[Security][CPS] Document detection rule behavior and correct app availability by nastasha-solomon · Pull Request #8064 · elastic/docs-content

nastasha-solomon · 2026-08-24T21:46:33Z

Summary

Contributes to #8050.

Corrects the cross-project search (CPS) availability information for Elastic Security apps and documents rule-level CPS behavior ahead of GA.

Previews

CPS availability in Elastic Security apps - Corrected and expanded the availability list. (The same snippet also renders on Configure CPS.) Made the following changes to the section and moved the info into a table to align the format used for Kibana and Observability:
- Added detection rules – Origin rules query linked projects and generate alerts on the origin.
- Added that the max alerts per run cap applies across all linked projects a rule covers.
- Added the Cloud identity requirement – Rules run with the API key of the user who created or last updated them. Elasticsearch API keys and local users are origin-scoped, so those rules don't search linked projects and can skip with a matching-indices warning. Called this out for migration and automation.
- Corrected the Entity store entry – Origin retrieval includes linked-project entity data; store build, risk scoring, and unification stay per project.
- Corrected Defend and Osquery – No longer origin-only. Reads data across linked projects.
- Corrected Explore and Overview – These pages show linked-project data. Session View flyouts are not supported.
- Added machine learning – Anomaly detection datafeeds and transforms can read linked-project data. ML rules alert on those anomalies. Jobs and results live on the origin.
- Added Cases to the origin-scoped list – Attaching linked-project alerts is not supported.
- Added the Value Report and SIEM Readiness features to the origin-scoped list - Requested in Slack.
CPS and detection rules — Expands the detection-rules row. The intro snippet also renders on Observability Create and manage rules, and states space default, read-only selector, and query-level overrides inline:
- Which projects a rule searches and where alerts are stored - Origin rules search the space-level scope and write alerts to the origin. The origin Alerts page does not show alerts a linked project generated on its own.
- Which linked projects a rule can access - Kibana creates an API key with a snapshot of the editor's role assignments. Elasticsearch API keys used through the API skip linked projects (with a matching-indices warning) or run origin-only with no warning.
- How the alert limit applies across linked projects - Max alerts per run is a combined cap across the origin and linked projects in the space-level scope.
- CPS context in alerts and the event log - Scope fields recorded on alerts and in the event log.
Common rule settings - Max alerts per run notes that, with CPS enabled, the limit covers combined results from the origin and linked projects in the space-level scope, with a link to the full explanation.

Deliberately not included

The "Using cross-project search with Elastic Security" guidance page (item 2 of #8050) is not included as it's not a blocker to CPS GA'ing. It will be added in a separate PR.

Lifecycle note

CPS pages remain at serverless: preview. Flipping them to GA is intentionally left to a separate PR. The one inline {applies_to} tag added here, on Max alerts per run, will need to flip with them.

Generative AI disclosure

Did you use a generative AI (GenAI) tool to assist in creating this contribution?

Yes - Cursor + Claude Opus
No

github-actions · 2026-08-24T21:47:08Z

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

github-actions · 2026-08-24T21:57:11Z

🔍 Preview links for changed docs

github-actions · 2026-08-24T21:57:15Z

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

Co-authored-by: Cursor <cursoragent@cursor.com>

shainaraskas

hello thank you!

overall thoughts:

I think it would be good if we could be clearer about when things use the space scope
We can probably cut back/unify some of the info about API keys on rules - it reads as pretty cohesive between the two surfaces now and we should probably just document what is different about detection rules in this spot

shainaraskas · 2026-08-26T18:57:00Z

+    :::
+
+- **{{ml-cap}}:** {{anomaly-detect-cap}} job {{dfeeds}} and transforms can read data from linked projects. Jobs and results live on the origin project. {{ml-cap}} rules alert on those origin results, including anomalies produced from linked-project data.
 - **Timeline:** Tables display documents from linked projects. Actions that don't apply to remote documents are disabled.


is this using the space scope?

@PhilippeOberti @michaelolo24 does Timeline always use the space’s default CPS scope, or can it follow the CPS scope selector selection in the project's header? For reference, here's the latest draft.

shainaraskas · 2026-08-26T18:57:22Z

 - **Dashboards:** The Detection & Response and Data Quality dashboards support {{cps-init}}.
 - **Intelligence:** Threat intelligence indicator searches support {{cps-init}}.


space scope?

