Skip to content

Commit 0443794

Browse files
mergify[bot]joepeeplesgithub-actions[bot]
authored
[8.15] Permissions for alert suppression in machine learning rules (backport #5819) (#5934)
* Permissions for alert suppression in machine learning rules (#5819) * Update ESS docs: ML rule req for alert suppression * Update serverless docs, and align with ESS (cherry picked from commit 632deff) # Conflicts: # docs/serverless/advanced-entity-analytics/ml-requirements.mdx # docs/serverless/alerts/alert-suppression.mdx * Delete docs/serverless directory and its contents --------- Co-authored-by: Joe Peeples <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent fbfd5e3 commit 0443794

File tree

2 files changed

+8
-2
lines changed

2 files changed

+8
-2
lines changed

docs/advanced-entity-analytics/ml-req.asciidoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ To run and create {ml} jobs and rules, you need all of these:
77
* There must be at least one {ml} node in your cluster
88
* The `machine_learning_admin` user role
99

10+
Additionally, to configure <<alert-suppression,alert suppression>> for {ml} rules, your role needs the following {kibana-ref}/kibana-role-management.html#adding_index_privileges[index privilege]:
11+
12+
* `read` permission for the `.ml-anomalies-*` index
13+
1014
For more information, go to {ml-docs}/setup.html[Set up {ml-features}].
1115

1216
[IMPORTANT]

docs/detections/alert-suppression.asciidoc

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,9 @@
44
.Requirements and notices
55
[sidebar]
66
--
7-
Alert suppression requires a https://www.elastic.co/pricing[Platinum or higher subscription].
7+
* Alert suppression requires a https://www.elastic.co/pricing[Platinum or higher subscription].
8+
9+
* {ml-cap} rules have <<ml-requirements,additional requirements>> for alert suppression.
810

911
preview::["Alert suppression is in technical preview for threshold, indicator match, event correlation, and new terms rules. The functionality may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features."]
1012
--
@@ -17,7 +19,7 @@ Alert suppression allows you to reduce the number of repeated or duplicate detec
1719
* <<create-eql-rule,Event correlation>> (non-sequence queries only)
1820
* <<create-new-terms-rule,New terms>>
1921
* <<create-esql-rule,{esql}>>
20-
* <<create-ml-rule,{ml-app}>>
22+
* <<create-ml-rule,{ml-cap}>>
2123

2224
Normally, when a rule meets its criteria repeatedly, it creates multiple alerts, one for each time the rule's criteria are met. When alert suppression is configured, duplicate qualifying events are grouped, and only one alert is created for each group. Depending on the rule type, you can configure alert suppression to create alerts each time the rule runs, or once within a specified time window. You can also specify multiple fields to group events by unique combinations of values.
2325

0 commit comments

Comments
 (0)