Skip to content

Commit 17848f1

Browse files
joepeeplesmergify[bot]
joepeeples
authored and
mergify[bot]
committed
Spaces in serverless (#5813)
* Add previously omitted spaces page, align with ESS * Fix typo in description frontmatter * Minor edit * Update "Data views in Elastic Security" Align across platforms, and omit "feature visibility" since it's unavailable in security * Update "Timeline" * Update "Timeline templates" * Update link to general docs on spaces This link will be broken until elastic/docs-content#55 is merged * Fix links: targets from stateful to serverless (cherry picked from commit 686800d) # Conflicts: # docs/serverless/explore/data-views-in-sec.mdx # docs/serverless/investigate/timeline-templates-ui.mdx # docs/serverless/investigate/timelines-ui.mdx # docs/serverless/sec-requirements.mdx # docs/serverless/serverless-security.docnav.json
1 parent 18ec15d commit 17848f1

File tree

10 files changed

+1248
-7
lines changed

10 files changed

+1248
-7
lines changed

‎docs/events/timeline-templates.asciidoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ NOTE: You cannot delete prebuilt templates.
136136
== Export and import Timeline templates
137137

138138
You can import and export Timeline templates, which enables importing templates
139-
from one {kib} space or instance to another. Exported templates are saved in an `ndjson` file.
139+
from one space or {elastic-sec} instance to another. Exported templates are saved in an `ndjson` file.
140140

141141
. Go to *Timelines* -> *Templates*.
142142
. To export templates, do one of the following:

‎docs/events/timeline-ui-overview.asciidoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ then select an action from the *Bulk actions* menu.
171171
== Export and import Timelines
172172

173173
You can export and import Timelines, which enables you to share Timelines from one
174-
{kib} space or instance to another. Exported Timelines are saved as `.ndjson` files.
174+
space or {elastic-sec} instance to another. Exported Timelines are saved as `.ndjson` files.
175175

176176
To export Timelines:
177177

‎docs/getting-started/data-views-in-sec.asciidoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ NOTE: You cannot update the data view for the Alerts page. This includes referen
3333
[[default-data-view-security]]
3434
== The default {data-source}
3535

36-
The default {data-source} is defined by the `securitySolution:defaultIndex` setting, which you can modify in {kib}'s advanced settings (**Stack Management** > **Advanced Settings** > **Security Solution**). To learn more about this setting, including its default value, refer to {security-guide}/advanced-settings.html#update-sec-indices[Advanced settings].
36+
The default {data-source} is defined by the `securitySolution:defaultIndex` setting, which you can modify in {security-guide}/advanced-settings.html#update-sec-indices[advanced settings].
3737

3838
The first time a user visits {elastic-sec} within a given {kib} {kibana-ref}/xpack-spaces.html[space], the default {data-source} generates in that space and becomes active.
3939

‎docs/getting-started/security-spaces.asciidoc‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22
= Spaces and {elastic-sec}
33

44
{elastic-sec} supports the organization of your security operations into
5-
logical instances with the {kibana-ref}/xpack-spaces.html[{kib} spaces]
5+
logical instances with the {kibana-ref}/xpack-spaces.html[spaces]
66
feature. Each space in {kib} represents a separate logical instance of
77
{elastic-sec} in which detection rules, rule exceptions, value lists,
88
alerts, Timelines, cases, and {kib} advanced settings are private to the
99
space and accessible only by users that have role privileges to
10-
access the space. For details about configuring privileges for
11-
{es} and {kib}, refer to <<detections-permissions-section>>.
10+
access the space. For details about privileges for
11+
{elastic-sec} and specific features, refer to <<sec-requirements>>.
1212

1313
For example, if you create a `SOC_prod` space in which you load and
1414
activate all the {elastic-sec} prebuilt detection rules, these rules and
@@ -22,7 +22,7 @@ the `SOC_dev` space, and they will run independently of those in the
2222
[NOTE]
2323
=====
2424
By default, alerts created by detection rules are stored in {es} indices
25-
under the `.alerts-security.alerts-<Kibana-space>` index pattern, and they may be
25+
under the `.alerts-security.alerts-<space-name>` index pattern, and they may be
2626
accessed by any user with role privileges to access those
2727
{es} indices. In our example above, any user with {es} privileges to access
2828
`.alerts-security.alerts-SOC_prod` will be able to view `SOC_prod` alerts from