@chuddy-elastic who can clarify whether the threat intel features always use the space’s default CPS scope, or can follow the CPS scope selector selection in the project's header? For reference, here's the latest draft.

shainaraskas

also avoid remote

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

…y-security-apps.md Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

shainaraskas

looking nice! a couple of considerations for you about the table columns and some questions about rule scope.

the cutback on the API keys stuff for rules is looking especially nice 🎉

shainaraskas · 2026-08-31T16:43:12Z

- **Attack Discovery**: AI-generated attack discoveries are based on alerts from the origin project only.
- **Overview**: The Security Overview page reflects data from the origin project only.
- **Defend and Osquery**: Elastic Defend and Osquery are scoped to the origin project only. Defend and Osquery are managed through Fleet, meaning their configuration is tied to a single project. Endpoint artifacts, policies, response actions, and Osquery saved queries and packs are managed per project and are not shared across linked projects.
+| App | {{cps-init}} scope selector | Query-level overrides |


I think using the query-level overrides column for some of these details can lead to a little confusion. looking at the ML row specifically, the details in the query-level overrides are mostly about how CPS is supported in the feature. consider moving this to another column, or renaming the column to something like "Details" since only one of your features support query-level overrides (nor would we expect the others to).

the pattern observability uses is that it defers these details to a dedicated page. that's an option but perhaps too heavy

shainaraskas · 2026-08-31T16:47:00Z


 **[{{cps-cap}} and detection rules](/solutions/security/detect-and-alert/cross-project-search-detection-rules.md)**
-:   Relevant if you use {{cps}} to query data across linked {{serverless-short}} projects. Explains how detection rules use the space-level {{cps}} scope and how to use project routing to target specific projects. {{serverless-short}} only.
+:   Relevant if you use {{cps}} to query data across linked {{serverless-short}} projects. Explains which projects a rule searches, where its alerts are stored, how last-editor access affects linked-project searches, and how the alert limit applies across them. {{serverless-short}} only.


we're talking about "last-editor access" like it's a known entity but I think this might be [AI(?)] trying to come up with unnecessary shorthand - perhaps a little hard to parse for people who don't already understand. perhaps an unnecessary level of detail here as well - we don't have to name every single thing on the page

shainaraskas · 2026-08-31T16:48:05Z

@@ -19,7 +19,7 @@ Most users don't need these pages during initial setup. Review them if any of th
 :   Relevant if your data is spread across multiple {{es}} clusters and you need detection rules on one cluster to query indices on another. Covers establishing trust between clusters, remote cluster connections, and how to reference remote indices in rule index patterns. {{stack}} only.

 **[{{cps-cap}} and detection rules](/solutions/security/detect-and-alert/cross-project-search-detection-rules.md)**


consider making the "elastic stack only" and "serverless only" notes badges on the "link" line

Suggested change

**[{{cps-cap}} and detection rules](/solutions/security/detect-and-alert/cross-project-search-detection-rules.md)**

**[{{cps-cap}} and detection rules](/solutions/security/detect-and-alert/cross-project-search-detection-rules.md)** {applies_to}`serverless: ga` {applies_to}`stack: unavailable`

or just

Suggested change

**[{{cps-cap}} and detection rules](/solutions/security/detect-and-alert/cross-project-search-detection-rules.md)**

**[{{cps-cap}} and detection rules](/solutions/security/detect-and-alert/cross-project-search-detection-rules.md)** {applies_to}`serverless: ga`

shainaraskas · 2026-08-31T16:49:54Z

@@ -1,15 +1,22 @@
-{{elastic-sec}} apps have partial {{cps-init}} support. The following features work across linked projects:
+{{elastic-sec}} apps have partial {{cps-init}} support. The following table shows which apps support the {{cps-init}} scope selector and query-level overrides.


this sentence isn't necessarily describing the table contents right now

shainaraskas · 2026-08-31T16:52:48Z

+If you create or update a rule through the API with an {{es}} API key, the rule keeps that credential and searches the origin project only:
+
+- If the origin project has no matching indices, the rule doesn't run and its last-run status shows a warning.
+- If those patterns exist on the origin, the rule still runs and reports success, but it searches the origin only. There's no warning for that.


