[Security][Quality] Improve docs for Security detections and alerts by nastasha-solomon · Pull Request #5253 · elastic/docs-content

nastasha-solomon · 2026-02-21T07:03:14Z

Summary

Restructures the Detections and alerts section. Significant changes include: reduced duplication, improved navigation and cross-linking, more audience-centric guidance, and extensible structures.

The new structure:

Detections and alerts
├── Before you begin
│   ├── Turn on detections
│   ├── Detections privileges
│   ├── Detection rule concepts
│   └── Advanced data source configuration
│       ├── Cross-cluster search detection rules
│       └── Using LogsDB index mode with Elastic Security
│
├── MITRE ATT&CK coverage
│
├── Prebuilt rules
│   ├── Prebuilt rule components
│   ├── Install prebuilt rules
│   ├── Update prebuilt rules
│   ├── Prebuilt rules in air-gapped environments
│   └── Customize prebuilt rules
│
├── Author rules
│   ├── Choose the right rule type
│   │   └── About building block rules
│   ├── Rule types
│   │   ├── ES|QL
│   │   ├── Custom query
│   │   ├── EQL
│   │   ├── Indicator match
│   │   ├── New terms
│   │   └── Machine learning
│   │   └── Threshold
│   ├── Using the UI
│   ├── Using the API
│   ├── Common rule settings
│   ├── Set rule data sources
│   ├── Write investigation guides
│   └── Validate and test rules
│
├── Manage detection rules
│
├── Monitor rule executions
│   └── Fill rule execution gaps
│
├── Reduce noise and false positives
│   ├── Tune detection rules
│   ├── Rule exceptions
│   │   ├── Create and manage value lists
│   │   ├── Add and manage exceptions
│   │   └── Create and manage shared exception lists
│   └── Alert suppression
│
└── Manage detection alerts
    ├── Visualize detection alerts
    ├── View detection alert details
    ├── Add detection alerts to cases
    └── Query alert indices

This PR addresses https://github.com/elastic/docs-content-internal/issues/797, which is the main issue tracking quality improvements to the Security detection docs. It also addresses some gaps and doc bugs that have been sitting in the backlog for 3453485384953794348 years.

Review requests

For technical reviewers

Please verify accuracy in the following areas:

Rule type pages (new)

Please review the following pages for accuracy and completeness. Most of the content is a direct port. The net-new content is fairly limited.

(Fixes https://github.com/elastic/docs-content-internal/issues/239 by creating individual configuration guides for each rule type.)

Reference and decision guides (new or heavily rewritten to improve clarity and findability)

Page	What to verify
Detections and alerts	The sections about where to start and the detection program lifecycle for accuracy and fixes added for #1210
Detection rule concepts	Mental model for rules, key component explanations, and glossary
Common rule settings	All shared field descriptions for completeness and accuracy
Choose the right rule type	Comparison table accuracy
Reduce noise and false positives	Decision table, key distinctions table, scenario walkthrough
Using the API	API endpoint paths and links for Stack and Serverless

Other rewritten pages

Page	What to verify
Write investigation guides	Markdown syntax table, Osquery steps, best practices
Set rule data sources	Per-rule index pattern behavior, cold/frozen tier filter accuracy
Validate and test rules	DaC workflow accuracy
Suppress detection alerts	Info added to fix #1545 and https://github.com/elastic/security-docs-internal/issues/22
Prebuilt rules	Info added to fix elastic/security-docs#3035, elastic/kibana#109016, #3994
Create and manage value lists	Info added to fix elastic/security-docs#3754 and elastic/security-docs#4929

For editorial reviewers

Please check the following items for logical flow and navigation between pages and glaring style/formatting errors.

Hub pages
Please spot-check navigation and descriptions for the following:

Restructured pages

Manage detection rules - Refocused page on flows tied to editing rules.
Monitor rule executions - Descoped page to only cover content related to monitoring rules.
Fill rule execution gaps - Centralized feature docs for filling gaps rules.
Suppress detection alerts - Improved structure and refined certain sections that were overly complex. Also fixes [Website]: suppressed alerts count toward the maximum number of alerts defined by xpack.alerting.rules.run.alerts.max #1545.

Prebuilt rules pages
Content from Use Elastic prebuilt rules and Update modified and unmodified Elastic prebuilt rules was moved around into three buckets: install, update, and customize prebuilt rule. To help convey capabilities provided at certain subscription levels, added comparison tables and specified when certain flows were gated behind subscriptions.