‎docs/serverless/explore/data-views-in-sec.mdx‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
slug: /serverless/security/data-views-in-sec
3+
title: ((data-sources-cap)) in Elastic Security
4+
description: Use data views to control what data displays on ((elastic-sec)) pages with event or alert data.
5+
tags: [ 'serverless', 'security', 'reference', 'manage' ]
6+
status: in review
7+
---
8+
9+
<DocBadge template="technical preview" />
10+
<div id="data-views-in-sec"></div>
11+
12+
((data-sources-cap)) determine what data displays on ((elastic-sec)) pages with event or alert data.
13+
((data-sources-cap)) are defined by the index patterns they include.
14+
Only data from ((es)) [indices](((ref))/documents-indices.html), [data streams](((ref))/data-streams.html), or [index aliases](((ref))/alias.html) specified in the active ((data-source)) will appear.
15+
16+
<DocCallOut title="Important" color="warning">
17+
Custom indices are not included in the <DocLink slug="/serverless/security/data-views-in-sec" section="the-default-((data-source))">default ((data-source))</DocLink>. Modify it or create a custom ((data-source)) to include custom indices.
18+
</DocCallOut>
19+
20+
## Switch to another ((data-source))
21+
22+
You can tell which ((data-source)) is active by clicking the **((data-source-cap))** menu at the upper right of ((elastic-sec)) pages that display event or alert data, such as Overview, Alerts, Timelines, or Hosts.
23+
To switch to another ((data-source)), click **Choose ((data-source))**, select one of the options, and click **Save**.
24+
25+
![image highlighting how to open the data view selection menu](../images/data-views-in-sec/-getting-started-dataview-button-highlighted.png)
26+
27+
## Create or modify a ((data-source))
28+
29+
To learn how to modify the default **Security Default Data View**, refer to <DocLink slug="/serverless/security/advanced-settings" section="update-sec-indices" />.
30+
31+
To learn how to modify, create, or delete another ((data-source)) refer to [((data-sources-cap))](((kibana-ref))/data-views.html).
32+
33+
You can also temporarily modify the active ((data-source)) from the **((data-source-cap))** menu by clicking **Advanced options**, then adding or removing index patterns.
34+
35+
![video showing how to filter the active data view](../images/data-views-in-sec/-getting-started-dataview-filter-example.gif)
36+
37+
This only allows you to add index patterns that match indices that currently contain data (other index patterns are unavailable). Note that any changes made are saved in the current browser window and won't persist if you open a new tab.
38+
39+
<DocCallOut title="Note">
40+
You cannot update the data view for the Alerts page. This includes referencing a cross-cluster search (CCS) data view or any other data view. The Alerts page always shows data from `.alerts-security.alerts-default`.
41+
</DocCallOut>
42+
43+
<div id="default-data-view-security"></div>
44+
45+
## The default ((data-source))
46+
47+
The default ((data-source)) is defined by the `securitySolution:defaultIndex` setting, which you can modify in <DocLink slug="/serverless/security/advanced-settings">advanced settings</DocLink>.
48+
49+
The first time a user visits ((elastic-sec)) within a given ((kib)) <DocLink slug="/serverless/spaces">space</DocLink>, the default ((data-source)) generates in that space and becomes active.
50+
51+
If you delete the active ((data-source)) when there are no other defined ((data-sources)), the default ((data-source)) will regenerate and become active upon refreshing any ((elastic-sec)) page in the space.