nit: "there's no warning for that" reads a little casual to my eye

shainaraskas · 2026-08-31T16:54:47Z

+
+The **Max alerts per run** [advanced setting](/solutions/security/detect-and-alert/common-rule-settings.md#rule-ui-advanced-params) limits the number of alerts a rule creates in a single execution. Under {{cps}}, that limit covers the combined results from the origin project and all linked projects in the space-level scope rather than each project separately. The default is 100.
+
+A rule that stayed comfortably under the limit on a single project can reach it once you link projects, which leaves matches without alerts. Review the limit for rules that run across a broad scope, and consider [narrowing the scope with project routing](/explore-analyze/cross-project-search/cross-project-search-project-routing.md) instead of raising the limit.


"it" in "A rule that stayed comfortably under the limit on a single project can reach it" is not clear

narrowing the scope with project routing

how do you do this for rules? can you possibly connect this to where the person can input a query in rule creation (or is this very very obvious?)

shainaraskas · 2026-08-31T16:57:47Z

 **Max alerts per run** (optional)
 :   Specify the maximum number of alerts the rule can create each time it executes. Default is 100.

+    {applies_to}`serverless: preview` When {{cps}} is enabled, this limit covers the combined results from the origin project and all linked projects in the space-level scope rather than each project separately. Refer to [{{cps-cap}} and detection rules](/solutions/security/detect-and-alert/cross-project-search-detection-rules.md#cps-rules-max-alerts).


🤔 if we can limit the scope with project routing, is this exactly true? or is it the scope of the query, which is by default the same as the space-level scope unless there's a query-level override?

shainaraskas · 2026-08-31T17:02:48Z

@@ -1,10 +1,13 @@

-When [{{cps}}](/explore-analyze/cross-project-search.md) is enabled and you have [linked projects](/deploy-manage/cross-project-search-config/cps-config-link-and-manage.md), rules query data across linked projects based on the **space-level {{cps}} scope**.
+When [{{cps}}](/explore-analyze/cross-project-search.md) is enabled and you have [linked projects](/deploy-manage/cross-project-search-config/cps-config-link-and-manage.md), rules query data across linked projects based on the **space-level {{cps}} scope**. You can't set a {{cps}} scope on individual rules.


You can't set a cross-project search scope on individual rules.

this seems to clash with the paragraphs below, which say that you can override with SET project_routing, and use a qualified index expression to limit results (if not query scope). maybe easier to say "most rules can't blah blah" and treat esql and index pattern rules as exceptions?

shainaraskas · 2026-08-31T17:03:58Z

-For prerequisites such as linking projects and configuring default scope, refer to [{{cps-cap}}](/explore-analyze/cross-project-search.md) and [Configure {{cps}} access and scope](/deploy-manage/cross-project-search-config/cps-config-access-and-scope.md). 
+For {{esql}} rules, you can use [`SET project_routing`](/explore-analyze/cross-project-search/cross-project-search-project-routing.md) in the rule query to target specific linked projects, overriding the space-level scope. For non-{{esql}} rules that use index patterns, you can use [qualified index expressions](/explore-analyze/cross-project-search/cross-project-search-search.md#search-expressions) to scope the rule to specific projects.
+
+For prerequisites such as linking projects and configuring default scope, refer to [{{cps-cap}}](/explore-analyze/cross-project-search.md) and [Configure {{cps}} access and scope](/deploy-manage/cross-project-search-config/cps-config-access-and-scope.md).


no need to spell out the title of the page here

Suggested change

For prerequisites such as linking projects and configuring default scope, refer to [{{cps-cap}}](/explore-analyze/cross-project-search.md) and [Configure {{cps}} access and scope](/deploy-manage/cross-project-search-config/cps-config-access-and-scope.md).

