IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Migrate detection alerts enriched with threat intelligence
editMigrate detection alerts enriched with threat intelligence
editAfter upgrading to Elastic Stack version 7.15.x or newer from a release between 7.12.0 and 7.14.2, you need to migrate detection alerts enriched with threat intelligence data to ensure threat intelligence properly displays in Elastic Security.
To migrate detection alerts:
- Ensure that all detection rules are deactivated prior to upgrading your Elastic Stack.
- Upgrade Kibana. See Upgrade Kibana for more information.
- Visit the Overview or Alerts page in Elastic Security to update the detection alert indices.
- Migrate old alerts using the Detection Alerts Migration API.
- Reactivate all detection rules.
Deactivate all detection rules
editTo deactivate all detection rules:
- Go to Rules → Detection rules (SIEM).
- Click the Select all x rules option above the rules table.
- Click Bulk actions → Disable.
Reactivate all detection rules
editTo reactivate all detection rules:
- Go to Rules → Detection rules (SIEM).
- Click the Select all x rules option above the rules table.
- Click Bulk actions → Enable.