Threat Intelligence View Not Using securitySolution:defaultThreatIndex

logalicious · March 12, 2026, 2:30pm

It looks like threat intelligence source indices are controlled with an ILM policy that has a hot tier max age of 1 day and delete min age of 2 days. So I guess while the data is duplicated for ~2 days, that is the best that can be achieved while using Elastic’s current approach.

Not too bad, but I still think there is room for improvement here. Specifically, it would be nice if the threat intelligence view respected the securitySolution:defaultThreatIndex setting or if the source indices did not use index names that match the logs-ti_* pattern.

For example:

github.com/elastic/integrations

packages/ti_crowdstrike/data_stream/ioc/elasticsearch/ilm/default_policy.json

main

{
    "policy": {
        "phases": {
            "hot": {
                "actions": {
                    "rollover": {
                        "max_age": "1d",
                        "max_size": "50gb"
                    },
                    "set_priority": {
                        "priority": 100
                    }
                }
            },
            "delete": {
                "min_age": "2d",
                "actions": {
                    "delete": {}
                }
            }

This file has been truncated. show original

Topic		Replies	Views
Threat Intelligence Integration won't show any data Elastic Security	8	601	October 25, 2023
Threat Intel and SIEM SIEM	3	4419	December 15, 2020
No threat intelligence data Beats beats-module , filebeat	5	538	November 29, 2022
Dedicated index logs-ti* (Threat Intel module) in Filebeat Beats beats-module , filebeat	1	320	August 15, 2022
Change index name for threatintel module, good idea? Beats docker , filebeat	2	357	February 21, 2022

Threat Intelligence View Not Using securitySolution:defaultThreatIndex

Related topics