Cross cluster search for SIEM rules

Elastic Security
1

Hello

I didn't find info in docs.
So the question is, if I have remote cluster with Basic license where I store all logs and etc for SIEM and connect from remote cluster with Enteprise license and Kibana where I create all rules in Elastic Security.
It will work? or not?

1 Like
2

Hi @Aliya_Khalel

Good question.

Clusters using CCS or CCR are required to be at the same license level.

So no the use case you are describing is not supported.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.