Feature availability and scope
Self-Healing Pipelines are available on primary search heads, as well as on Enterprise Security (ES) search heads.
Availability by region
Self-healing pipelines are available in the following cloud provider regions:
| Region | LLM model | Cross-regional calls |
|---|---|---|
| us-east-1 | GPT-5.4 | us-west-2 |
| us-west-2 | GPT-5.4 | us-east-1 |
| eu-central-1 | GPT-5.4 | eu-west-1, eu-west-3, eu-south-1 |
| eu-west-1 | GPT-5.4 | eu-west-3, eu-south-1, eu-central-1 |
| eu-west-3 | GPT-5.4 | eu-west-1, eu-south-1, eu-central-1 |
| eu-south-1 | GPT-5.4 | eu-west-1, eu-west-3, eu-central-1 |
Availability on primary search heads versus Enterprise Security search heads
-
Primary search heads: You can access the full set of Ingest Monitoring app features, including dashboards, scheduled searches, and all alert templates including Common Information Model (CIM) alerts.
-
Enterprise Security (ES) search heads: The app allows access to only the Self-Healing Pipeline feature. Dashboards, scheduled searches, and other alert templates are not available on ES search heads.
Any alert rules configured on a search head are local to that node and won't be available on the other search heads. This means the CIM alerts rules created or triggered from an ES search head are not accessible on your primary search head. Additionally, CIM alerts rules created or triggered from your primary search head are not accessible on your ES search head.