Documents how to change the default security index #4695

benironside · 2024-01-26T21:41:10Z

First pass at fixing #4653.

@e40pud please let me know what you think, if we should add any more info and if this addresses the need. Thanks!

github-actions · 2024-01-26T21:41:23Z

A documentation preview will be available soon.

Help us out by validating the Buildkite preview and reporting issues here.
Please also be sure to double check all images to ensure they are correct in the preview.

🔨 Buildkite builds
📚 HTML diff: Buildkite - Jenkins
📙 Preview: Buildkite - Jenkins
🧪 Buildkite vs Jenkins diff

Request a new doc build by commenting

Rebuild this PR: run docs-build
Rebuild this PR and all Elastic docs: run docs-build rebuild

_{run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.}

_{If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.}

e40pud · 2024-01-29T10:26:24Z

@benironside sorry, I did not really clarify well what docs we want to add. I updated the original ticket and added UPDATED section there:

It is not possible to change data view for the Alerts page and the data view for the page bound to .alerts-security.alerts-default index pattern.
Would be nice to add a docs note about that.

Let me know if you have questions about it.

e40pud

Thanks for putting this together!

nastasha-solomon

Looks great! Thanks, @benironside!

docs/getting-started/data-views-in-sec.asciidoc

nastasha-solomon · 2024-01-30T20:12:16Z

docs/getting-started/data-views-in-sec.asciidoc


 image::images/dataview-filter-example.gif[video showing how to filter the active data view]

 This only allows you to add index patterns that match indices that currently contain data (other index patterns are unavailable). Note that any changes made are saved in the current browser window and won't persist if you open a new tab.

-To permanently modify a {data-source}, delete an existing {data-source} or create a new one, you need the required permissions.
-To learn more, refer to {apm-app-ref}/data-views.html[{kib} {data-sources-cap}].
+NOTE: You cannot update the data view for the Alerts page. It always shows data from `.alerts-security.alerts-default`.


@e40pud can we tweak the UI copy so it aligns with this note? The current copy could be interpreted as: you must go elsewhere to update the data view for the Alerts page.

If it's still possible to change the copy, I'd suggest this:

You can't modify the data view for the Alerts page.

If that version is too blunt and overly formal, here's a slightly softer version:

This page's data view can't be adjusted.

It is not bound to Alerts page only. Same happens on rule details page. Also, there is another similar message that we show on the timeline. So, general message looks better to me.

Screen.Recording.2024-01-31.at.16.47.22.mov

Ah, interesting. Thanks for pointing out these other areas @e40pud -- I wasn't aware of them. Would it be ok if we continued this conversation in https://github.com/elastic/security-docs/issues/4718 so that we're not blocking this doc issue from being closed and merged?

Co-authored-by: Nastasha Solomon <[email protected]>

* First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 225f3c8) Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

* First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 225f3c8)

* First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 225f3c8) Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

) (#4731) * Documents how to change the default security index (#4695) * First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 225f3c8) # Conflicts: # docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

) (#4726) * Documents how to change the default security index (#4695) * First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 225f3c8) # Conflicts: # docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

…4695) (#4721) * Documents how to change the default security index (#4695) * First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 225f3c8) # Conflicts: # docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

) (#4730) * Documents how to change the default security index (#4695) * First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 225f3c8) # Conflicts: # docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

) (#4729) * Documents how to change the default security index (#4695) * First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 225f3c8) # Conflicts: # docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

) (#4722) * Documents how to change the default security index (#4695) * First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 225f3c8) # Conflicts: # docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

) (#4728) * Documents how to change the default security index (#4695) * First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 225f3c8) # Conflicts: # docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

) (#4727) * Documents how to change the default security index (#4695) * First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 225f3c8) # Conflicts: # docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

) (#4725) * Documents how to change the default security index (#4695) * First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 225f3c8) # Conflicts: # docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

) (#4724) * Documents how to change the default security index (#4695) * First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 225f3c8) # Conflicts: # docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

) (#4723) * Documents how to change the default security index (#4695) * First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 225f3c8) # Conflicts: # docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

Serverless follow up to #4695

* Add admonition to serverless Serverless follow up to #5513 * Update serverless to match ESS Serverless follow up to #4695 * Fix URL variable/attribute Should use `kibana-ref` instead of apm-app-ref since this has nothing to do with APM * No-op change to trigger build (i hope)

* Add admonition to serverless Serverless follow up to #5513 * Update serverless to match ESS Serverless follow up to #4695 * Fix URL variable/attribute Should use `kibana-ref` instead of apm-app-ref since this has nothing to do with APM * No-op change to trigger build (i hope) (cherry picked from commit 9e7d734) # Conflicts: # docs/serverless/explore/data-views-in-sec.mdx