For prerequisites such as linking projects and configuring default scope, refer to [](/explore-analyze/cross-project-search.md) and [](/deploy-manage/cross-project-search-config/cps-config-access-and-scope.md).

shainaraskas · 2026-08-31T17:06:03Z

 :::{note}
-{{ml-cap}} rules don't support {{cps}}; they search data in the origin project only. Other features also have limited or no {{cps}} support. For details, refer to [{{cps-cap}} availability by app](/explore-analyze/cross-project-search/cross-project-search-manage-scope.md#cps-availability).
+<!-- TODO: After https://github.com/elastic/docs-content/pull/7814 merges, restore the link on "can read linked-project data" to /explore-analyze/machine-learning/anomaly-detection/ml-ad-run-jobs.md#ml-ad-cps-scope. -->
+{{ml-cap}} rules alert on {{anomaly-detect}} results stored on the origin project. {{anomaly-jobs-cap}} can read linked-project data; jobs and results stay on the origin. Other features also have limited or no {{cps}} support. For details, refer to [{{cps-cap}} availability by app](/explore-analyze/cross-project-search/cross-project-search-manage-scope.md).


is this note about "other features have no support" needed here?

would we consider pulling the ml rule into the main text, so we could shape it like

"most don't let you select scope, here are the exceptions:

es|ql set project_routing

index patterns qualified expressions

ml rules are scoped at ad job level"

shainaraskas · 2026-08-31T17:17:47Z

this looks very similar to the stuff on create-manage-rules now ... should they all use a single snippet?

https://github.com/elastic/docs-content/blob/main/explore-analyze/alerting/alerts/create-manage-rules.md?plain=1#L46

shainaraskas · 2026-08-31T17:49:20Z


 If your data spans ECH, ECE, ECK, or self-managed clusters rather than linked {{serverless-short}} projects, refer to [{{ccs-cap}} and detection rules](/solutions/security/detect-and-alert/cross-cluster-search-detection-rules.md) instead.

+## Which projects a rule searches and where alerts are stored [cps-rules-scope-and-alerts]


is this stuff covered in the core alerting/rules docs?

first draft

4209cce

nastasha-solomon self-assigned this Aug 24, 2026

github-actions Bot deployed to docs-preview August 24, 2026 21:59 View deployment

Merge branch 'main' into issue-8050

3dff21c

github-actions Bot deployed to docs-preview August 25, 2026 17:10 View deployment

Merge branch 'main' into issue-8050

8a4589a

github-actions Bot deployed to docs-preview August 25, 2026 23:00 View deployment

additional edits

36f2c66

nastasha-solomon marked this pull request as ready for review August 25, 2026 23:53

nastasha-solomon requested review from a team as code owners August 25, 2026 23:53

nastasha-solomon requested review from PhilippeOberti, chuddy-elastic, roxana-gheorghe, tiamliu and yctercero August 25, 2026 23:53

github-actions Bot deployed to docs-preview August 25, 2026 23:56 View deployment

nastasha-solomon commented Aug 26, 2026

View reviewed changes

Comment thread deploy-manage/_snippets/cps-limitations-core.md

nastasha-solomon and others added 2 commits August 25, 2026 20:12

Merge branch 'main' into issue-8050

5d9d0ed

remove comment

0388165

github-actions Bot deployed to docs-preview August 26, 2026 00:16 View deployment

nastasha-solomon requested a review from shainaraskas August 26, 2026 00:21

nastasha-solomon mentioned this pull request Aug 26, 2026

[Internal]: CPS × Security docs for GA: correct the availability-by-app section + add a "CPS for Elastic Security" guidance page #8050

Open

Add Value report and SIEM Readiness to origin-project-scoped features

ffc05eb

github-actions Bot deployed to docs-preview August 26, 2026 00:44 View deployment

Remove accidentally committed docs-builder-mac-arm64.zip.

d52ada3

Co-authored-by: Cursor <cursoragent@cursor.com>

github-actions Bot deployed to docs-preview August 26, 2026 18:19 View deployment

shainaraskas reviewed Aug 26, 2026

View reviewed changes

Comment thread explore-analyze/cross-project-search/_snippets/cps-availability-security-apps.md Outdated

Comment thread explore-analyze/cross-project-search/_snippets/cps-availability-security-apps.md Outdated

nastasha-solomon and others added 6 commits August 26, 2026 16:17

Update solutions/_snippets/cps-sec-obs-rules.md

8b89a4f

Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update explore-analyze/cross-project-search/_snippets/cps-availabilit…

220da37

…y-security-apps.md Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update explore-analyze/cross-project-search/_snippets/cps-availabilit…

