---
title: Detections requirements
description: To use the Detections feature, you first need to configure a few settings. You also need the appropriate Elastic Stack subscription or Serverless project...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4501/solutions/security/detect-and-alert/detections-requirements
products:
  - Elastic Cloud Serverless
  - Elastic Security
---

# Detections requirements
To use the [Detections feature](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4501/solutions/security/detect-and-alert), you first need to configure a few settings. You also need the appropriate [Elastic Stack subscription](https://www.elastic.co/pricing) or [Serverless project feature tier](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4501/deploy-manage/deploy/elastic-cloud/project-settings) to send [notifications](/elastic/docs-content/pull/4501/solutions/security/detect-and-alert/create-detection-rule#rule-notifications) when detection alerts are generated. Additionally, there are some [advanced settings](#adv-list-settings) used to configure Kibana [value list](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4501/solutions/security/detect-and-alert/create-manage-value-lists) upload limits.
<important>
  Several steps are **only** required for **self-managed** Elastic Stack deployments. If you’re using an Elastic Cloud deployment, you only need to [enable detections](#enable-detections-ui).
</important>


## Configure self-managed Elastic Stack deployments

```yaml
  deployment:
    self:
```

These steps are only required for **self-managed** deployments:
- HTTPS must be configured for communication between [Elasticsearch and Kibana](/elastic/docs-content/pull/4501/deploy-manage/security/set-up-basic-security-plus-https#encrypt-kibana-http).
- In [`kibana.yml`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4501/deploy-manage/stack-settings):
  Add the `xpack.encryptedSavedObjects.encryptionKey` setting with any alphanumeric value of at least 32 characters. For example:
  `xpack.encryptedSavedObjects.encryptionKey: 'fhjskloppd678ehkdfdlliverpoolfcr'`
- In [`elasticsearch.yml`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4501/deploy-manage/deploy/self-managed/configure-elasticsearch):
  - Set the `xpack.security.enabled` setting to `true`. Refer to [General security settings](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/elasticsearch/configuration-reference/security-settings#general-security-settings) for more information.
- If the `search.allow_expensive_queries` setting is set to `false`, remove it. If set to its default value of `true` or not included in the `elasticsearch.yml` file, you don't need to make changes. This setting must be `true` for key detection features, such as [alerting rules](/elastic/docs-content/pull/4501/explore-analyze/alerts-cases/alerts/alerting-setup#alerting-prerequisites) and rule exceptions, to work.

<important>
  After changing the `xpack.encryptedSavedObjects.encryptionKey` value and restarting Kibana, you must restart all detection rules.
</important>


## Enable and access detections

```yaml
stack: ga
serverless: ga
```

To use the Detections feature, it must be enabled, your role must have access to rules and alerts, and your Kibana space must have **Data View Management** [feature visibility](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4501/deploy-manage/manage-spaces). If your role doesn’t have the cluster and index privileges needed to enable this feature, you can request someone who has these privileges to visit your Kibana space, which will turn it on for you.
<note>
  For instructions about using machine learning jobs and rules, refer to [Machine learning job and rule requirements](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4501/solutions/security/advanced-entity-analytics/machine-learning-job-rule-requirements).
</note>


