diff --git a/docs/advanced-entity-analytics/ml-req.asciidoc b/docs/advanced-entity-analytics/ml-req.asciidoc index f42f61e513..edab94a672 100644 --- a/docs/advanced-entity-analytics/ml-req.asciidoc +++ b/docs/advanced-entity-analytics/ml-req.asciidoc @@ -7,6 +7,10 @@ To run and create {ml} jobs and rules, you need all of these: * There must be at least one {ml} node in your cluster * The `machine_learning_admin` user role +Additionally, to configure <> for {ml} rules, your role needs the following {kibana-ref}/kibana-role-management.html#adding_index_privileges[index privilege]: + +* `read` permission for the `.ml-anomalies-*` index + For more information, go to {ml-docs}/setup.html[Set up {ml-features}]. [IMPORTANT] diff --git a/docs/detections/alert-suppression.asciidoc b/docs/detections/alert-suppression.asciidoc index 73f0537840..1d9070bd03 100644 --- a/docs/detections/alert-suppression.asciidoc +++ b/docs/detections/alert-suppression.asciidoc @@ -4,7 +4,9 @@ .Requirements and notices [sidebar] -- -Alert suppression requires a https://www.elastic.co/pricing[Platinum or higher subscription]. +* Alert suppression requires a https://www.elastic.co/pricing[Platinum or higher subscription]. + +* {ml-cap} rules have <> for alert suppression. preview::["Alert suppression is in technical preview for threshold, indicator match, event correlation, and new terms rules. The functionality may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features."] -- @@ -17,7 +19,7 @@ Alert suppression allows you to reduce the number of repeated or duplicate detec * <> (non-sequence queries only) * <> * <> -* <> +* <> Normally, when a rule meets its criteria repeatedly, it creates multiple alerts, one for each time the rule's criteria are met. When alert suppression is configured, duplicate qualifying events are grouped, and only one alert is created for each group. Depending on the rule type, you can configure alert suppression to create alerts each time the rule runs, or once within a specified time window. You can also specify multiple fields to group events by unique combinations of values.