Feature availability and scope
This feature is available on primary search heads, as well as on Enterprise Security (ES) search heads.
Availability by region
Self-healing pipelines are available in the following cloud provider regions:
| Region | LLM model | Cross-regional calls |
|---|---|---|
| us-east-1 | GPT-5.4 | us-west-2 |
| us-west-2 | GPT-5.4 | us-east-1 |
| eu-central-1 | GPT-5.4 | eu-west-1, eu-west-3, eu-south-1 |
| eu-west-1 | GPT-5.4 | eu-west-3, eu-south-1, eu-central-1 |
| eu-west-3 | GPT-5.4 | eu-west-1, eu-south-1, eu-central-1 |
| eu-south-1 | GPT-5.4 | eu-west-1, eu-west-3, eu-central-1 |
Availability on primary search heads versus Enterprise Security search heads
-
Primary search heads: The full Ingest Monitoring app features are available, including dashboards, scheduled searches, and all alert templates including CIM alerts.
-
Enterprise Security (ES) search heads: The app is trimmed down to only the Self-Healing Pipeline feature. Dashboards, scheduled searches, and other alert templates are not available on ES search heads.
Any alert rules configured on a search head are local to that node and won't be available on the other search heads. This means the CIM alerts rules created or triggered from an ES search head are not accessible on your primary search head. Additionally, CIM alerts rules created or triggered from your primary search head are not accessible on your ES search head.