Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion solutions/security/explore/configure-network-map-data.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ To see source and destination connections lines on the map, you must configure `

## Permissions required [prereq-perms]

To view the map in {{stack}} 9.0.0+, you need a role with at least `Read` [privileges](/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles.md#adding_kibana_privileges) for the `Maps` feature. In serverless, you need the appropriate [predefined user role](/deploy-manage/users-roles/cloud-organization/user-roles.md#general-assign-user-roles) or a [custom role](/deploy-manage/users-roles/cloud-organization/user-roles.md) with at least `Read` privileges for the `Maps` feature.
To view the map in {{stack}}, you need a role with at least `Read` [privileges](/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles.md#adding_kibana_privileges) for the `Maps` feature. In serverless, you need the appropriate [predefined user role](/deploy-manage/users-roles/cloud-organization/user-roles.md#general-assign-user-roles) or a [custom role](/deploy-manage/users-roles/cloud-organization/user-roles.md) with at least `Read` privileges for the `Maps` feature.


## Create {{kib}} data views [kibana-index-pattern]
Expand Down
2 changes: 1 addition & 1 deletion solutions/security/explore/hosts-page.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ Beneath the KPI charts are data tables, categorized by individual tabs, which ar
* **All hosts**: High-level host details.
* **Uncommon processes**: Uncommon processes running on hosts.
* **Anomalies**: Anomalies discovered by machine learning jobs.
* **Host risk**: The latest recorded host risk score for each host, and its host risk classification. In {{stack}} 9.0.0+, this feature requires a [Platinum subscription](https://www.elastic.co/pricing) or higher. In serverless, this feature requires the Security Analytics Complete [project feature](/deploy-manage/deploy/elastic-cloud/project-settings.md). Click **Enable** on the **Host risk** tab to get started. To learn more, refer to our [entity risk scoring documentation](/solutions/security/advanced-entity-analytics/entity-risk-scoring.md).
* **Host risk**: The latest recorded host risk score for each host, and its host risk classification. In {{stack}}, this feature requires a [Platinum subscription](https://www.elastic.co/pricing) or higher. In serverless, this feature requires the Security Analytics Complete [project feature](/deploy-manage/deploy/elastic-cloud/project-settings.md). Click **Enable** on the **Host risk** tab to get started. To learn more, refer to our [entity risk scoring documentation](/solutions/security/advanced-entity-analytics/entity-risk-scoring.md).
* **Sessions**: Linux process events that you can open in [Session View](/solutions/security/investigate/session-view.md), an investigation tool that allows you to examine Linux process data at a hierarchal level.

The tables within the **Events** and **Sessions** tabs include inline actions and several customization options. To learn more about what you can do with the data in these tables, refer to [*Manage detection alerts*](/solutions/security/detect-and-alert/manage-detection-alerts.md).
Expand Down
2 changes: 1 addition & 1 deletion solutions/security/explore/network-page.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ The Network page provides key network activity metrics in an interactive map, an
The map provides an interactive visual overview of your network traffic. Hover over source and destination points to show more information, such as host names and IP addresses.

::::{note}
To access the interactive map in {{stack}} 9.0.0+, you need either `Read` or `All` privileges for `Maps` (**Kibana Privileges** → **Analytics** → **Maps**). In serverless, you must have the appropriate user role. To learn more about map setup, refer to [Configure network map data](/solutions/security/explore/configure-network-map-data.md).
To access the interactive map in {{stack}}, you need either `Read` or `All` privileges for `Maps` (**Kibana Privileges** → **Analytics** → **Maps**). In serverless, you must have the appropriate user role. To learn more about map setup, refer to [Configure network map data](/solutions/security/explore/configure-network-map-data.md).
::::


Expand Down
2 changes: 1 addition & 1 deletion solutions/security/explore/users-page.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ Beneath the KPI charts are data tables, which are useful for viewing and investi
* **All users**: A chronological list of unique user names, when they were last active, and the associated domains.
* **Authentications**: A chronological list of user authentication events and associated details, such as the number of successes and failures, and the host name of the last successful destination.
* **Anomalies**: Unusual activity discovered by machine learning jobs that contain user data.
* **User risk**: The latest recorded user risk score for each user, and its user risk classification. In {{stack}} 9.0.0+, this feature requires a [Platinum subscription](https://www.elastic.co/pricing) or higher. In serverless, this feature requires the Security Analytics Complete [project feature](/deploy-manage/deploy/elastic-cloud/project-settings.md). Click **Enable** on the **User risk** tab to get started. To learn more, refer to our [entity risk scoring documentation](/solutions/security/advanced-entity-analytics/entity-risk-scoring.md).
* **User risk**: The latest recorded user risk score for each user, and its user risk classification. In {{stack}}, this feature requires a [Platinum subscription](https://www.elastic.co/pricing) or higher. In serverless, this feature requires the Security Analytics Complete [project feature](/deploy-manage/deploy/elastic-cloud/project-settings.md). Click **Enable** on the **User risk** tab to get started. To learn more, refer to our [entity risk scoring documentation](/solutions/security/advanced-entity-analytics/entity-risk-scoring.md).