### Custom role privileges


| Action                                                                                                                                                                                                   | Cluster Privileges | Index Privileges                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | Kibana Privileges                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Enable detections in your space                                                                                                                                                                          | `manage`           | `manage`, `write`, `read`, and `view_index_metadata` for these system indices and data streams, where `<space-id>` is the space name:- `.alerts-security.alerts-<space-id>`- `.siem-signals-<space-id>` ^1^- `.lists-<space-id>`- `.items-<space-id>`^1^ **NOTE**: If you’re upgrading to Elastic Stack 8.0.0 or later, users should have privileges for the `.alerts-security.alerts-<space-id>` AND `.siem-signals-<space-id>` indices. If you’re newly installing the Elastic Stack, then users do not need privileges for the `.siem-signals-<space-id>` index.                                                                                                                                                                                | - `stack: ga 9.0`: `All` for the `Security` feature - `stack: ga 9.3` `serverless: ga`: `All` for the `Rules` feature                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Enable detections in all spaces**NOTE**: To turn on detections, visit the Rules and Alerts pages for each space.                                                                                         | `manage`           | `manage`, `write`, `read`, and `view_index_metadata` for these system indices and data streams:- `.alerts-security.alerts-<space-id>`- `.siem-signals-<space-id>` ^1^- `.lists-<space-id>`- `.items-<space-id>`^1^ **NOTE**: If you’re upgrading to Elastic Stack 8.0.0 or later, users should have privileges for the `.alerts-security.alerts-<space-id>` AND `.siem-signals-<space-id>` indices. If you’re newly installing the Elastic Stack, then users do not need privileges for the `.siem-signals-<space-id>` index.                                                                                                                                                                                                                      | - `stack: ga 9.0`: `All` for the `Security` feature - `stack: ga 9.3` `serverless: ga`: `All` for the `Rules` feature                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Preview rules                                                                                                                                                                                            | N/A                | `read` for these indices:- `.preview.alerts-security.alerts-<space-id>`- `.internal.preview.alerts-security.alerts-<space-id>-*`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | - `stack: ga 9.0`: `All` for the `Security` feature - `stack: ga 9.3` `serverless: ga`: `All` for the `Rules` feature                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Manage rules                                                                                                                                                                                             | N/A                | `manage`, `write`, `read`, and `view_index_metadata` for these system indices and data streams, where `<space-id>` is the space name:- `.alerts-security.alerts-<space-id>`- `.siem-signals-<space-id>`^1^- `.lists-<space-id>`- `.items-<space-id>`^1^ **NOTE**: If you’re upgrading to Elastic Stack 8.0.0 or later, users should have privileges for the `.alerts-security.alerts-<space-id>` AND `.siem-signals-<space-id>` indices. If you’re newly installing the Elastic Stack, then users do not need privileges for the `.siem-signals-<space-id>` index.                                                                                                                                                                                 | - `stack: ga 9.0`: `All` for the `Security` feature - `stack: ga 9.3` `serverless: ga`: `All` for the `Rules` feature**NOTE:** You need additional `Action and Connectors` feature privileges (**Management → Action and Connectors**) to manage rules with actions and connectors:- To provide full access to rule actions and connectors, give your role `All` privileges. With `Read` privileges, you can edit rule actions, but will have limited capabilities to manage connectors. For example, `Read` privileges allow you to add or remove an existing connector from a rule, but does not allow you to create a new connector.- To import rules with actions, you need at least `Read` privileges for the `Action and Connectors` feature. To overwrite or add new connectors, you need `All` privileges for the `Actions and Connectors` feature. To import rules without actions,  you don’t need `Actions and Connectors` privileges. |
| Manage alerts**NOTE**: Allows you to manage alerts, but not modify rules.                                                                                                                                | N/A                | `maintenance`, `write`, `read`, and `view_index_metadata` for these system indices and data streams, where `<space-id>` is the space name:- `.alerts-security.alerts-<space-id>`- `.internal.alerts-security.alerts-<space-id>-*`- `.siem-signals-<space-id>`^1^- `.lists-<space-id>`- `.items-<space-id>` **NOTE**: Before a user can be assigned to a case, they must log into Kibana at least once, which creates a user profile.^1^ **NOTE**: If you’re upgrading to Elastic Stack 8.0.0 or later, users should have privileges for the `.alerts-security.alerts-<space-id>` AND `.siem-signals-<space-id>` indices. If you’re newly installing the Elastic Stack, then users do not need privileges for the `.siem-signals-<space-id>` index. | - `stack: ga 9.0`: `All` for the `Security` feature - `stack: ga 9.3` `serverless: ga`: `All` for the `Rules` feature **NOTE:** Alerts are managed through Elasticsearch index privileges. To view the alert management flows requires at least the `Read` for the `Rules` feature.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Manage exceptions                                                                                                                                                                                        | N/A                | N/A                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | - `stack: ga 9.0`: `All` for the `Security` feature - `stack: ga 9.3` `serverless: ga`: `All` for the `Rules` feature                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Manage value lists.Create the `.lists` and `.items` data streams in your space**NOTE**: To initiate the process that creates the data streams, you must visit the Rules page for each appropriate space. | `manage`           | `manage`, `write`, `read`, and `view_index_metadata` for these data streams, where `<space-id>` is the space name:- `.lists-<space-id>`- `.items-<space-id>`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | - `stack: ga 9.0`: `All` for the `Security` feature - `stack: ga 9.3` `serverless: ga`: `All` for the `Rules` and `Saved Objects Management` features                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |


### Predefined Elastic Cloud Serverless roles

```yaml
serverless: ga
```


| Action                               | Predefined role                                                                                                                                |
|--------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------|
| Manage rules                         | - Threat Intelligence Analyst- Tier 3 Analyst- Detections Eng- SOC Manager- Endpoint Policy Manager- Tier 3 Analyst- Platform Engineer- Editor |
| Rules read only                      | - Tier 1 Analyst- Tier 2 Analyst- Viewer- Endpoint Operations Analyst                                                                          |
| Manage alerts                        | - All roles except for Viewer                                                                                                                  |
| Manage exceptions and value lists    | - Threat Intelligence Analyst- Tier 3 Analyst- Detections Eng- SOC Manager- Endpoint Policy Manager- Tier 3 Analyst- Platform Engineer- Editor |
| Exceptions and value lists read only | - Tier 1 Analyst- Tier 2 Analyst- Viewer- Endpoint Operations Analyst                                                                          |


### Authorization

```yaml
stack:
```

Rules, including all background detection and the actions they generate, are authorized using an [API key](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4501/deploy-manage/api-keys/elasticsearch-api-keys) associated with the last user to edit the rule. Upon creating or modifying a rule, an API key is generated for that user, capturing a snapshot of their privileges. The API key is then used to run all background tasks associated with the rule including detection checks and executing actions.
<important>
  If a rule requires certain privileges to run, such as index privileges, keep in mind that if a user without those privileges updates the rule, the rule will no longer function.
</important>


## Configure list upload limits

```yaml
stack:
```

You can set limits to the number of bytes and the buffer size used to upload [value lists](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4501/solutions/security/detect-and-alert/create-manage-value-lists) to Elastic Security.
To set the value:
1. Open [`kibana.yml`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4501/deploy-manage/stack-settings) [configuration file](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/configuration-reference/general-settings) or edit your Kibana cloud instance.
2. Add any of these settings and their required values:
   - `xpack.lists.maxImportPayloadBytes`: Sets the number of bytes allowed for uploading Elastic Security value lists (default `9000000`, maximum `100000000`). For every 10 megabytes, it is recommended to have an additional 1 gigabyte of RAM reserved for Kibana.
  For example, on a Kibana instance with 2 gigabytes of RAM, you can set this value up to 20000000 (20 megabytes).
- `xpack.lists.importBufferSize`: Sets the buffer size used for uploading Elastic Security value lists (default `1000`). Change the value if you’re experiencing slow upload speeds or larger than wanted memory usage when uploading value lists. Set to a higher value to increase throughput at the expense of using more Kibana memory, or a lower value to decrease throughput and reduce memory usage.