…kport #5582) (#5586) * (Doc+) Alerts UI cannot be CCS [serverless] + bonus fixes (#5582) * Add admonition to serverless Serverless follow up to #5513 * Update serverless to match ESS Serverless follow up to #4695 * Fix URL variable/attribute Should use `kibana-ref` instead of apm-app-ref since this has nothing to do with APM * No-op change to trigger build (i hope) (cherry picked from commit 9e7d734) # Conflicts: # docs/serverless/explore/data-views-in-sec.mdx * Delete docs/serverless directory and its contents --------- Co-authored-by: Joe Peeples <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

…kport #5582) (#5585) * (Doc+) Alerts UI cannot be CCS [serverless] + bonus fixes (#5582) * Add admonition to serverless Serverless follow up to #5513 * Update serverless to match ESS Serverless follow up to #4695 * Fix URL variable/attribute Should use `kibana-ref` instead of apm-app-ref since this has nothing to do with APM * No-op change to trigger build (i hope) (cherry picked from commit 9e7d734) # Conflicts: # docs/serverless/explore/data-views-in-sec.mdx * Delete docs/serverless directory and its contents --------- Co-authored-by: Joe Peeples <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

) (#4729) * Documents how to change the default security index (#4695) * First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit eb7373e) # Conflicts: # docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

) (#4727) * Documents how to change the default security index (#4695) * First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit eb7373e) # Conflicts: # docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

) (#4730) * Documents how to change the default security index (#4695) * First draft * incorporates feedback * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/getting-started/data-views-in-sec.asciidoc Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit eb7373e) # Conflicts: # docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc * Update docs/getting-started/data-views-in-sec.asciidoc --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]>

First draft

760e85e

benironside added enhancement New feature or request v8.12.0 v8.13.0 labels Jan 26, 2024

benironside self-assigned this Jan 26, 2024

benironside requested a review from a team as a code owner January 26, 2024 21:41

benironside requested a review from e40pud January 26, 2024 21:41

benironside marked this pull request as draft January 30, 2024 17:11

incorporates feedback

c1bf4be

benironside added v8.0.0 v8.1.0 v8.2.0 v8.3.0 v8.4.0 v8.5.0 v8.6.0 v8.7.0 v8.8.0 v8.9.0 v8.10.0 labels Jan 30, 2024

benironside marked this pull request as ready for review January 30, 2024 17:56

e40pud previously approved these changes Jan 30, 2024

View reviewed changes

Merge branch 'main' into 4653-alert-defaultIndex-instructions

38eb1dc

nastasha-solomon reviewed Jan 30, 2024

View reviewed changes

Update docs/getting-started/data-views-in-sec.asciidoc

f87a1d6

Co-authored-by: Nastasha Solomon <[email protected]>

benironside dismissed e40pud’s stale review via f87a1d6 January 30, 2024 21:36

Update docs/getting-started/data-views-in-sec.asciidoc

964f668

Co-authored-by: Nastasha Solomon <[email protected]>

This was referenced Jan 31, 2024

[8.1] Documents how to change the default security index (backport #4695) #4730

Merged

[8.0] Documents how to change the default security index (backport #4695) #4731

Merged

benironside added the v8.11.0 label Jan 31, 2024

mergify bot mentioned this pull request Jan 31, 2024

[8.11] Documents how to change the default security index (backport #4695) #4732

Merged

joepeeples added a commit that referenced this pull request Jul 17, 2024

Update serverless to match ESS

c5dc0b9

Serverless follow up to #4695

joepeeples mentioned this pull request Jul 17, 2024

(Doc+) Alerts UI cannot be CCS [serverless] + bonus fixes #5582

Merged

mergify bot mentioned this pull request Jul 19, 2024

[8.15] (Doc+) Alerts UI cannot be CCS [serverless] + bonus fixes (backport #5582) #5585

Merged

mergify bot mentioned this pull request Jul 19, 2024

[8.14] (Doc+) Alerts UI cannot be CCS [serverless] + bonus fixes (backport #5582) #5586

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Documents how to change the default security index #4695

Documents how to change the default security index #4695

benironside commented Jan 26, 2024 •

edited

Loading

github-actions bot commented Jan 26, 2024

e40pud commented Jan 29, 2024

e40pud left a comment

nastasha-solomon left a comment

nastasha-solomon Jan 30, 2024

e40pud Jan 31, 2024

nastasha-solomon Jan 31, 2024

Documents how to change the default security index #4695

Documents how to change the default security index #4695

Conversation

benironside commented Jan 26, 2024 • edited Loading

github-actions bot commented Jan 26, 2024

e40pud commented Jan 29, 2024

e40pud left a comment

Choose a reason for hiding this comment

nastasha-solomon left a comment

Choose a reason for hiding this comment

nastasha-solomon Jan 30, 2024

Choose a reason for hiding this comment

e40pud Jan 31, 2024

Choose a reason for hiding this comment

nastasha-solomon Jan 31, 2024

Choose a reason for hiding this comment

benironside commented Jan 26, 2024 •

edited

Loading