Skip to content

Commit e4ac982

Browse files
authored
Merge branch 'main' into add-elastic-new-intro-section
2 parents 44c03ec + dcaf6a5 commit e4ac982

File tree

9 files changed

+276
-23
lines changed

9 files changed

+276
-23
lines changed

manage-data/data-store/data-streams.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ products:
1313

1414
# Data streams [data-streams]
1515

16-
A data stream lets you store append-only time series data across multiple indices while giving you a single named resource for requests. Data streams are well-suited for logs, events, metrics, and other continuously generated data.
16+
A data stream acts as a layer of abstraction over a set of indices that are optimized for storing append-only time series data. It stores data across multiple backing indices while giving you a single named resource to use for requests. Data streams are well-suited for logs, events, metrics, and other continuously generated data.
1717

1818
You can submit indexing and search requests directly to a data stream. The stream automatically routes the request to backing indices that store the stream’s data. You can use [{{ilm}} ({{ilm-init}})](../lifecycle/index-lifecycle-management.md) to automate the management of these backing indices. For example, you can use {{ilm-init}} to automatically move older backing indices to less expensive hardware and delete unneeded indices. {{ilm-init}} can help you reduce costs and overhead as your data grows.
1919

@@ -39,7 +39,7 @@ A data stream consists of one or more [hidden](elasticsearch://reference/elastic
3939
:alt: data streams diagram
4040
:::
4141

42-
A data stream requires a matching [index template](templates.md). The template contains the mappings and settings used to configure the stream’s backing indices.
42+
A data stream requires a matching [index template](templates.md). The template contains the mappings and settings used to configure the stream’s backing indices and defines the {{ilm-init}} policy that the data stream uses.
4343

4444
Every document indexed to a data stream must contain a `@timestamp` field, mapped as a [`date`](elasticsearch://reference/elasticsearch/mapping-reference/date.md) or [`date_nanos`](elasticsearch://reference/elasticsearch/mapping-reference/date_nanos.md) field type. If the index template doesn’t specify a mapping for the `@timestamp` field, {{es}} maps `@timestamp` as a `date` field with default options.
4545

manage-data/lifecycle/data-stream.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ products:
1010

1111
# Data stream lifecycle [data-stream-lifecycle]
1212

13-
A data stream lifecycle is the built-in mechanism data streams use to manage their lifecycle. It enables you to easily automate the management of your data streams according to your retention requirements. For example, you could configure the lifecycle to:
13+
A data stream lifecycle is the built-in mechanism [data streams](/manage-data/data-store/data-streams.md) use to manage their lifecycle. It enables you to easily automate the management of your data streams according to your retention requirements. For example, you could configure the lifecycle to:
1414

1515
* Ensure that data indexed in the data stream will be kept at least for the retention time you defined.
1616
* Ensure that data older than the retention period will be deleted automatically by {{es}} at a later time.
@@ -22,6 +22,13 @@ To achieve that, it supports:
2222

2323
A data stream lifecycle also supports downsampling the data stream backing indices. See [the downsampling example](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-put-data-lifecycle) for more details.
2424

25+
## Data stream lifecycle availability
26+
27+
Note the availability of data stream lifecycle to ensure that it's applicable for your use case:
28+
29+
* Data stream lifecycle is supported only for data streams and cannot be used with individual indices.
30+
31+
* Data stream lifecycle is supported for all deployment types on the versioned {{stack}} as well as for {{es-serverless}}.
2532

2633
## How does it work? [data-streams-lifecycle-how-it-works]
2734

manage-data/lifecycle/index-lifecycle-management.md

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7,35 +7,42 @@ mapped_pages:
77
- https://www.elastic.co/guide/en/cloud/current/ec-configure-index-management.html
88
applies_to:
99
stack: ga
10+
serverless: unavailable
1011
products:
1112
- id: elasticsearch
1213
---
1314

1415
# Index lifecycle management
1516

16-
{{ilm-cap}} ({{ilm-init}}) provides an integrated and streamlined way to manage time-based data such as logs and metrics, making it easier to follow best practices for managing your indices.
17-
18-
You can configure {{ilm-init}} policies to automatically manage indices according to your performance, resiliency, and retention requirements. For example, you could use {{ilm-init}} to:
17+
{{ilm-cap}} ({{ilm-init}}) provides an integrated and streamlined way to manage your time series data. You can configure {{ilm-init}} policies to automatically manage indices according to your performance, resiliency, and retention requirements. For example, you could use {{ilm-init}} to:
1918

