[Security][9.x] Add 'search.allow_expensive_queries' to detections-requirements.md #3543
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
🔍 Preview links for changed docs |
|
Ready to review. Thanks! 😁 🙏 |
7 tasks
sdesalas
changed the title
banderror
reviewed
Oct 20, 2025
There was a problem hiding this comment.
Thanks @sdesalas for the important observation and opening this documentation improvement! I left a small suggestion.
Let's defer to @nastasha-solomon for a final review and approval.
sdesalas
force-pushed
the
main
branch
3 times, most recently
from
1316de5 to
7104b04
Compare
Co-authored-by: Georgii Gorbachev <[email protected]>
Co-authored-by: Nastasha Solomon <[email protected]>
Co-authored-by: Nastasha Solomon <[email protected]>
nastasha-solomon
approved these changes
Oct 21, 2025
Co-authored-by: Nastasha Solomon <[email protected]>
Co-authored-by: Nastasha Solomon <[email protected]>
nastasha-solomon
changed the title
Co-authored-by: Nastasha Solomon <[email protected]>
sdesalas
force-pushed
the
main
branch
2 times, most recently
from
809c4f9 to
f880825
Compare
sdesalas
force-pushed
the
main
branch
3 times, most recently
from
32cd1be to
24eac20
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
De-facto requirement of Security Detections, (and much of Kibana) that has not been documented properly.
Errors go as far back as
v8.18(but likely much further), and not only affect Security app, but also manyServer Managementfeatures such as Fleet, Saved Objects, Tags, etc.For more info: elastic/kibana#237496 -> Section
Risks that were found acceptableWe're documenting it under the correct location to make sure that users know about it. There is an internal slack thread for discussion.
Note also that this is documented as a requirement of the 'alerting' plugin that we're using under the hood.