Generative AI disclosure

Did you use a generative AI (GenAI) tool to assist in creating this contribution?

Yes
No

Cursor, Claude

github-actions · 2026-02-21T07:04:35Z

Vale Linting Results

Summary: 10 warnings, 60 suggestions found

⚠️ Warnings (10)

File	Line	Rule	Message
solutions/security/detect-and-alert/common-rule-settings.md	117	Elastic.Spelling	'subtechniques' is a possible misspelling.
solutions/security/detect-and-alert/esql.md	21	Elastic.DontUse	Don't use '...'.
solutions/security/detect-and-alert/esql.md	163	Elastic.DontUse	Don't use '...'.
solutions/security/detect-and-alert/indicator-match.md	16	Elastic.Spelling	'operationalizing' is a possible misspelling.
solutions/security/detect-and-alert/install-prebuilt-rules.md	122	Elastic.Spelling	'auditability' is a possible misspelling.
solutions/security/detect-and-alert/prebuilt-rules-airgapped.md	21	Elastic.Spelling	'prebundled' is a possible misspelling.
solutions/security/detect-and-alert/query-alert-indices.md	63	Elastic.Spelling	'triaged' is a possible misspelling.
solutions/security/detect-and-alert/validate-and-test-rules.md	24	Elastic.Spelling	'auditability' is a possible misspelling.
solutions/security/detect-and-alert/view-detection-alert-details.md	40	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
troubleshoot/security/detection-rules.md	192	Elastic.DontUse	Don't use 'note that'.

💡 Suggestions (60)

