This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« Post-upgrade steps (optional) Index template script »
Elastic Docs ›Elastic Security Solution [8.16] ›Post-upgrade steps (optional)

Migrate detection alerts enriched with threat intelligence

edit

Migrate detection alerts enriched with threat intelligence

edit

After upgrading to Elastic Stack version 7.15.x or newer from a release between 7.12.0 and 7.14.2, you need to migrate detection alerts enriched with threat intelligence data to ensure threat intelligence properly displays in Elastic Security.

To migrate detection alerts:

  1. Ensure that all detection rules are deactivated prior to upgrading your Elastic Stack.
  2. Upgrade Kibana. See Upgrade Kibana for more information.
  3. Visit the Overview or Alerts page in Elastic Security to update the detection alert indices.
  4. Migrate old alerts using the Detection Alerts Migration API.
  5. Reactivate all detection rules.

Deactivate all detection rules

edit

To deactivate all detection rules:

  1. Find Detection rules (SIEM) in the navigation menu or by using the global search field.
  2. Click the Select all x rules option above the rules table.
  3. Click Bulk actions → Disable.

Reactivate all detection rules

edit

To reactivate all detection rules:

  1. Find Detection rules (SIEM) in the navigation menu or by using the global search field.
  2. Click the Select all x rules option above the rules table.
  3. Click Bulk actions → Enable.
« Post-upgrade steps (optional) Index template script »