search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.73k stars 8.14k forks source link

[Security Solution] Index cleanup on deleting space #175616

Open e40pud opened 8 months ago

e40pud commented 8 months ago

Enhancement:

Related SDH: https://github.com/elastic/sdh-security-team/issues/839

One of our users asked if they can safely remove space related indices after they deleted a space. Historically, we've never removed those indices and left them in case user need them in case of restoring data.

Here are the details of what is being removed one deleting space from the core team:

If a saved object only exists in that space, it will be deleted. If a SO is shared with the space and other spaces, it will still exist after the space is deleted. Please keep in mind that elasticsearch indices are not saved objects. In Kibana, data views are. Since indices are not SO, we never remove them.

It would be nice to allow users to decide whether they want to purge all space related data or just do that by default.

cc @yctercero @paulewing

elasticmachine commented 8 months ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 7 months ago

Pinging @elastic/security-detection-engine (Team:Detection Engine)