File	Line	Rule	Message
explore-analyze/alerting/alerts/rule-types.md	16	Elastic.WordChoice	Consider using 'refer to (if it's a document), view (if it's a UI element)' instead of 'see', unless the term is in the UI.
reference/glossary/index.md	259	Elastic.WordChoice	Consider using 'refer to (if it's a document), view (if it's a UI element)' instead of 'See', unless the term is in the UI.
reference/glossary/index.md	425	Elastic.Wordiness	Consider using 'to' instead of 'in order to'.
solutions/security/detect-and-alert/about-building-block-rules.md	20	Elastic.WordChoice	Consider using 'run, start' instead of 'execute', unless the term is in the UI.
solutions/security/detect-and-alert/common-rule-settings.md	202	Elastic.WordChoice	Consider using 'run, start' instead of 'execute', unless the term is in the UI.
solutions/security/detect-and-alert/common-rule-settings.md	281	Elastic.WordChoice	Consider using 'refer to (if it's a document), view (if it's a UI element)' instead of 'see', unless the term is in the UI.
solutions/security/detect-and-alert/common-rule-settings.md	291	Elastic.Wordiness	Consider using 'because' instead of 'since'.
solutions/security/detect-and-alert/custom-query.md	20	Elastic.WordChoice	Consider using 'efficient, basic' instead of 'simple', unless the term is in the UI.
solutions/security/detect-and-alert/custom-query.md	90	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/detection-rule-concepts.md	32	Elastic.WordChoice	Consider using 'run, start' instead of 'execute', unless the term is in the UI.
solutions/security/detect-and-alert/detection-rule-concepts.md	65	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
solutions/security/detect-and-alert/detection-rule-concepts.md	85	Elastic.WordChoice	Consider using 'run, start' instead of 'Execute', unless the term is in the UI.
solutions/security/detect-and-alert/detection-rule-concepts.md	87	Elastic.WordChoice	Consider using 'run, start' instead of 'Execute', unless the term is in the UI.
solutions/security/detect-and-alert/detection-rule-concepts.md	111	Elastic.WordChoice	Consider using 'run, start' instead of 'execute', unless the term is in the UI.
solutions/security/detect-and-alert/detection-rule-concepts.md	135	Elastic.WordChoice	Consider using 'run, start' instead of 'execute', unless the term is in the UI.
solutions/security/detect-and-alert/esql.md	21	Elastic.Ellipses	In general, don't use an ellipsis.
solutions/security/detect-and-alert/esql.md	163	Elastic.Ellipses	In general, don't use an ellipsis.
solutions/security/detect-and-alert/fill-rule-gaps.md	15	Elastic.WordChoice	Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
solutions/security/detect-and-alert/indicator-match.md	20	Elastic.Semicolons	Use semicolons judiciously.
solutions/security/detect-and-alert/indicator-match.md	20	Elastic.Wordiness	Consider using 'all' instead of 'all of '.
solutions/security/detect-and-alert/indicator-match.md	20	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/indicator-match.md	133	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/install-prebuilt-rules.md	105	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'Disable', unless the term is in the UI.
solutions/security/detect-and-alert/install-prebuilt-rules.md	105	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
solutions/security/detect-and-alert/manage-detection-alerts.md	154	Elastic.WordChoice	Consider using 'run, start' instead of 'Execute', unless the term is in the UI.
solutions/security/detect-and-alert/manage-detection-rules.md	82	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
solutions/security/detect-and-alert/manage-detection-rules.md	84	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'Disable', unless the term is in the UI.
solutions/security/detect-and-alert/manage-detection-rules.md	94	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
solutions/security/detect-and-alert/manage-detection-rules.md	185	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/mitre-attack-coverage.md	79	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
solutions/security/detect-and-alert/new-terms.md	81	Elastic.HeadingColons	Capitalize ': f'.
solutions/security/detect-and-alert/new-terms.md	109	Elastic.HeadingColons	Capitalize ': n'.
solutions/security/detect-and-alert/new-terms.md	133	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/prebuilt-rule-components.md	20	Elastic.Semicolons	Use semicolons judiciously.
solutions/security/detect-and-alert/prebuilt-rule-components.md	41	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
solutions/security/detect-and-alert/prebuilt-rule-components.md	60	Elastic.Semicolons	Use semicolons judiciously.
solutions/security/detect-and-alert/prebuilt-rule-components.md	60	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/prebuilt-rule-components.md	78	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/prebuilt-rule-components.md	78	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/prebuilt-rules-airgapped.md	231	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/query-alert-indices.md	43	Elastic.Wordiness	Consider using 'all' instead of 'all of '.
solutions/security/detect-and-alert/reduce-noise-and-false-positives.md	47	Elastic.FirstPerson	Use caution when using first-person pronouns such as 'my.'
solutions/security/detect-and-alert/reduce-noise-and-false-positives.md	92	Elastic.Wordiness	Consider using 'all' instead of 'all of '.
solutions/security/detect-and-alert/reduce-noise-and-false-positives.md	104	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/reduce-noise-and-false-positives.md	104	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/set-rule-data-sources.md	40	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/set-rule-data-sources.md	62	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/using-the-rule-ui.md	69	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
solutions/security/detect-and-alert/view-detection-alert-details.md	19	Elastic.Wordiness	Consider using 'act' instead of 'Take action'.
solutions/security/detect-and-alert/view-detection-alert-details.md	200	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/view-detection-alert-details.md	229	Elastic.WordChoice	Consider using 'refer to (if it's a document), view (if it's a UI element)' instead of 'See', unless the term is in the UI.
solutions/security/detect-and-alert/view-detection-alert-details.md	230	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/view-detection-alert-details.md	232	Elastic.Versions	Use 'or later' instead of 'or higher' when referring to versions.
solutions/security/detect-and-alert/view-detection-alert-details.md	232	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert/view-detection-alert-details.md	233	Elastic.Versions	Use 'or later' instead of 'or higher' when referring to versions.
solutions/security/detect-and-alert/visualize-detection-alerts.md	117	Elastic.Semicolons	Use semicolons judiciously.
solutions/security/detect-and-alert/visualize-detection-alerts.md	152	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/get-started/automatic-migration.md	138	Elastic.Repetition	"the" is repeated.
solutions/security/get-started/configure-advanced-settings.md	93	Elastic.Semicolons	Use semicolons judiciously.
troubleshoot/security/detection-rules.md	206	Elastic.Wordiness	Consider using 'also' instead of 'In addition'.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

github-actions · 2026-02-21T07:11:04Z

🔍 Preview links for changed docs

More links …

…nto issue-797

natasha-moore-elastic

Comments for the Author rules section.

solutions/security/detect-and-alert/author-rules.md

solutions/security/detect-and-alert/rule-types.md

solutions/security/detect-and-alert/esql.md

solutions/security/detect-and-alert/using-the-rule-builder.md

solutions/security/detect-and-alert/esql.md

solutions/security/detect-and-alert/using-the-rule-ui.md

solutions/security/detect-and-alert/using-the-rule-builder.md

solutions/security/detect-and-alert/turn-on-detections.md

natasha-moore-elastic

Comments on the Reduce noise and false positives section.