‎docs/serverless/investigate/timeline-templates-ui.mdx‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
---
2+
slug: /serverless/security/timeline-templates-ui
3+
title: Timeline templates
4+
description: Attach Timeline templates to detection rules to streamline investigations.
5+
tags: [ 'serverless', 'security', 'how-to', 'analyze', 'manage' ]
6+
status: in review
7+
---
8+
9+
<DocBadge template="technical preview" />
10+
<div id="timeline-templates-ui"></div>
11+
12+
You can attach Timeline templates to detection rules. When attached, the rule's alerts use the template when they are investigated in Timeline. This enables immediately viewing the alert's most interesting fields when you start an investigation.
13+
14+
Templates can include two types of filters:
15+
16+
* **Regular filter**: Like other KQL filters, defines both the source event field and its value. For example: `host.name : "win-server"`.
17+
18+
* **Template filter**: Only defines the event field and uses a placeholder
19+
for the field's value. When you investigate an alert in Timeline, the field's value is taken from the alert.
20+
21+
For example, if you define the `host.name: "{host.name}"` template filter, when alerts generated by the rule are investigated in Timeline, the alert's
22+
`host.name` value is used in the filter. If the alert's `host.name` value is
23+
`Linux_stafordshire-061`, the Timeline filter is:
24+
`host.name: "Linux_stafordshire-061"`.
25+
26+
<DocCallOut title="Note">
27+
For information on how to add Timeline templates to rules, refer to <DocLink slug="/serverless/security/rules-create">Create a detection rule</DocLink>.
28+
</DocCallOut>
29+
30+
When you load ((elastic-sec)) prebuilt rules, ((elastic-sec)) also loads a selection of prebuilt Timeline templates, which you can attach to detection rules. **Generic** templates use broad KQL queries to retrieve event data, and **Comprehensive** templates use detailed KQL queries to retrieve additional information. The following prebuilt templates appear by default:
31+
32+
* **Alerts Involving a Single Host Timeline**: Investigate detection alerts involving a single host.
33+
* **Alerts Involving a Single User Timeline**: Investigate detection alerts involving a single user.
34+
* **Generic Endpoint Timeline**: Investigate ((elastic-endpoint)) detection alerts.
35+
* **Generic Network Timeline**: Investigate network-related detection alerts.
36+
* **Generic Process Timeline**: Investigate process-related detection alerts.
37+
* **Generic Threat Match Timeline**: Investigate threat indicator match detection alerts.
38+
* **Comprehensive File Timeline**: Investigate file-related detection alerts.
39+
* **Comprehensive Network Timeline**: Investigate network-related detection alerts.
40+
* **Comprehensive Process Timeline**: Investigate process-related detection alerts.
41+
* **Comprehensive Registry Timeline**: Investigate registry-related detection alerts.
42+
43+
<DocCallOut title="Tip">
44+
You can <DocLink slug="/serverless/security/timeline-templates-ui" section="manage-existing-timeline-templates">duplicate prebuilt templates</DocLink> and use them as
45+
a starting point for your own custom templates.
46+
</DocCallOut>
47+
48+
<div id="template-legend-ui"></div>
49+
50+
## Timeline template legend
51+
52+
When you add filters to a Timeline template, the items are color coded to
53+
indicate which type of filter is added. Additionally, you change Timeline
54+
filters to template filters as you build your template.
55+
56+
Regular Timeline filter
57+
: Clicking **Convert to template field** changes the filter to a template filter:
58+
59+
<DocImage size="m" url="../images/timeline-templates-ui/-events-template-filter-value.png" alt="" />
60+
61+
Template filter
62+
63+
: <DocImage size="m" url="../images/timeline-templates-ui/-events-timeline-template-filter.png" alt="" />
64+
When you <DocLink slug="/serverless/security/timeline-templates-ui" section="manage-existing-timeline-templates">convert a template to a Timeline</DocLink>, template filters with placeholders are disabled:
65+
66+
<DocImage size="m" url="../images/timeline-templates-ui/-events-invalid-filter.png" alt="" />
67+
68+