2019
* Spin up a new index when an index reaches a certain size or number of documents
2120
* Create a new index each day, week, or month and archive previous ones
2221
* Delete stale indices to enforce data retention standards
2322

24-
::::{tip}
25-
{{ilm-init}} is not available on {{es-serverless}}.
26-
27-
:::{dropdown} Why?
28-
In an {{ecloud}} or self-managed environment, ILM lets you automatically transition indices through data tiers according to your performance needs and retention requirements. This allows you to balance hardware costs with performance. {{es-serverless}} eliminates this complexity by optimizing your cluster performance for you.
29-
30-
Data stream lifecycle is an optimized lifecycle tool that lets you focus on the most common lifecycle management needs, without unnecessary hardware-centric concepts like data tiers.
31-
:::
32-
::::
33-
3423
::::{important}
3524
To use {{ilm-init}}, all nodes in a cluster must run the same version. Although it might be possible to create and apply policies in a mixed-version cluster, there is no guarantee they will work as intended. Attempting to use a policy that contains actions that aren’t supported on all nodes in a cluster will cause errors.
3625
::::
3726

38-
## Actions
27+
## {{ilm-init}} availability
28+
29+
Note the availability of {{ilm-init}} to ensure that it's applicable for your use case.
30+
31+
* You can use {{ilm-init}} to manage indices and data streams:
32+
33+
* **Indices:** You use {{ilm-init}} to manage a specific index or set of indices by defining a lifecycle policy and applying it to the indices or an index alias. Each index is then evaluated against its policy and transitions through phases (`hot`, `warm`, `cold`, `frozen`, `delete`) based on pre-defined conditions. This approach allows for more granular control over each index but requires considerably more effort compared to using a data stream, which is our recommended option.
34+
35+
* **Data streams:** A [data stream](/manage-data/data-store/data-streams.md) acts as a layer of abstraction over a set of indices that contain append-only, time series data. You can configure {{ilm-init}} using a data stream as a single named resource, so that rollover and any other configured actions are performed on the data stream's backing indices automatically.
36+
37+
* {{ilm-init}} is available for all deployment types on the versioned {{stack}} but is not available for {{es-serverless}}. In a {{serverless-short}} environment, [data stream lifecycle](/manage-data/lifecycle/data-stream.md) is available as a data lifecycle option.
38+
39+
:::{admonition} Simpler lifecycle management in Serverless environments
40+
{{ilm-init}} lets you automatically transition indices through data tiers according to your performance needs and retention requirements. This allows you to balance hardware costs with performance. {{ilm-init}} is not available in {{serverless-short}} because in that environment your cluster performance is optimized for you. Instead, data stream lifecycle is available as a data management option.
41+
42+
Data stream lifecycle is a simpler lifecycle management tool optimized for the most common lifecycle management needs. It enables you to configure the retention duration for your data and to optimize how the data is stored, without hardware-centric concepts like data tiers. For a detailed comparison of {{ilm-init}} and data stream lifecycle refer to [Data lifecycle](/manage-data/lifecycle.md).
43+
:::
44+
45+
## Index lifecycle actions
3946

4047
{{ilm-init}} policies can trigger actions like:
4148

166 KB
Loading
82 KB
Loading
208 KB
Loading

solutions/security/ai/ai-assistant.md

Lines changed: 243 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -112,28 +112,266 @@ Be sure to specify which language you’d like AI Assistant to use when writing
112112
AI Assistant can remember particular information you tell it to remember. For example, you could tell it: "When anwering any question about srv-win-s1-rsa or an alert that references it, mention that this host is in the New York data center". This will cause it to remember the detail you highlighted.
113113
::::
114114