The Events table includes inline actions and several customization options. To learn more about what you can do with the data in these tables, refer to [*Manage detection alerts*](/solutions/security/detect-and-alert/manage-detection-alerts.md).

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ mapped_urls:
The Indicators page collects data from enabled threat intelligence feeds and provides a centralized view of indicators, also known as indicators of compromise (IoCs). This topic helps you set up the Indicators page and explains how to work with IoCs.

::::{admonition} Requirements
* In {{stack}} 9.0.0+, the Indicators page is an [Enterprise subscription](https://www.elastic.co/pricing) feature.
* In {{stack}}, the Indicators page is an [Enterprise subscription](https://www.elastic.co/pricing) feature.
* In serverless, the Indicators page requires the Security Analytics Complete [project feature](/deploy-manage/deploy/elastic-cloud/project-settings.md)
* You must have *one* of the following installed on the hosts you want to monitor:

Expand Down
2 changes: 1 addition & 1 deletion troubleshoot/observability/troubleshoot-logs.md
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ You need to either:
* Get an API key from an administrator and manually add the API to the {{agent}} configuration. See [Configure the {{agent}}](../../raw-migrated-files/docs-content/serverless/observability-stream-log-files.md#observability-stream-log-files-step-3-configure-the-agent) for more on manually updating the configuration and adding the API key.
::::

::::{tab-item} {{stack}} 9.0.0+
::::{tab-item} {{stack}}
If you don’t have the required privileges to create an API key, you’ll see the following error message:

```plaintext
Expand Down
4 changes: 2 additions & 2 deletions troubleshoot/observability/troubleshooting-synthetics.md
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ When creating a {{private-location}}, you have to:
3. [Add a {{private-location}}](/solutions/observability/apps/monitor-resources-on-private-networks.md#synthetics-private-location-add) in the Synthetics UI.
:::

:::{tab-item} {{stack}} 9.0.0+
:::{tab-item} {{stack}}
1. [Set up {{fleet-server}} and {{agent}}](/solutions/observability/apps/monitor-resources-on-private-networks.md#synthetics-private-location-fleet-agent).
2. [Connect {{fleet}} to the {{stack}}](/solutions/observability/apps/monitor-resources-on-private-networks.md#synthetics-private-location-connect) and enroll an {{agent}} in {{fleet}}.
3. [Add a {{private-location}}](/solutions/observability/apps/monitor-resources-on-private-networks.md#synthetics-private-location-add) in the {{synthetics-app}}.
Expand Down Expand Up @@ -119,7 +119,7 @@ There are a few ways to fix this:

:::

:::{tab-item} {{stack}} 9.0.0+
:::{tab-item} {{stack}}
* If you have [write access](/solutions/observability/apps/writer-role.md) including the privileges for [creating new Private Locations](/solutions/observability/apps/writer-role.md#synthetics-role-write-private-locations), you can [create a new Private Location](/solutions/observability/apps/monitor-resources-on-private-networks.md#monitor-via-private-agent). Then try creating the monitor again.
* If you do *not* have the right privileges to create a Private Location, you can ask someone with the [necessary privileges](/solutions/observability/apps/writer-role.md#synthetics-role-write-private-locations) to create a Private Location or ask an administrator with a [setup role](/solutions/observability/apps/setup-role.md) to give you the necessary privileges and [create a new Private Location](/solutions/observability/apps/monitor-resources-on-private-networks.md#monitor-via-private-agent). Then try creating the monitor again.
* If you want to create a monitor to run on Elastic’s global managed infrastructure, ask an administrator with a [setup role](/solutions/observability/apps/setup-role.md) to update [`Synthetics and Uptime` sub-feature privileges](/solutions/observability/apps/writer-role.md#disable-managed-locations) for the role you’re currently assigned. Then try creating the monitor again.
Expand Down