From 46726b3a646d8d1db43c496e976c81f072ffaa34 Mon Sep 17 00:00:00 2001 From: Nastasha Solomon Date: Tue, 28 Apr 2026 21:56:34 -0400 Subject: [PATCH 1/6] First draft --- docs/reference/advanced-settings-space.yml | 30 ++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/docs/reference/advanced-settings-space.yml b/docs/reference/advanced-settings-space.yml index 3ef2e3e3fc941..6d3a75d3c09c2 100644 --- a/docs/reference/advanced-settings-space.yml +++ b/docs/reference/advanced-settings-space.yml @@ -802,6 +802,23 @@ groups: self: ga serverless: ga + - group: Cases + id: kibana-cases-settings + settings: + + - setting: "cases:maxOpenCasesPerRuleRun" + id: cases-max-open-cases-per-rule-run + description: | + Sets the maximum number of new cases the Cases connector can open in one detection rule run when the rule includes a Cases action. Values must be between 1 and 1000. Very high values can add load on {{kib}} and {{es}}. `20` by default. + datatype: string + applies_to: + stack: ga 9.4 + ech: ga + ece: ga + eck: ga + self: ga + serverless: ga + - group: Discover id: kibana-discover-settings settings: @@ -2139,6 +2156,19 @@ groups: self: ga security: ga + - setting: "securitySolution:includedDataStreamNamespacesForRuleExecution" + id: security-solution-included-data-stream-namespaces-for-rule-execution + description: | + When configured, the setting restricts which documents detection rules search. Only events whose `data_stream.namespace` field matches one of the specified namespaces are queried. This applies to all detection rules in the {{kib}} space and acts like a global filter on `data_stream.namespace`. Specify an array of namespace strings (for example, `namespace1`, `namespace2`). You can configure up to 50 namespaces. Empty by default (searches all namespaces). + datatype: string + applies_to: + stack: ga 9.4 + ech: ga + ece: ga + eck: ga + self: ga + serverless: ga + - setting: "securitySolution:enablePrivilegedUserMonitoring" id: security-solution-enable-privileged-user-monitoring description: | From 4120e670112e6c57cf4636fbaed27a6808ec989d Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Tue, 28 Apr 2026 22:59:33 -0400 Subject: [PATCH 2/6] Update docs/reference/advanced-settings-space.yml --- docs/reference/advanced-settings-space.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/advanced-settings-space.yml b/docs/reference/advanced-settings-space.yml index 6d3a75d3c09c2..55481e3b00707 100644 --- a/docs/reference/advanced-settings-space.yml +++ b/docs/reference/advanced-settings-space.yml @@ -810,7 +810,7 @@ groups: id: cases-max-open-cases-per-rule-run description: | Sets the maximum number of new cases the Cases connector can open in one detection rule run when the rule includes a Cases action. Values must be between 1 and 1000. Very high values can add load on {{kib}} and {{es}}. `20` by default. - datatype: string + datatype: number applies_to: stack: ga 9.4 ech: ga From cbb50691cb076e25df7e9baaa03571c3631195bb Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Tue, 28 Apr 2026 23:32:49 -0400 Subject: [PATCH 3/6] Apply suggestion from @nastasha-solomon --- docs/reference/advanced-settings-space.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/reference/advanced-settings-space.yml b/docs/reference/advanced-settings-space.yml index 55481e3b00707..9536bbece10f3 100644 --- a/docs/reference/advanced-settings-space.yml +++ b/docs/reference/advanced-settings-space.yml @@ -811,6 +811,7 @@ groups: description: | Sets the maximum number of new cases the Cases connector can open in one detection rule run when the rule includes a Cases action. Values must be between 1 and 1000. Very high values can add load on {{kib}} and {{es}}. `20` by default. datatype: number + default: 20 applies_to: stack: ga 9.4 ech: ga From 0d531267157f8d39647adee8d339c5e3164291b7 Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Wed, 29 Apr 2026 13:37:13 -0400 Subject: [PATCH 4/6] Update docs/reference/advanced-settings-space.yml Co-authored-by: Florent LB --- docs/reference/advanced-settings-space.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/advanced-settings-space.yml b/docs/reference/advanced-settings-space.yml index 9536bbece10f3..202212138b2e2 100644 --- a/docs/reference/advanced-settings-space.yml +++ b/docs/reference/advanced-settings-space.yml @@ -810,7 +810,7 @@ groups: id: cases-max-open-cases-per-rule-run description: | Sets the maximum number of new cases the Cases connector can open in one detection rule run when the rule includes a Cases action. Values must be between 1 and 1000. Very high values can add load on {{kib}} and {{es}}. `20` by default. - datatype: number + datatype: int default: 20 applies_to: stack: ga 9.4 From 3083e32a8cc1a8dc53942e8659fa8eec9dc3468b Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Wed, 29 Apr 2026 13:37:29 -0400 Subject: [PATCH 5/6] Update docs/reference/advanced-settings-space.yml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- docs/reference/advanced-settings-space.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/reference/advanced-settings-space.yml b/docs/reference/advanced-settings-space.yml index 202212138b2e2..ede552a1ee47b 100644 --- a/docs/reference/advanced-settings-space.yml +++ b/docs/reference/advanced-settings-space.yml @@ -2160,8 +2160,8 @@ groups: - setting: "securitySolution:includedDataStreamNamespacesForRuleExecution" id: security-solution-included-data-stream-namespaces-for-rule-execution description: | - When configured, the setting restricts which documents detection rules search. Only events whose `data_stream.namespace` field matches one of the specified namespaces are queried. This applies to all detection rules in the {{kib}} space and acts like a global filter on `data_stream.namespace`. Specify an array of namespace strings (for example, `namespace1`, `namespace2`). You can configure up to 50 namespaces. Empty by default (searches all namespaces). - datatype: string + When configured, the setting restricts which documents detection rules search. Only events whose `data_stream.namespace` field matches one of the specified namespaces are queried. This applies to all detection rules in the {{kib}} space and acts like a global filter on `data_stream.namespace`. Specify an array of namespace strings (for example, `["namespace1", "namespace2"]`). You can configure up to 50 namespaces. Empty by default (searches all namespaces). + datatype: json applies_to: stack: ga 9.4 ech: ga From 34a26e8192851ccfe8a562bf4a1a6e9abb2707c5 Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Wed, 29 Apr 2026 14:36:12 -0400 Subject: [PATCH 6/6] Update docs/reference/advanced-settings-space.yml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- docs/reference/advanced-settings-space.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/advanced-settings-space.yml b/docs/reference/advanced-settings-space.yml index ede552a1ee47b..f09c944abd80f 100644 --- a/docs/reference/advanced-settings-space.yml +++ b/docs/reference/advanced-settings-space.yml @@ -2157,7 +2157,7 @@ groups: self: ga security: ga - - setting: "securitySolution:includedDataStreamNamespacesForRuleExecution" + - setting: "securitySolution:includedDataStreamNamespacesForRuleExecution" id: security-solution-included-data-stream-namespaces-for-rule-execution description: | When configured, the setting restricts which documents detection rules search. Only events whose `data_stream.namespace` field matches one of the specified namespaces are queried. This applies to all detection rules in the {{kib}} space and acts like a global filter on `data_stream.namespace`. Specify an array of namespace strings (for example, `["namespace1", "namespace2"]`). You can configure up to 50 namespaces. Empty by default (searches all namespaces).