115+
## Share conversations
116+
117+
```{applies_to}
118+
stack: ga 9.2
119+
serverless: ga
120+
```
121+
122+
Conversations that you start with AI Assistant are private by default and not visible to other members of your team. You have two ways to share conversations - either with selected members or more broadly to everyone with access to the space.
123+
124+
To share a conversation, do one of the following:
125+
126+
- Click the **Private** / **Shared** / **Restricted** badge next to the conversation's title. Use the dropdown menu to define the chat's visibility. If you select **Restricted**, a modal appears where you can select which users have access.
127+
::::{image} /solutions/images/ai-assistant-shared-status-badge.png
128+
:alt: AI Assistant chat with the sharing status dropdown open
129+
:screenshot:
130+
::::
131+
- Go to **AI Assistant settings -> Conversations** to view all conversations you've started. Update their visibility as desired.
132+
133+
134+
Once a conversation is shared, you can copy its URL to easily link it to your team:
135+
136+
- Open an AI Assistant chat, open the **Conversation settings** menu and select **Copy URL**.
137+
- Open the **Conversations** tab of the AI Assistant settings page, then select the one you want to share and click **Copy URL**.
138+
139+
When someone shares a chat with you, you can review it but can't continue the conversation, since it is owned by another user. However, you can duplicate a shared conversation and continue where your colleague left off. To duplicate a shared conversation:
140+
141+
- Open an AI Assistant chat, open the **Conversation settings** menu and select **Duplicate**.
142+
- Open the **Conversations** tab of the AI Assistant settings page, then select the one you want to duplicate and click **Duplicate**.
143+
144+
There are several [audit events](kibana://reference/kibana-audit-events.md) related to conversation sharing. Click each title to show an example:
145+
146+
:::{dropdown} 1. security_assistant_conversation_shared
147+
```
148+
{
149+
"event": {
150+
"action": "security_assistant_conversation_shared",
151+
"category": [
152+
"database"
153+
],
154+
"type": [
155+
"change"
156+
],
157+
"outcome": "success"
158+
},
159+
"user": {
160+
"id": "u_xSVO6jcSCvoEcle7e3XVVfBU4Swm1R8-x7pi5bxrSvU_0",
161+
"name": "test_daija_glover",
162+
"roles": [
163+
"superuser"
164+
]
165+
},
166+
"kibana": {
167+
"space_id": "default",
168+
"session_id": "1AZ8kfSYHzVO5ZMZ97DrNi1wjN6BFKHTw75KH8WiF7w="
169+
},
170+
"trace": {
171+
"id": "7e080b32-41b4-453b-80fe-b9c1e12a1c57"
172+
},
173+
"client": {
174+
"ip": "127.0.0.1"
175+
},
176+
"http": {
177+
"request": {
178+
"headers": {
179+
"x-forwarded-for": "127.0.0.1"
180+
}
181+
}
182+
},
183+
"service": {
184+
"node": {
185+
"roles": [
186+
"background_tasks",
187+
"ui"
188+
]
189+
}
190+
},
191+
"ecs": {
192+
"version": "9.0.0"
193+
},
194+
"@timestamp": "2025-08-26T13:16:10.422-06:00",
195+
"message": "User has shared conversation [id=b873b917-2fd0-4452-98e8-8c359f6acbfa, title=\"Getting Started with Elastic Security\"] to all users in the space",
196+
"log": {
197+
"level": "INFO",
198+
"logger": "plugins.security.audit.ecs"
199+
},
200+
"process": {
201+
"pid": 61536,
202+
"uptime": 65.705743792
203+
},
204+
"span": {
205+
"id": "8364fa9bf07311d6"
206+
}
207+
}
208+
```
209+
:::
210+
211+
:::{dropdown} 2. security_assistant_conversation_private
212+
```
213+
{
214+
"event": {
215+
"action": "security_assistant_conversation_private",
216+
"category": [
217+
"database"
218+
],
219+
"type": [
220+
"change"
221+
],
222+
"outcome": "success"
223+
},
224+
"user": {
225+
"id": "u_xSVO6jcSCvoEcle7e3XVVfBU4Swm1R8-x7pi5bxrSvU_0",
226+
"name": "test_daija_glover",
227+
"roles": [
228+
"superuser"
229+
]
230+
},
231+
"kibana": {
232+
"space_id": "default",
233+
"session_id": "1AZ8kfSYHzVO5ZMZ97DrNi1wjN6BFKHTw75KH8WiF7w="
234+
},
235+
"trace": {
236+
"id": "ae998403-8453-44ae-a9b8-ac8002c3bf28"
237+
},
238+
"client": {
239+
"ip": "127.0.0.1"
240+
},
241+
"http": {
242+
"request": {
243+
"headers": {
244+
"x-forwarded-for": "127.0.0.1"
245+
}
246+
}
247+
},
248+
"service": {
249+
"node": {
250+
"roles": [
251+
"background_tasks",
252+
"ui"
253+
]
254+
}
255+
},
256+
"ecs": {
257+
"version": "9.0.0"
258+
},
259+
"@timestamp": "2025-08-26T13:15:46.300-06:00",
260+
"message": "User has made private conversation [id=b873b917-2fd0-4452-98e8-8c359f6acbfa, title=\"Getting Started with Elastic Security\"]",
261+
"log": {
262+
"level": "INFO",
263+
"logger": "plugins.security.audit.ecs"
264+
},
265+
"process": {
266+
"pid": 61536,
267+
"uptime": 41.582780958
268+
},
269+
"span": {
270+
"id": "68a0d5f52faa17d4"
271+
}
272+
}
273+
```
274+
:::
275+
276+
:::{dropdown} 3. security_assistant_conversation_restricted
277+
```
278+
{
279+
"event": {
280+
"action": "security_assistant_conversation_restricted",
281+
"category": [
282+
"database"
283+
],
284+
"type": [
285+
"change"
286+
],
287+
"outcome": "success"
288+
},
289+
"user": {
290+
"id": "u_xSVO6jcSCvoEcle7e3XVVfBU4Swm1R8-x7pi5bxrSvU_0",
291+
"name": "test_daija_glover",
292+
"roles": [
293+
"superuser"
294+
]
295+
},
296+
"kibana": {
297+
"space_id": "default",
298+
"session_id": "1AZ8kfSYHzVO5ZMZ97DrNi1wjN6BFKHTw75KH8WiF7w="
299+
},
300+
"trace": {
301+
"id": "b59f9790-87ff-45f0-b28e-1d9ffa6cfb09"
302+
},
303+
"client": {
304+
"ip": "127.0.0.1"
305+
},
306+
"http": {
307+
"request": {
308+
"headers": {
309+
"x-forwarded-for": "127.0.0.1"
310+
}
311+
}
312+
},
313+
"service": {
314+
"node": {
315+
"roles": [
316+
"background_tasks",
317+
"ui"
318+
]
319+
}
320+
},
321+
"ecs": {
322+
"version": "9.0.0"
323+
},
324+
"@timestamp": "2025-08-26T14:40:59.897-06:00",
325+
"message": "User has restricted conversation [id=b873b917-2fd0-4452-98e8-8c359f6acbfa, title=\"Getting Started with Elastic Security\"] to user ([id=u_LdnmWaOWbWS1ObwqRW2MLWMkWtxCSyiElishzEpew0g_0, name=test_dina_bahringer])",
326+
"log": {
327+
"level": "INFO",
328+
"logger": "plugins.security.audit.ecs"
329+
},
330+
"process": {
331+
"pid": 77921,
332+
"uptime": 29.727069625
333+
},
334+
"span": {
335+
"id": "80e57252aceea924"
336+
}
337+
}
338+
```
339+
:::
340+
115341
## Configure AI Assistant [configure-ai-assistant]
116342