solutions/security/detect-and-alert/tune-detection-rules.md

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

…ls.md

Resolved modify/delete conflict for create-detection-rule.md by keeping the deletion (content was restructured into using-the-rule-builder.md and rule type-specific pages). Made-with: Cursor

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

…nto issue-797

georgewallace

Reviewing just our purview (Manage data) No issues on the manage-data content. Just link changes.

natasha-moore-elastic

🚢

vitaliidm

Suppression docs LGTM

approksiu

Reviewed till "author rules", will submit the second part in a bit

approksiu · 2026-03-12T12:54:24Z

solutions/security/detect-and-alert.md

+| Your goal | Start here |
+|---|---|
+| Set up detection for the first time | [Setup](/solutions/security/detect-and-alert/before-you-begin.md#one-time-setup) → [Install prebuilt rules](/solutions/security/detect-and-alert/install-prebuilt-rules.md) |
+| Take over an existing deployment | [MITRE ATT&CK coverage](/solutions/security/detect-and-alert/mitre-attack-coverage.md) → [Monitor rule executions](/solutions/security/detect-and-alert/monitor-rule-executions.md) |


What does it mean "take over an existing deployment"? Maybe "manage existing deployment" - as it applies to users who have a deployment as a continuous task of coverage and rules monitoring.

approksiu · 2026-03-12T12:57:58Z

solutions/security/detect-and-alert.md

-To use {{kib}} Alerting for detection alert notifications in the {{stack}}, you need the [appropriate license](https://www.elastic.co/subscriptions).
-::::
+1. **Confirm requirements.** Verify infrastructure, privileges, and data availability.
+2. **Assess coverage gaps.** Use MITRE ATT&CK coverage to identify priority areas.


Use MITRE ATT&CK coverage to identify priority areas. -> "Perform threat modelling and use MITRE ATT&CK coverage to identify priority areas."

Note: There might be requirements how the MITRE ATT&CK should be referenced https://attack.mitre.org/resources/legal-and-branding/ - do we follow their guideline?

approksiu · 2026-03-12T12:58:49Z

solutions/security/detect-and-alert.md

-The {{elastic-sec}} Labs team uses the [detection-rules](https://github.com/elastic/detection-rules) repo to develop, test, and release {{elastic-sec}}'s[ prebuilt rules](https://github.com/elastic/detection-rules/tree/main/rules). The repo provides DaC features and allows you to customize settings to simplify the setup for managing user rules with the DaC pipeline.
-
-To get started, refer to the [DaC documentation](https://github.com/elastic/detection-rules/blob/main/README.md#detections-as-code-dac).
+A minimal viable detection program (prebuilt rules enabled for your highest-priority tactics, running correctly, with noise managed to an actionable level) is a meaningful outcome at any stage of this workflow. You do not need to complete every stage before your detection program delivers value.


-> your highest priority tactics and techniques

approksiu · 2026-03-12T12:59:56Z

solutions/security/detect-and-alert/detection-rule-concepts.md

+
+| Part | Purpose |
+|------|---------|
+| Query | Specifies the threat behavior or pattern to detect. The query searches your [data sources](#data-sources-concept) using syntax that varies by [rule type](/solutions/security/detect-and-alert/choose-the-right-rule-type.md) (KQL, EQL, {{ml}} anomaly scores, or threat indicator matches). |


ESQL is missing from the list

approksiu · 2026-03-12T13:01:50Z

solutions/security/detect-and-alert/detection-rule-concepts.md

+|------|---------|
+| Query | Specifies the threat behavior or pattern to detect. The query searches your [data sources](#data-sources-concept) using syntax that varies by [rule type](/solutions/security/detect-and-alert/choose-the-right-rule-type.md) (KQL, EQL, {{ml}} anomaly scores, or threat indicator matches). |
+| Schedule | Controls how often the rule runs and how far back it searches. The interval you set determines both. For example, a rule with a 5-minute interval runs every 5 minutes and searches the last 5 minutes of data each time. An optional look-back setting extends the search window to help catch late-arriving events. |
+| Rule actions | Specifies what happens when the rule detects a match. You can [send notifications](#notifications-concept), create tickets, or trigger integrations with external systems. |


-> or trigger actions on external systems

approksiu · 2026-03-12T16:56:41Z

solutions/security/detect-and-alert/update-prebuilt-rules.md

+When updated versions are available for your installed prebuilt rules, the **Rule Updates** tab appears on the **Rules** page.
+
+:::{admonition} Automatic updates
+On {{stack}}, automatic updates are supported for the current {{elastic-sec}} version and the latest three previous minor releases. For example, if you're on version 9.0, you can use the Rules UI to update prebuilt rules until version 9.4 is released. After that, you can still manually download and install updates, but must upgrade {{elastic-sec}} to receive automatic updates again.


