Skip to content

[8.15] (Doc+) Alerts UI cannot be CCS [serverless] + bonus fixes (backport #5582) #5585

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
joepeeples merged 2 commits into from
Jul 19, 2024
Merged

[8.15] (Doc+) Alerts UI cannot be CCS [serverless] + bonus fixes (backport #5582) #5585

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
06e74d4
(Doc+) Alerts UI cannot be CCS [serverless] + bonus fixes (#5582)
joepeeples Jul 19, 2024
9a4c399
Delete docs/serverless directory and its contents
github-actions[bot] Jul 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions docs/getting-started/data-views-in-sec.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,7 @@ IMPORTANT: Custom indices are not included in the <<default-data-view-security,
[discrete]
== Switch to another {data-source}

You can tell which {data-source} is active by clicking the *{data-source-cap}* menu at the upper right of {elastic-sec} pages that display event or alert data, such as Overview, Alerts, Timelines, or Hosts.
To switch to another {data-source}, click **Choose {data-source}**, select one of the options, and click **Save**.
You can tell which {data-source} is active by clicking the *{data-source-cap}* menu at the upper right of {elastic-sec} pages that display event or alert data, such as Overview, Alerts, Timelines, or Hosts. To switch to another {data-source}, click **Choose {data-source}**, select one of the options, and click **Save**.

image::images/dataview-button-highlighted.png[image highlighting how to open the data view selection menu]

Expand All @@ -20,7 +19,7 @@ image::images/dataview-button-highlighted.png[image highlighting how to open the

To learn how to modify the default **Security Default Data View**, refer to <<update-sec-indices, Update default {elastic-sec} indices>>.

To learn how to modify, create, or delete another {data-source} refer to {apm-app-ref}/data-views.html[{kib} {data-sources-cap}].
To learn how to modify, create, or delete another {data-source} refer to {kibana-ref}/data-views.html[{kib} {data-sources-cap}].

You can also temporarily modify the active {data-source} from the *{data-source-cap}* menu by clicking *Advanced options*, then adding or removing index patterns.

Expand All @@ -36,6 +35,6 @@ NOTE: You cannot update the data view for the Alerts page. This includes referen

The default {data-source} is defined by the `securitySolution:defaultIndex` setting, which you can modify in {kib}'s advanced settings (**Stack Management** > **Advanced Settings** > **Security Solution**). To learn more about this setting, including its default value, refer to {security-guide}/advanced-settings.html#update-sec-indices[Advanced settings].

The first time a user visits {elastic-sec} within a given {kib} {apm-app-ref}/xpack-spaces.html[space], the default {data-source} generates in that space and becomes active.
The first time a user visits {elastic-sec} within a given {kib} {kibana-ref}/xpack-spaces.html[space], the default {data-source} generates in that space and becomes active.

If you delete the active {data-source} when there are no other defined {data-sources}, the default {data-source} will regenerate and become active upon refreshing any {elastic-sec} page in the space.