Skip to content

[Suggestion] Add example of excluding cold/frozen data from Indicator Match rule queries #5895

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

[Suggestion] Add example of excluding cold/frozen data from Indicator Match rule queries #5895

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
eff795c
First draft
nastasha-solomon Oct 4, 2024
d86caa0
Merge branch 'main' into issue-47-im-rule-doc-improvements
nastasha-solomon Oct 16, 2024
746e600
Merge branch 'main' into issue-47-im-rule-doc-improvements
nastasha-solomon Oct 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/detections/detection-engine-intro.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ Indicator match rules provide a powerful capability to search your security data

In addition, the following support restrictions are in place:

* {elastic-sec} does not support the use of either cold or frozen {ref}/data-tiers.html[tier data] with indicator match rules.
* {elastic-sec} does not support the use of either cold or frozen {ref}/data-tiers.html[tier data] with indicator match rules. However, the rule will search cold and frozen data tiers if they exist. To prevent this, configure the `excludedDataTiersForRuleExecution` <<exclude-cold-frozen-data-rule-executions,advanced setting>> (which applies to all rules in a space), or add a <<exclude-cold-frozen-data-individual-rules,Query DSL filter>> to individual rules.
* Indicator match rules with an additional look-back time value greater than 24 hours are not supported.

[float]
Expand Down