[SIEM][Docs]Clarifies SIEM index and Kibana index pattern requirements #739
Conversation
benskelker
changed the title
benskelker
changed the title
| NOTE: The default index glob patterns defined for {siem-soln} events are | ||
| `endgame-*`, `auditbeat-*`, `winlogbeat-*`, `filebeat-*`, and `packetbeat-*`. | ||
| You can change the default glob patterns in {kib} -> Management -> Advanced | ||
| Settings -> `siem:defaultIndex`. |
There was a problem hiding this comment.
Just a heads up that this will be changing to include apm-*-transcation* as part of elastic/kibana#52297 (comment). As noted in that comment, there is going to be specific logic for matching apm-*-transcation* to the apm-* Kibana Index Pattern.
There was a problem hiding this comment.
Thanks @spong
We can update the documentation anytime - so we'll add this when it's implemented.
docs/en/siem/siem-ui.asciidoc
Outdated
| ==== Create {kib} index patterns | ||
|
|
||
| To display data on the map, you must define {kib} index patterns | ||
| (Management -> Index Patterns) that match all the {siem-soln} {es} indices you |
There was a problem hiding this comment.
Only note here is whether 'match' could be understood to mean pattern matching vs exact string match. Not sure if clarification is needed, but I think this may be the last area of confusion (🤞) until we support pattern matching when determining which layers to generate.
There was a problem hiding this comment.
Yes, thanks. Updating the text.
There was a problem hiding this comment.
Added a couple clarifying comments, but no changes necessary.
LGTM! 👍 Thanks @benskelker!
|
@spong |
Updates look great! Very clear that you have to have exact matching SIEM/Kibana index patterns to see data on the map now. Thanks @benskelker! |
docs/en/siem/installation.asciidoc
Outdated
| must add its index to the {siem-soln} {es} indices (*{kib}* -> | ||
| *Management* -> *Advanced Settings* -> *`siem:defaultIndex`*). | ||
|
|
||
| It is also important to note that {siem-soln} uses the |
There was a problem hiding this comment.
Consider trimming this up:
It is also important to note that {siem-soln} uses the
Adds additional clarifications on index requirements in general and, specifically, for maps configuration.
Map configuration page preview
Requested in #52312.