Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/serverless/rules/rules-ui-management.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@ Similarly, rules will be skipped if they can't be modified by a bulk edit. For e
+
[NOTE]
====
Rule actions won't run during a {kibana-ref}/maintenance-windows.html[maintenance window]. They'll resume running after the maintenance window ends.
Rule actions won't run during a <<maintenance-windows, maintenance window>>. They'll resume running after the maintenance window ends.
====
** **Update rule schedules**: Update the <<rule-schedule,schedules>> and look-back times on all selected rules.
** **Apply Timeline template**: Apply a specified <<security-timeline-templates-ui,Timeline template>> to the selected rules. You can also choose **None** to remove Timeline templates from the selected rules.
Expand Down Expand Up @@ -177,15 +177,15 @@ If you try to export with both prebuilt and custom rules selected, only the cust

The `.ndjson` file also includes any actions, connectors, and exception lists related to the exported rules. However, other configuration items require additional handling when exporting and importing rules:

* **Data views**: For rules that use a {kib} data view as a data source, the exported file contains the associated `data_view_id`, but does _not_ include any other data view configuration. To export/import between {kib} spaces, first use the {kibana-ref}/managing-saved-objects.html#managing-saved-objects-share-to-space[Saved Objects] UI (**Project settings** → **Content** → **Saved Objects**) to share the data view with the destination space.
* **Data views**: For rules that use a {kib} data view as a data source, the exported file contains the associated `data_view_id`, but does _not_ include any other data view configuration. To export/import between {kib} spaces, first use the <<saved-objects, Saved Objects>> UI (**Project settings** → **Stack Management** → **Saved Objects**) to share the data view with the destination space.

To import into a different {stack} deployment, the destination cluster must include a data view with a matching data view ID (configured in the {kibana-ref}/data-views.html[data view's advanced settings]). Alternatively, after importing, you can manually reconfigure the rule to use an appropriate data view in the destination system.

* **Actions and connectors**: Rule actions and connectors are included in the exported file, but sensitive information about the connector (such as authentication credentials) _is not_ included. You must re-add missing connector details after importing detection rules.
+
[TIP]
====
You can also use the {kibana-ref}/managing-saved-objects.html#managing-saved-objects-share-to-space[Saved Objects] UI (**Project settings** → **Content** → **Saved Objects**) to export and import necessary connectors before importing detection rules.
You can also use the <<saved-objects, Saved Objects>> UI (**Project settings** → **Stack Management** → **Saved Objects**) to export and import necessary connectors before importing detection rules.
====
* **Value lists**: Any value lists used for rule exceptions are _not_ included in rule exports or imports. Use the <<manage-value-lists,Manage value lists>> UI (**Rules** → **Detection rules (SIEM)** → **Manage value lists**) to export and import value lists separately.

Expand Down