Cross cluster search for SIEM rules

Elastic Security
1

Hello

I didn't find info in docs.
So the question is, if I have remote cluster with Basic license where I store all logs and etc for SIEM and connect from remote cluster with Enteprise license and Kibana where I create all rules in Elastic Security.
It will work? or not?

2

Hi @Aliya_Khalel

Good question.

Clusters using CCS or CCR are required to be at the same license level.

So no the use case you are describing is not supported.