1a6078a

…y-security-apps.md Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

Update explore-analyze/cross-project-search/_snippets/cps-availabilit…

d7c184a

…y-security-apps.md Co-authored-by: shainaraskas <58563081+shainaraskas@users.noreply.github.com>

revert ref and add reminder

d06b056

Merge branch 'main' into issue-8050

267ba11

github-actions Bot deployed to docs-preview August 27, 2026 19:21 View deployment

Shaina's feedback

8687e7f

github-actions Bot deployed to docs-preview August 27, 2026 21:22 View deployment

nastasha-solomon requested a review from shainaraskas August 28, 2026 20:55

Merge branch 'main' into issue-8050

28c93a7

github-actions Bot deployed to docs-preview August 28, 2026 21:07 View deployment

shainaraskas reviewed Aug 31, 2026

View reviewed changes

		- Dashboards: The Detection & Response and Data Quality dashboards support {{cps-init}}.
		- Intelligence: Threat intelligence indicator searches support {{cps-init}}.

		@@ -19,7 +19,7 @@ Most users don't need these pages during initial setup. Review them if any of th
		: Relevant if your data is spread across multiple {{es}} clusters and you need detection rules on one cluster to query indices on another. Covers establishing trust between clusters, remote cluster connections, and how to reference remote indices in rule index patterns. {{stack}} only.

		[{{cps-cap}} and detection rules](/solutions/security/detect-and-alert/cross-project-search-detection-rules.md)

		@@ -1,15 +1,22 @@
		{{elastic-sec}} apps have partial {{cps-init}} support. The following features work across linked projects:
		{{elastic-sec}} apps have partial {{cps-init}} support. The following table shows which apps support the {{cps-init}} scope selector and query-level overrides.


		The Max alerts per run [advanced setting](/solutions/security/detect-and-alert/common-rule-settings.md#rule-ui-advanced-params) limits the number of alerts a rule creates in a single execution. Under {{cps}}, that limit covers the combined results from the origin project and all linked projects in the space-level scope rather than each project separately. The default is 100.

		A rule that stayed comfortably under the limit on a single project can reach it once you link projects, which leaves matches without alerts. Review the limit for rules that run across a broad scope, and consider [narrowing the scope with project routing](/explore-analyze/cross-project-search/cross-project-search-project-routing.md) instead of raising the limit.

		@@ -1,10 +1,13 @@

		When [{{cps}}](/explore-analyze/cross-project-search.md) is enabled and you have [linked projects](/deploy-manage/cross-project-search-config/cps-config-link-and-manage.md), rules query data across linked projects based on the space-level {{cps}} scope.
		When [{{cps}}](/explore-analyze/cross-project-search.md) is enabled and you have [linked projects](/deploy-manage/cross-project-search-config/cps-config-link-and-manage.md), rules query data across linked projects based on the space-level {{cps}} scope. You can't set a {{cps}} scope on individual rules.

	For prerequisites such as linking projects and configuring default scope, refer to [{{cps-cap}}](/explore-analyze/cross-project-search.md) and [Configure {{cps}} access and scope](/deploy-manage/cross-project-search-config/cps-config-access-and-scope.md).
	For prerequisites such as linking projects and configuring default scope, refer to [](/explore-analyze/cross-project-search.md) and [](/deploy-manage/cross-project-search-config/cps-config-access-and-scope.md).


		If your data spans ECH, ECE, ECK, or self-managed clusters rather than linked {{serverless-short}} projects, refer to [{{ccs-cap}} and detection rules](/solutions/security/detect-and-alert/cross-cluster-search-detection-rules.md) instead.

		## Which projects a rule searches and where alerts are stored [cps-rules-scope-and-alerts]

Uh oh!

Conversation

nastasha-solomon commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Previews

Deliberately not included

Lifecycle note

Generative AI disclosure

Uh oh!

github-actions Bot commented Aug 24, 2026

Elastic Docs AI PR menu

Uh oh!

github-actions Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

github-actions Bot commented Aug 24, 2026

✅ Elastic Docs Style Checker (Vale)

Uh oh!

Uh oh!

shainaraskas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nastasha-solomon Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nastasha-solomon Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

shainaraskas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

shainaraskas left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

nastasha-solomon commented Aug 24, 2026 •

edited

Loading

github-actions Bot commented Aug 24, 2026 •

edited

Loading

nastasha-solomon Aug 27, 2026 •

edited

Loading

nastasha-solomon Aug 27, 2026 •

edited

Loading