Skip to content

[Security][8.18 & 8.19] Add 'search.allow_expensive_queries' to detection reqs #7092

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Oct 22, 2025
Merged

[Security][8.18 & 8.19] Add 'search.allow_expensive_queries' to detection reqs #7092

Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
07b5ad6
First draft
nastasha-solomon Oct 21, 2025
5bc0544
Fixed attribute
nastasha-solomon Oct 21, 2025
8d9b464
Update docs/detections/detections-req.asciidoc
sdesalas Oct 22, 2025
ae19161
Update docs/detections/detections-req.asciidoc
nastasha-solomon Oct 22, 2025
481feff
Update docs/detections/detections-req.asciidoc
nastasha-solomon Oct 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions docs/detections/detections-req.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,15 +20,15 @@ These steps are only required for *self-managed* deployments:

* HTTPS must be configured for communication between
{kibana-ref}/configuring-tls.html#configuring-tls-kib-es[{es} and {kib}].
* In the `elasticsearch.yml` configuration file, set the
`xpack.security.enabled` setting to `true`. For more information, refer to
{ref}/settings.html[Configuring {es}] and
{ref}/security-settings.html[Security settings in {es}].
* In the `kibana.yml` {kibana-ref}/settings.html[configuration file], add the
`xpack.encryptedSavedObjects.encryptionKey` setting with any alphanumeric value
of at least 32 characters. For example:
+
`xpack.encryptedSavedObjects.encryptionKey: 'fhjskloppd678ehkdfdlliverpoolfcr'`
* In the `elasticsearch.yml` {ref}/settings.html[configuration] file:

** Set the `xpack.security.enabled` setting to `true`. For more information, refer to {ref}/security-settings.html[general security settings in {es}].
** Remove the line `search.allow_expensive_queries=false` if you find it. The `search.allow_expensive_queries` setting must be left on its default value of `true` for key detection features like {kibana-ref}/alerting-getting-started.html#_rules[alerting rules] and rule exceptions to work.

IMPORTANT: After changing the `xpack.encryptedSavedObjects.encryptionKey` value
and restarting {kib}, you must restart all detection rules.
Expand Down