New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« Beats release notes Elasticsearch release notes »
Elastic Docs ›Elastic Installation and Upgrade Guide [9.0] ›Release notes

Elastic Security release notes

edit

Elastic Security release notes

edit

Elastic Security version 9.0.0-rc1

edit

Coming in 9.0.0-rc1.

All features introduced in 8.18.0 are also available in 9.0.0.

Breaking changes

edit
  • Refactors the Timeline HTTP API endpoints (#200633).
  • Removes deprecated API endpoints for Elastic Defend (#199598).
  • Removes deprecated API endpoints for bulk CRUD actions on detection rules (#197422, #207906).

Deprecations

edit
  • Renames the integration-assistant plugin to automatic-import to match the associated feature (#207325).
  • Removes all legacy risk engine code and features (#201810).
  • Removes deprecated API endpoints for Elastic Defend (#199598).
  • Deprecates the SIEM signals migration APIs (#202662).

Known issues

edit
Duplicate alerts can be produced from manually running threshold rules

Details
On November 12, 2024, it was discovered that manually running threshold rules could produce duplicate alerts if the date range was already covered by a scheduled rule execution.

Manually running custom query rules with suppression could suppress more alerts than expected

Details
On November 12, 2024, it was discovered that manually running a custom query rule with suppression could incorrectly inflate the number of suppressed alerts.

New features

edit
  • Enables Automatic Import to accept CEL log samples (#206491).
  • Applies the latest Elastic UI framework (EUI) to Elastic Security features (#204007, #204908).
  • Adds the option to view Elasticsearch queries that run during rule execution for threshold, custom query, and machine learning rules (#203320).

Enhancements

edit
  • Enhances Automatic Import by including setup and troubleshooting documentation for each input type that’s selected in the readme (#206477).
  • Allows users to include closed alerts in risk score calculations (#201909).
  • Adds the ability to continue to the Entity Analytics dashboard when there is no data (#201363).
  • Modifies the privilege-checking behavior during rule execution. Now, only read privileges of extant indices are checked during rule execution (#177658).

Bug fixes

edit
  • Ensures that table actions use standard colors (#207743).
  • Fixes a bug with the Save and continue button on a Fleet form (#211563).

Elastic Security version 9.0.0-beta1

edit

Breaking changes

edit
  • Refactors the Timeline HTTP API endpoints (#200633).
  • Removes deprecated API endpoints for Elastic Defend (#199598).
  • Removes deprecated API endpoints for bulk CRUD actions on detection rules (#197422, #207906).

Deprecations

edit
  • Renames the integration-assistant plugin to automatic-import to match the associated feature (#207325).
  • Removes all legacy risk engine code and features (#201810).
  • Removes deprecated API endpoints for Elastic Defend (#199598).
  • Deprecates the SIEM signals migration APIs (#202662).

Known issues

edit
Duplicate alerts can be produced from manually running threshold rules

Details
On November 12, 2024, it was discovered that manually running threshold rules could produce duplicate alerts if the date range was already covered by a scheduled rule execution.

Manually running custom query rules with suppression could suppress more alerts than expected

Details
On November 12, 2024, it was discovered that manually running a custom query rule with suppression could incorrectly inflate the number of suppressed alerts.

New features

edit
  • Enables Automatic Import to accept CEL log samples (#206491).
  • Applies the latest Elastic UI framework (EUI) to Elastic Security features (#204007, #204908).
  • Adds the option to view Elasticsearch queries that run during rule execution for threshold, custom query, and machine learning rules (#203320).

Enhancements

edit
  • Enhances Automatic Import by including setup and troubleshooting documentation for each input type that’s selected in the readme (#206477).
  • Allows users to include closed alerts in risk score calculations (#201909).
  • Adds the ability to continue to the Entity Analytics dashboard when there is no data (#201363).
  • Modifies the privilege-checking behavior during rule execution. Now, only read privileges of extant indices are checked during rule execution (#177658).

Bug fixes

edit
  • Ensures that table actions use standard colors (#207743).
« Beats release notes Elasticsearch release notes »