Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Serverless]: Security – About detection rules #6239

Draft
wants to merge 6 commits into
base: main
Choose a base branch
from
Draft
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/serverless/rules/about-rules.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ When you create a rule, you must either specify the {es} index pattens for which

[NOTE]
====
To access data views, ensure you have the {kibana-ref}/data-views.html#data-views-read-only-access[required permissions].
To access data views, you need either the appropriate <<general-assign-user-roles,predefined Security user role>> or a <<custom-roles,custom role>> with the right privileges.
====

[discrete]
Expand All @@ -74,7 +74,7 @@ For both prebuilt and custom rules, you can send notifications when alerts are c
[[alerting-authorization-model]]
== Authorization

Rules, including all background detection and the actions they generate, are authorized using an {kibana-ref}/api-keys.html[API key] associated with the last user to edit the rule. Upon creating or modifying a rule, an API key is generated for that user, capturing a snapshot of their privileges. The API key is then used to run all background tasks associated with the rule including detection checks and executing actions.
Rules, including all background detection and the actions they generate, are authorized using an <<api-keys,API key>> associated with the last user to edit the rule. Upon creating or modifying a rule, an API key is generated for that user, capturing a snapshot of their privileges. The API key is then used to run all background tasks associated with the rule including detection checks and executing actions.

[IMPORTANT]
====
Expand Down