You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/serverless/rules/rules-ui-management.asciidoc
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -81,7 +81,7 @@ Similarly, rules will be skipped if they can't be modified by a bulk edit. For e
81
81
+
82
82
[NOTE]
83
83
====
84
-
Rule actions won't run during a {kibana-ref}/maintenance-windows.html[maintenance window]. They'll resume running after the maintenance window ends.
84
+
Rule actions won't run during a <<maintenance-windows, maintenance window>>. They'll resume running after the maintenance window ends.
85
85
====
86
86
** **Update rule schedules**: Update the <<rule-schedule,schedules>> and look-back times on all selected rules.
87
87
** **Apply Timeline template**: Apply a specified <<security-timeline-templates-ui,Timeline template>> to the selected rules. You can also choose **None** to remove Timeline templates from the selected rules.
@@ -177,15 +177,15 @@ If you try to export with both prebuilt and custom rules selected, only the cust
177
177
178
178
The `.ndjson` file also includes any actions, connectors, and exception lists related to the exported rules. However, other configuration items require additional handling when exporting and importing rules:
179
179
180
-
* **Data views**: For rules that use a {kib} data view as a data source, the exported file contains the associated `data_view_id`, but does _not_ include any other data view configuration. To export/import between {kib} spaces, first use the {kibana-ref}/managing-saved-objects.html#managing-saved-objects-share-to-space[Saved Objects] UI (**Project settings** → **Content** → **Saved Objects**) to share the data view with the destination space.
180
+
* **Data views**: For rules that use a {kib} data view as a data source, the exported file contains the associated `data_view_id`, but does _not_ include any other data view configuration. To export/import between {kib} spaces, first use the <<saved-objects, Saved Objects>> UI (**Project settings** → **Stack Management** → **Saved Objects**) to share the data view with the destination space.
181
181
182
182
To import into a different {stack} deployment, the destination cluster must include a data view with a matching data view ID (configured in the {kibana-ref}/data-views.html[data view's advanced settings]). Alternatively, after importing, you can manually reconfigure the rule to use an appropriate data view in the destination system.
183
183
184
184
* **Actions and connectors**: Rule actions and connectors are included in the exported file, but sensitive information about the connector (such as authentication credentials) _is not_ included. You must re-add missing connector details after importing detection rules.
185
185
+
186
186
[TIP]
187
187
====
188
-
You can also use the {kibana-ref}/managing-saved-objects.html#managing-saved-objects-share-to-space[Saved Objects] UI (**Project settings** → **Content** → **Saved Objects**) to export and import necessary connectors before importing detection rules.
188
+
You can also use the <<saved-objects, Saved Objects>> UI (**Project settings** → **Stack Management** → **Saved Objects**) to export and import necessary connectors before importing detection rules.
189
189
====
190
190
* **Value lists**: Any value lists used for rule exceptions are _not_ included in rule exports or imports. Use the <<manage-value-lists,Manage value lists>> UI (**Rules** → **Detection rules (SIEM)** → **Manage value lists**) to export and import value lists separately.
0 commit comments