To enable the filter, either specify a value or change it to a field's existing filter (refer to <DocLink slug="/serverless/security/timelines-ui" section="edit-existing-filters">Edit existing filters</DocLink>).
69+
70+
<div id="create-timeline-template"></div>
71+
72+
## Create a Timeline template
73+
74+
1. Choose one of the following:
75+
* Go to **Investigations** → **Timelines**. Click the **Templates** tab, then click **Create new Timeline template**.
76+
* Go to the Timeline bar (which is at the bottom of most pages), click the <DocIcon type="plusInCircle" title="New Timeline" /> button, then click **Create new Timeline template**.
77+
* From an open Timeline or Timeline template, click **New** → **New Timeline template**.
78+
79+
1. Add filters to the new Timeline template. Click **Add field**, and select the required option:
80+
81+
* **Add field**: Add a regular Timeline filter.
82+
* **Add template field**: Add a template filter with a value placeholder.
83+
84+
<DocCallOut title="Tip">
85+
You can also drag and send items to the template from the **Overview**, **Hosts**, **Network**, and **Alerts** pages.
86+
</DocCallOut>
87+
88+
![An example of a Timeline filter](../images/timeline-templates-ui/-events-create-a-timeline-template-field.png)
89+
90+
1. Click **Save** to give the template a title and description.
91+
92+
**Example**
93+
94+
To create a template for process-related alerts on a specific host:
95+
96+
* Add a regular filter for the host name:
97+
`host.name: "Linux_stafordshire-061"`
98+
99+
* Add template filter for process names: `process.name: "{process.name}"`
100+
101+
![](../images/timeline-templates-ui/-events-template-query-example.png)
102+
103+
When alerts generated by rules associated with this template are investigated
104+
in Timeline, the host name is `Linux_stafordshire-061`, whereas the process name
105+
value is retrieved from the alert's `process.name` field.
106+
107+
<div id="man-templates-ui"></div>
108+
109+
## Manage existing Timeline templates
110+
111+
You can view, duplicate, export, delete, and create templates from existing Timelines:
112+
113+
1. Go to **Investigations** → **Timelines** → **Templates**.
114+
115+
![](../images/timeline-templates-ui/-events-all-actions-timeline-ui.png)
116+
117+
1. Click the **All actions** icon in the relevant row, and then select the action:
118+
119+
* **Create timeline from template** (refer to <DocLink slug="/serverless/security/timeline-templates-ui" section="create-a-timeline-template">Create a Timeline template</DocLink>)
120+
* **Duplicate template**
121+
* **Export selected** (refer to <DocLink slug="/serverless/security/timeline-templates-ui" section="export-and-import-timeline-templates">Export and import Timeline templates</DocLink>)
122+
* **Delete selected**
123+
* **Create query rule from timeline** (only available if the Timeline contains a KQL query)
124+
* **Create EQL rule from timeline** (only available if the Timeline contains an EQL query)
125+
126+
<DocCallOut title="Tip">
127+
To perform the same action on multiple templates, select templates, then the required action from the **Bulk actions** menu.
128+
</DocCallOut>
129+
130+
<DocCallOut title="Note">
131+
You cannot delete prebuilt templates.
132+
</DocCallOut>
133+
134+
<div id="import-export-timeline-templates"></div>
135+
136+
## Export and import Timeline templates
137+
138+
You can import and export Timeline templates, which enables importing templates from one space or ((elastic-sec)) instance to another. Exported templates are saved in an `ndjson` file.
139+
140+
1. Go to **Investigations** → **Timelines** → **Templates**.
141+
1. To export templates, do one of the following:
142+
143+
* To export one template, click the **All actions** icon in the relevant row and then select **Export selected**.
144+
145+
* To export multiple templates, select all the required templates and then click **Bulk actions** → **Export selected**.
146+
147+
1. To import templates, click **Import**, then select or drag and drop the template `ndjson` file.
148+
149+
<DocCallOut title="Note">
150+
Each template object in the file must be represented in a single line.
151+
Multiple template objects are delimited with newlines.
152+
</DocCallOut>
153+
154+
<DocCallOut title="Note">
155+
You cannot export prebuilt templates.
156+
</DocCallOut>
157+

0 commit comments

Comments
 (0)