From daaa4a726e63a0c8d3894868fcf2fca0d2dad2dc Mon Sep 17 00:00:00 2001
From: James Gowdy <jgowdy@elastic.co>
Date: Wed, 22 Mar 2023 04:51:50 -0400
Subject: [PATCH] [ML] Reinstating cold and frozen tier filters for linux and
 windows security modules (#153222)

The cold and frozen query filters which were added
[here](https://github.com/elastic/kibana/issues/116696) were
accidentally removed in this
[PR](https://github.com/elastic/kibana/pull/131166)
---
 .../modules/security_linux/manifest.json               | 10 +++++++++-
 .../modules/security_windows/manifest.json             | 10 +++++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/manifest.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/manifest.json
index cfa9f45c5d1ac..269f90dea4471 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/manifest.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/manifest.json
@@ -40,7 +40,15 @@
             }
           }
         }
-      ]
+      ],
+      "must_not": {
+        "terms": {
+          "_tier": [
+            "data_frozen",
+            "data_cold"
+          ]
+        }
+      }
     }
   },
   "jobs": [
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/manifest.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/manifest.json
index 8d01d0d91e0c2..01636fbbd6a4b 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/manifest.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/manifest.json
@@ -30,7 +30,15 @@
             ]
           }
         }
-      ]
+      ],
+      "must_not": {
+        "terms": {
+          "_tier": [
+            "data_frozen",
+            "data_cold"
+          ]
+        }
+      }
     }
   },
   "jobs": [