bar](/explore-analyze/find-and-organize/find-apps-and-objects.md).
30
-
2. Under **Configure AI provider** you can use Elastic LLM, select another configured model, or [add a new one](/solutions/security/ai/set-up-connectors-for-large-language-models-llm.md). For information on how different models perform, refer to the [LLM performance matrix](../../../solutions/security/ai/large-language-model-performance-matrix.md).
30
+
2. Under **Configure AI provider**, you can use Elastic LLM, select another configured model, or [add a new one](/solutions/security/ai/set-up-connectors-for-large-language-models-llm.md). For information on how different models perform, refer to the [LLM performance matrix](../../../solutions/security/ai/large-language-model-performance-matrix.md).
31
31
3. Next, under **Migrate rules & add data**, click **Translate your existing SIEM rules to Elastic**, then **Upload rules**.
32
32
4. Follow the instructions on the **Upload Splunk SIEM rules** flyout to export your rules from Splunk as JSON.
33
33
@@ -78,7 +78,7 @@ When you upload a new batch of rules, they are assigned a name and number, for e
78
78
79
79
The table's fields are as follows:
80
80
81
-
***Name:** The names of Elasticauthored rules cannot be edited until after rule installation. To edit the name of a custom translated rule, click the name and select **Edit**.
81
+
***Name:** The names of Elastic-authored rules cannot be edited until after rule installation. To edit the name of a custom translated rule, click the name and select **Edit**.
82
82
***Status:** The rule's translation status:
83
83
*`Installed`: Already added to Elastic SIEM. Click **View** to manage and enable it.
84
84
*`Translated`: Ready to install. This rule was mapped to an Elastic-authored rule, or translated by Automatic Import. Click **Install** to install it.
@@ -108,7 +108,7 @@ The table's fields are as follows:
108
108
Once you're on the **Translated rules** page, to install any rules that were partially translated or not translated, you will need to edit them. Optionally, you can also edit custom rules that were successfully translated to finetune them.
109
109
110
110
:::{note}
111
-
You cannot edit Elastic authored rules using this interface, but after they are installed you can edit them from the [**Rules**](/solutions/security/detect-and-alert/about-detection-rules.md) page.
111
+
You cannot edit Elastic authored rules using this interface, but after they are installed you can [edit them](/solutions/security/detect-and-alert/manage-detection-rules.md) from the **Rules** page.
112
112
:::
113
113
114
114
### Edit a custom rule
@@ -127,21 +127,21 @@ If you haven't yet ingested your data, you will likely encounter `Unknown index`
127
127
128
128
### View rule details
129
129
130
-
The rule details flyout which appears when you click on a rule's name in the **Translate rules** table has two other tabs, **Overview** and **Summary**. The **Overview** tab displays information such as the rule's severity, risk score, rule type, and how frequently it runs. The **Summary** tab explains the logic behind how the rule was translated, such as why specific {{esql}} commands were used, or why a source rule was mapped to a particular Elastic authored rule.
130
+
The rule details flyout (which appears when you click on a rule's name in the **Translate rules** table) has two other tabs, **Overview** and **Summary**. The **Overview** tab displays information such as the rule's severity, risk score, rule type, and how frequently it runs. The **Summary** tab explains the logic behind how the rule was translated, such as why specific {{esql}} commands were used, or why a source rule was mapped to a particular Elastic authored rule.
131
131
132
132
::::{important}
133
133
All the details about your migrations is stored in the `.kibana-siem-rule-migrations-rules-default` index. You can use [Discover](/explore-analyze/discover.md) to review a variety of metrics, analyze metrics, and more.
134
134
::::
135
135
136
-
#FAQ (Frequently asked questions)
136
+
## Frequently asked questions (FAQ)
137
137
138
-
**How does Automatic Migration handle rules that can't be exactly translated, such as due to feature parity issues?**
138
+
**How does Automatic Migration handle rules that can't be exactly translated for various reasons, such as feature parity issues?**
139
139
140
140
After translation, rules that can't be translated appear with a status of either partially translated (yellow) or not translated (red). From there, you can address them individually.
141
141
142
142
**How does Automatic Migration handle Splunk rules which lookup other indices?**
143
143
144
-
Rules that fall into this category will typically appear with a status of partially translated. Lookup JOINs are currently a tech preview {{esql}} which can help in this situation.
144
+
Rules that fall into this category will typically appear with a status of partially translated. `LOOKUP JOIN`s are currently a tech preview {{esql}} which can help in this situation.
0 commit comments