Advanced data source configuration

These pages cover deployment-level data settings that affect detection rule behavior. Unlike per-rule data source settings, which apply to individual rules, the configurations below affect how your entire environment interacts with the detection engine.

Most users don't need these pages during initial setup. Review them if any of the following apply to your environment:

Cross-cluster search and detection rules Stack The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Relevant if your data is spread across multiple Elasticsearch clusters and you need detection rules on one cluster to query indices on another. Covers establishing trust between clusters, remote cluster connections, and how to reference remote indices in rule index patterns.

Cross-project search and detection rules Serverless Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Relevant if you use cross-project search to query data across linked Serverless projects. Explains which projects a rule searches, where its alerts are stored, and how the alert limit applies across them.

Using logsdb index mode with Elastic Security

Relevant if your indices use logsdb index mode (enabled by default in Serverless). Explains how synthetic _source reconstruction can affect field formatting in alerts and rule queries, and what to watch for when writing rules against logsdb-backed indices.