Skip to content

Document Security Analytics query restrictions - #13456

Closed
cwperks wants to merge 2 commits into
opensearch-project:mainfrom
cwperks:document-security-analytics-query-restriction
Closed

cwperks wants to merge 2 commits into
opensearch-project:mainfrom
cwperks:document-security-analytics-query-restriction

Conversation

@cwperks

@cwperks cwperks commented Nov 4, 2026

Copy link
Copy Markdown
Member

Summary

Documents the authorization and query constraints introduced by opensearch-project/security-analytics#1760.

  • States that Security Analytics mappings APIs require index-level mapping permission for index_name.
  • States that Security Analytics search APIs reject terms lookup objects and return 403 Forbidden; inline terms remain supported.
  • Corrects the threat intelligence monitor search example to use /_plugins/_security_analytics/threat_intel/monitors/_search.

Validation

  • Verified front matter and balanced Markdown fences for every changed page.
  • bundle exec jekyll build --trace is blocked locally by the installed Ruby 3.4.0 native google-protobuf extension failing to load (ruby_abi_version symbol missing).

Follow-up

The version-specific release notes and advisory publication should be coordinated with the Security Analytics release and security-response process.

Document the index-level permissions required by mapping APIs and
that Security Analytics search APIs reject terms lookup queries.
Correct the threat intelligence monitor search endpoint.

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@github-actions github-actions Bot added the Tech review PR: Tech review in progress label Nov 4, 2026
@github-actions

github-actions Bot commented Nov 4, 2026

Copy link
Copy Markdown

Thank you for submitting your PR. The PR states are In progress (or Draft) -> Tech review -> Doc review -> Merged.

Before you submit your PR for doc review, make sure the content is technically accurate. If you need help finding a tech reviewer, tag a maintainer.

When you're ready for doc review, tag the assignee of this PR. The doc reviewer may push edits to the PR directly or leave comments and editorial suggestions for you to address (let us know in a comment if you have a preference).

@kolchfa-aws kolchfa-aws added Doc review PR: Doc review in progress backport 3.9 and removed Tech review PR: Tech review in progress labels Nov 4, 2026
Signed-off-by: Fanit Kolchina <kolchfa@amazon.com>
@kolchfa-aws kolchfa-aws mentioned this pull request Nov 5, 2026
1 task done
@cwperks cwperks closed this Nov 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport 3.9 Doc review PR: Doc review in progress

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants