DataStream vs detection rules

Elastic Security
#1

Hi, I'm testing datastreams right now and observed that default detection rules are not looking logs from my datastreams indices. Do I have to manually change all default rules (and new ones added by updates) to include the auto-generated indices created by datastreams (.ds-*) ?

Thank you

1 Like
#2

Are these your own custom data stream logs? The default rules are looking at different indexes, so they're not all going to be the same. If so, yeah, you will have to edit and change them. You can do this via the UI or you if you're handy with scripting we have a REST API you can use to automate some of these types of tasks:

We are looking at ways of improving things such as changing indexes globally or overriding them for rules but we don't have a global mechanism at the this point.

1 Like
#3

Hi Franck, yes they are custom data streams. So for the moment, I guess I can name my datastreams with the same syntax that what detection rules are looking for (ex: filebeat-*) and detections will magically work.

Thx !

2 Likes