Configure advanced settings

The advanced settings determine:

To change these settings, you need All privileges for the Advanced Settings Kibana feature.

To access advanced settings, go to Stack Management → Advanced Settings, then scroll down to Security Solution settings.

The securitySolution:defaultIndex field defines which Elasticsearch indices the Elastic Security app uses to collect data. By default, index patterns are used to match sets of Elasticsearch indices.

All of the default index patterns match Beats and Elastic Agent indices. This means all data shipped via Beats and the Elastic Agent is automatically added to the Elastic Security app.

You can add or remove any indices and index patterns as required. For background information on Elasticsearch indices, refer to Data in: documents and indices.

The securitySolution:defaultThreatIndex advanced setting specifies threat intelligence indices that Elastic Security features query for ingested threat indicators. This setting affects features that query threat intelligence indices, such as the Threat Intelligence view on the Overview page, indicator match rules, and the alert enrichment query. You can specify one or more threat intelligence indices; multiple indices must be separated by commas. By default, only the logs-ti* index pattern is specified. Do not remove or overwrite this index pattern, as it is used by Elastic Agent integrations.

Kibana transmits certain information about Elastic Security when users interact with the Elastic Security app, detailed below. Kibana redacts or obfuscates personal data (IP addresses, host names, usernames, etc.) before transmitting messages to Elastic. Security-specific telemetry events include:

To learn more, refer to our Privacy Statement.

When security machine learning jobs are enabled, this setting determines the threshold above which anomaly scores appear in Elastic Security:

You can change these settings, which affect the news feed displayed on the Elastic Security Overview page:

Including data from cold and frozen data tiers in visual event analyzer queries may result in performance degradation. The securitySolution:excludeColdAndFrozenTiersInAnalyzer setting allows you to exclude this data from analyzer queries. This setting is turned off by default.

The securitySolution:enableVisualizationsInFlyout setting allows you to access the event analyzer and Session View in the Visualize tab on the alert or event details flyout. This setting is turned off by default.

These settings determine the default time interval and refresh rate Elastic Security pages use to display data when you open the app:

On IP details pages (Security → Network → IP address), links to external sites for verifying the IP address’s reputation are displayed. By default, links to these sites are listed: TALOS and VIRUSTOTAL.

The securitySolution:ipReputationLinks field determines which IP reputation sites are listed. To modify the listed sites, edit the field’s JSON array. These fields must be defined in each array element:

Example

Adds a link to https://www.dnschecker.org on IP detail pages:

[
  { "name": "virustotal.com", "url_template": "https://www.virustotal.com/gui/search/{{ip}}" },
  { "name": "dnschecker.org", "url_template": "https://www.dnschecker.org/ip-location.php?ip={{ip}}" },
  { "name": "talosIntelligence.com", "url_template": "https://talosintelligence.com/reputation_center/lookup?search={{ip}}" }
]

Each time a detection rule runs using a remote cross-cluster search (CCS) index pattern, it will return a warning saying that the rule may not have the required read privileges to the remote index. Because privileges cannot be checked across remote indices, this warning displays even when the rule actually does have read privileges to the remote index.

If you’ve ensured that your detection rules have the required privileges across your remote indices, you can use the securitySolution:enableCcsWarning setting to disable this warning and reduce noise.

By default, Elastic prebuilt rules in the Rules and Rule Monitoring tables include a badge showing how many related integrations have been installed. Turn off securitySolution:showRelatedIntegrations to hide this in the rules tables (related integrations will still appear on rule details pages).

The securitySolution:alertTags field determines which options display in the alert tag menu. The default alert tag options are Duplicate, False Positive, and Further investigation required. You can update the alert tag menu by editing these options or adding more. To learn more about using alert tags, refer to Apply and filter alert tags.

The securitySolution:maxUnassociatedNotes field determines the maximum number of notes that you can attach to alerts and events. The maximum limit and default value is 1000.

To ensure rules don’t search cold and frozen data when executing, specify cold and frozen data tiers in the excludedDataTiersForRuleExecution field. Multiple data tiers must be separated by commas, for example: data_frozen, data_cold. This setting is turned off by default; turning it on can improve rule performance and reduce execution time.

This setting does not apply to machine learning rules.