[DOCS] Detection engine/cold tier data - 7.11

[jmikell821]

Addresses #446.

Preview link.

[jmikell821]

@oatkiller @MikePaquette is there anything else I need to add here?

[MikePaquette]

Thanks @jmikell821 this is looking good.

If detection rules run with data stored in this tier, it likely will impact performance and speed.

This sentence could be clarified - are we providing more information the the cases that are supported, or are we saying what will happen if they run cold tier on unsupported indices?

[jmikell821]

Thanks @jmikell821 this is looking good.

If detection rules run with data stored in this tier, it likely will impact performance and speed.

This sentence could be clarified - are we providing more information the the cases that are supported, or are we saying what will happen if they run cold tier on unsupported indices?

Hi @MikePaquette -- I'm not sure what else would happen beyond a sluggish performance if they ran cold tier on unsupported indices -- I suppose there could be a potential bug of the rule not executing but I don't want to assume. @oatkiller can you provide some more context please to Mike's question?

[MikePaquette]

If detection rules run with data stored in this tier, it likely will impact performance and speed.

@jmikell821 sorry my previous comment was not very clear. I am asking that we tighten up that sentence because it is not clear to the reader what was meant by run with data stored in this tier. The reader may wonder how does run with data stored in this tier relate to the two lists you just gave me above?

Suggestion 1): delete the sentence. (We've already said what's supported and what's not supported, do we need to elaborate?)
Suggestion 2): modify sentence as: "Using cold tier data for unsupported indices may result in detection rule timeouts and overall performance degradation."

[MikePaquette]

One more suggestion @jmikell821, since this notice and topic is not strictly limited to the operation of the detection engine, can we either move it to or replicate it in the Elastic Security system requirements section?

[oatkiller]

Thanks!