117-
To adjust AI Assistant's settings from the chat window, click the **More** (three dots) button in the upper-right.
343+
To adjust general AI Assistant settings from the chat window, click the **Assistant settings menu** button in the upper-right.
118344

119-
::::{image} /solutions/images/security-attack-discovery-more-popover.png
120-
:alt: AI Assistant's more options popover
345+
::::{image} /solutions/images/security-ai-assistant-settings-menu.png
346+
:alt: AI Assistant's settings popover
121347
:screenshot:
122348
::::
123349

124-
The first three options (**AI Assistant settings**, **Knowledge Base**, and **Anonymization**) open the corresponding tabs of the **Security AI settings** page. The **Chat options** affect display-only user settings: whether to show or hide anonymized values, and whether to include citations. When citations are enabled, AI Assistant will refer you to information sources including data you've shared with it, information you've added to the [knowledge base](/solutions/security/ai/ai-assistant-knowledge-base.md), and content from Elastic's Security Labs and [product documentation](/solutions/security/ai/ai-assistant-knowledge-base.md#elastic-docs).
350+
The first three options (**AI Assistant settings**, **Knowledge Base**, and **Anonymization**) open the corresponding tabs of the **Security AI settings** page. The **Alerts to analyze** button allows you to adjust how many alerts to include as context for your conversation.
125351

