From 600d92b3e61a81bbd175d48edfc79132eac5a76d Mon Sep 17 00:00:00 2001 From: Stef Nestor <26751266+stefnestor@users.noreply.github.com> Date: Fri, 5 Jul 2024 11:31:04 -0600 Subject: [PATCH 1/2] (Doc+) Alerts UI cannot be CCS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 👋 howdy, team! Playing forward a couple ballpark Githubs (kindly see their sub-internal-links) https://github.com/elastic/security-docs/issues/4653 , https://github.com/elastic/kibana/issues/172534 , can we expand [this doc's](https://www.elastic.co/guide/en/security/master/data-views-in-sec.html#_create_or_modify_a_data_view) note to more heavily indicate even CCS is not possible on the Alerts UI? --- docs/getting-started/data-views-in-sec.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started/data-views-in-sec.asciidoc b/docs/getting-started/data-views-in-sec.asciidoc index 50d4248761..c3c6a2084b 100644 --- a/docs/getting-started/data-views-in-sec.asciidoc +++ b/docs/getting-started/data-views-in-sec.asciidoc @@ -28,7 +28,7 @@ image::images/dataview-filter-example.gif[video showing how to filter the active This only allows you to add index patterns that match indices that currently contain data (other index patterns are unavailable). Note that any changes made are saved in the current browser window and won't persist if you open a new tab. -NOTE: You cannot update the data view for the Alerts page. It always shows data from `.alerts-security.alerts-default`. +NOTE: You cannot update the data view for the Alerts page, e.g. to enable it to reference a cross-cluster search (CCS) data view. It always shows data from `.alerts-security.alerts-default`. [discrete] [[default-data-view-security]] From 3a2976b81b2967ee8fb2114090a25fb29dc0d00d Mon Sep 17 00:00:00 2001 From: Stef Nestor <26751266+stefnestor@users.noreply.github.com> Date: Wed, 17 Jul 2024 13:35:44 -0600 Subject: [PATCH 2/2] feedback Co-authored-by: Joe Peeples --- docs/getting-started/data-views-in-sec.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started/data-views-in-sec.asciidoc b/docs/getting-started/data-views-in-sec.asciidoc index c3c6a2084b..7b0d75074b 100644 --- a/docs/getting-started/data-views-in-sec.asciidoc +++ b/docs/getting-started/data-views-in-sec.asciidoc @@ -28,7 +28,7 @@ image::images/dataview-filter-example.gif[video showing how to filter the active This only allows you to add index patterns that match indices that currently contain data (other index patterns are unavailable). Note that any changes made are saved in the current browser window and won't persist if you open a new tab. -NOTE: You cannot update the data view for the Alerts page, e.g. to enable it to reference a cross-cluster search (CCS) data view. It always shows data from `.alerts-security.alerts-default`. +NOTE: You cannot update the data view for the Alerts page. This includes referencing a cross-cluster search (CCS) data view or any other data view. The Alerts page always shows data from `.alerts-security.alerts-default`. [discrete] [[default-data-view-security]]