diff --git a/solutions/security/detect-and-alert/add-manage-exceptions.md b/solutions/security/detect-and-alert/add-manage-exceptions.md index f57d3a0d16..d8f766422e 100644 --- a/solutions/security/detect-and-alert/add-manage-exceptions.md +++ b/solutions/security/detect-and-alert/add-manage-exceptions.md @@ -33,7 +33,39 @@ You can add exceptions to a rule from the rule details page, the Alerts table, t :::: +## Requirements [exceptions-requirements] +To use exceptions ensure your role has the appropriate access. To learn how to access other detection features, refer to [](/solutions/security/detect-and-alert/detections-requirements.md). + +### Exceptions requirements + +::::{applies-switch} + +:::{applies-item} { "stack": "ga 9.0" } + +**Manage access**: To create and manage exceptions for individual and multiple rules, your role needs `All` [{{kib}} privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management.md) for the **Security > Security** feature. + +::: + +:::{applies-item} { "stack": "ga 9.3" } + +- **View only access**: To view exceptions for individual and multiple rules, your role needs at least `Read` [{{kib}} privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management.md) for the **Security > Rules, Alerts, and Exceptions** {{kib}} feature. +- **Manage access**: To create and manage exceptions for individual and multiple rules, your role needs `All` {{kib}} privileges for the **Security > Rules, Alerts, and Exceptions** {{kib}} feature. + +::: + +:::{applies-item} { "stack": "ga 9.4", "serverless": "ga" } + +- **View only access**: To view exceptions for individual and multiple rules, your role needs at least `Read` [{{kib}} privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-role-management.md) for the **Security > Rules, Alerts, and Exceptions** {{kib}} feature and `Read` for the **Security > Rules > Exceptions** subfeature. +- **Manage access**: To create and manage exceptions for individual and multiple rules, your role needsat least `Read` {{kib}} privileges for the **Security > Rules, Alerts, and Exceptions** {{kib}} feature and `All` for the **Security > Rules > Exceptions** subfeature. +::: + +:::: + +### {{elastic-endpoint}} exceptions requirements + +- **View only access**: To view {{elastic-endpoint}} exceptions, your role needs at least `Read` {{kib}} privileges for the **Security > Security > Endpoint Exceptions** subfeature. +- **Manage access**: To create and manage {{elastic-endpoint}} exceptions, your role needs `All` {{kib}} privileges for the **Security > Security > Endpoint Exceptions** subfeature. ## Add exceptions to a rule [detection-rule-exceptions] diff --git a/solutions/security/detect-and-alert/detections-requirements.md b/solutions/security/detect-and-alert/detections-requirements.md index ac7c8dac66..2cd09e9704 100644 --- a/solutions/security/detect-and-alert/detections-requirements.md +++ b/solutions/security/detect-and-alert/detections-requirements.md @@ -65,7 +65,7 @@ For instructions about using {{ml}} jobs and rules, refer to [Machine learning j | Preview rules | N/A | `read` for these indices:

- `.preview.alerts-security.alerts-`
- `.internal.preview.alerts-security.alerts--*`
| - {applies_to}`stack: ga 9.0`: `All` for the `Security` feature

- {applies_to}`stack: ga 9.3` {applies_to}`serverless: ga`: `All` for the `Rules` feature | | Manage rules | N/A | `manage`, `write`, `read`, and `view_index_metadata` for these system indices and data streams, where `` is the space name:

- `.alerts-security.alerts-`
- `.siem-signals-`^1^
- `.lists-`
- `.items-`

^1^ **NOTE**: If you’re upgrading to {{stack}} 8.0.0 or later, users should have privileges for the `.alerts-security.alerts-` AND `.siem-signals-` indices. If you’re newly installing the {{stack}}, then users do not need privileges for the `.siem-signals-` index.
| - {applies_to}`stack: ga 9.0`: `All` for the `Security` feature

- {applies_to}`stack: ga 9.3` {applies_to}`serverless: ga`: `All` for the `Rules` feature

**NOTE:** You need additional `Action and Connectors` feature privileges (**Management → Action and Connectors**) to manage rules with actions and connectors:

- To provide full access to rule actions and connectors, give your role `All` privileges. With `Read` privileges, you can edit rule actions, but will have limited capabilities to manage connectors. For example, `Read` privileges allow you to add or remove an existing connector from a rule, but does not allow you to create a new connector.
- To import rules with actions, you need at least `Read` privileges for the `Action and Connectors` feature. To overwrite or add new connectors, you need `All` privileges for the `Actions and Connectors` feature. To import rules without actions, you don’t need `Actions and Connectors` privileges.
| | Manage alerts

**NOTE**: Allows you to manage alerts, but not modify rules. | N/A | `maintenance`, `write`, `read`, and `view_index_metadata` for these system indices and data streams, where `` is the space name:

- `.alerts-security.alerts-`
- `.internal.alerts-security.alerts--*`
- `.siem-signals-`^1^
- `.lists-`
- `.items-`

**NOTE**: Before a user can be assigned to a case, they must log into Kibana at least once, which creates a user profile.

^1^ **NOTE**: If you’re upgrading to {{stack}} 8.0.0 or later, users should have privileges for the `.alerts-security.alerts-` AND `.siem-signals-` indices. If you’re newly installing the {{stack}}, then users do not need privileges for the `.siem-signals-` index.
| - {applies_to}`stack: ga 9.0`: `All` for the `Security` feature

- {applies_to}`stack: ga 9.3` {applies_to}`serverless: ga`: `All` for the `Rules` feature

**NOTE:** Alerts are managed through {{es}} index privileges. To view the alert management flows requires at least the `Read` for the `Rules` feature. | -| Manage exceptions | N/A | N/A | - {applies_to}`stack: ga 9.0`: `All` for the `Security` feature

- {applies_to}`stack: ga 9.3` {applies_to}`serverless: ga`: `All` for the `Rules` feature | +| Manage exceptions | N/A | N/A | - {applies_to}`stack: ga 9.0`: `All` for the `Security` feature

- {applies_to}`stack: ga 9.3`: `All` for the `Rules` feature

- {applies_to}`stack: ga 9.4` {applies_to}`serverless: ga`: `Read` for the `Rules, Alerts, and Exceptions ` feature and `All` for the `Exceptions` subfeature | | Manage value lists.

Create the `.lists` and `.items` data streams in your space

**NOTE**: To initiate the process that creates the data streams, you must visit the Rules page for each appropriate space. | `manage` | `manage`, `write`, `read`, and `view_index_metadata` for these data streams, where `` is the space name:

- `.lists-`
- `.items-`
| - {applies_to}`stack: ga 9.0`: `All` for the `Security` feature

- {applies_to}`stack: ga 9.3` {applies_to}`serverless: ga`: `All` for the `Rules` and `Saved Objects Management` features | ### Predefined {{serverless-full}} roles [predefined-serverless-roles-detections]