126352
The **Security AI settings** page provides a range of configuration options for AI Assistant. To access it directly, use the global search field to search for "AI Assistant for Security".
127353

128354
It has the following tabs:
129355

130-
* **Conversations:** When you open AI Assistant from certain pages, such as **Alerts**, it defaults to the relevant conversation type. For each conversation type, choose the default System Prompt, the default connector, and the default model (if applicable). The **Streaming** setting controls whether AI Assistant’s responses appear word-by-word (streamed), or as a complete block of text. Streaming is currently only available for OpenAI models.
356+
* **Conversations:** The **Streaming** setting controls whether AI Assistant’s responses appear word-by-word (streamed), or as a complete block of text. After the streaming setting is a list of all saved conversations. From here you can change their visibility, system prompt, and connector.
131357
* **Connectors:** Manage all LLM connectors.
132358
* **System Prompts:** Edit existing System Prompts or create new ones. To create a new System Prompt, type a unique name in the **Name** field, then press **enter**. Under **Prompt**, enter or update the System Prompt’s text. Under **Contexts**, select where the System Prompt should appear.
133359
* **Quick Prompts:** Modify existing Quick Prompts or create new ones. To create a new Quick Prompt, type a unique name in the **Name** field, then press **enter**. Under **Prompt**, enter or update the Quick Prompt’s text.
134360
* **Anonymization:** Select fields to include as plaintext, to obfuscate, and to not send when you provide events to AI Assistant as context. [Learn more](/solutions/security/ai/ai-assistant.md#ai-assistant-anonymization).
135361
* **Knowledge base:** Provide additional context to AI Assistant. [Learn more](/solutions/security/ai/ai-assistant-knowledge-base.md).
136362

363+
364+
To adjust the settings for a specific chat, click the **Conversation settings** button in the upper-right of its chat window.
365+
366+
::::{image} /solutions/images/security-ai-assistant-chat-options-menu.png
367+
:alt: AI Assistant's chat options menu
368+
:screenshot:
369+
::::
370+
371+
The **Copy URL** and **Duplicate** options allow you to share conversations (by sending their URL) and to continue conversations that were shared with you (by duplicating them). The **Delete** option appears for the conversation owner only and allows you to remove a saved conversation.
372+
373+
Settings in the **Chat options** section affect display-only user settings: whether to show or hide anonymized values, and whether to include citations. When citations are enabled, AI Assistant will refer you to information sources including data you've shared with it, information you've added to the [knowledge base](/solutions/security/ai/ai-assistant-knowledge-base.md), and content from Elastic's Security Labs and [product documentation](/solutions/security/ai/ai-assistant-knowledge-base.md#elastic-docs).
374+
137375
### Anonymization [ai-assistant-anonymization]
138376

139377
::::{admonition} Requirements

solutions/security/detect-and-alert/mitre-attandckr-coverage.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ Refer to the following table to find the MITRE ATT&CK® version that's mapped to
3737
| MITRE ATT\&CK® version | {{elastic-sec}} version |
3838
| :---- | :---- |
3939
| [v16.1](https://attack.mitre.org/resources/updates/updates-october-2024/) | • 9.0.0-9.0.6 <br> • 9.1.0-9.1.3|
40-
| [v17.1](https://attack.mitre.org/resources/updates/updates-april-2025/) | • {applies_to}`stack: ga 9.2.0` <br> • {{serverless-short}} |
40+
| [v17.1](https://attack.mitre.org/resources/updates/updates-april-2025/) |9.0.7 <br> • 9.1.4 <br> • {applies_to}`stack: ga 9.2.0` <br> • {{serverless-short}} |
4141

4242

4343
## Filter rules [security-rules-coverage-filter-rules]

troubleshoot/elasticsearch.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ If you're using {{ech}}, you can use AutoOps to monitor your cluster. AutoOps si
3030
* [](/troubleshoot/elasticsearch/increase-shard-limit.md)
3131
* [](/troubleshoot/elasticsearch/increase-cluster-shard-limit.md)
3232
* [](/troubleshoot/elasticsearch/corruption-troubleshooting.md)
33+
* [](/troubleshoot/elasticsearch/troubleshoot-ingest-pipelines.md)
3334

3435
## Management [troubleshooting-management]
3536

0 commit comments

Comments
 (0)