We are supporting 8.19 for a while, and latest 3 versions, so it is current + latest 2. See https://support.elastic.dev/knowledge/view/685735b8

approksiu · 2026-03-12T17:00:58Z

solutions/security/detect-and-alert/update-prebuilt-rules.md

+::::
+
+::::{dropdown} Basic–Platinum / Security Analytics Essentials
+:name: basic-modified-rules


In this case user can no longer modify rules, do we mean here the rules modifications done on Enterprise and then subscription is downgraded? Kind of an edge case. Maybe clarify more this situation.

approksiu · 2026-03-12T17:05:28Z

solutions/security/detect-and-alert/prebuilt-rules-airgapped.md

 To update your prebuilt rules, first update your self-hosted {{package-registry}} with a newer distribution image, then install the rule updates in {{elastic-sec}}.

 ::::{important}
 Elastic releases prebuilt rule updates continuously. To receive the latest updates in an air-gapped environment, we recommend updating your self-hosted {{package-registry}} at least monthly. Prebuilt rule updates are version-specific. Updating your {{package-registry}} provides rule updates designed for your current {{stack}} version, not rules designed for newer versions. To receive rules designed for a newer version, you must upgrade your entire {{stack}}.


we do biweekly rule updates.

approksiu · 2026-03-12T17:07:52Z

solutions/security/detect-and-alert/customize-prebuilt-rules.md

+| Edit prebuilt rules directly | — | ✓ |
+| Revert to Elastic version | — | ✓ |
+
+:::{note}


For rules customisation it is true, but for other features there are more discrepancies. Maybe call out directly serverless subscriptions, so users are not mislead by this statement?

approksiu · 2026-03-12T17:09:39Z

solutions/security/detect-and-alert/customize-prebuilt-rules.md

+### Considerations for editing prebuilt rules
+
+* **Updates might cause conflicts**: When Elastic releases an update that changes the same fields you modified, you need to resolve the conflict. Refer to [Resolve update conflicts](/solutions/security/detect-and-alert/update-prebuilt-rules.md#resolve-reduce-rule-conflicts).
+* **Revert if needed**: You can restore the original Elastic version at any time. Refer to [Revert to Elastic version](#revert-prebuilt-rules).


If the original version is present. Is we are missing it, the option to revert will be hidden. Updating on time prevents this from happening.

First draft

e9f1f19

nastasha-solomon self-assigned this Feb 21, 2026

github-actions bot had a problem deploying to docs-preview February 21, 2026 07:03 Failure

Fix ref

778ef00

github-actions bot deployed to docs-preview February 21, 2026 07:09 View deployment

Merge branch 'main' into issue-797

80a2cd8

github-actions bot deployed to docs-preview February 23, 2026 19:22 View deployment

Continued moving content around

6590972

github-actions bot had a problem deploying to docs-preview February 23, 2026 20:47 Failure

Fix error

0a854a0

github-actions bot had a problem deploying to docs-preview February 23, 2026 20:52 Failure

Comment out craft sections

5b0ff43

github-actions bot had a problem deploying to docs-preview February 23, 2026 21:01 Failure

req rewrite

b55d975

github-actions bot deployed to docs-preview February 23, 2026 21:06 View deployment

Remove extra page

315d39d

github-actions bot deployed to docs-preview February 23, 2026 21:17 View deployment

Merge branch 'main' into issue-797

715b4b1

github-actions bot deployed to docs-preview February 23, 2026 21:27 View deployment

nastasha-solomon added 2 commits February 23, 2026 16:46

restructure and rename author rules

e3ff673

Merge branch 'issue-797' of https://github.com/elastic/docs-content i…

1d549b5

…nto issue-797

github-actions bot had a problem deploying to docs-preview February 23, 2026 21:47 Failure

deleted old file

d639771

github-actions bot deployed to docs-preview February 23, 2026 21:50 View deployment

endpoint refs

7d4fba1

github-actions bot deployed to docs-preview February 23, 2026 23:22 View deployment

updates tuning page

67d4b8d

github-actions bot deployed to docs-preview February 23, 2026 23:28 View deployment

natasha-moore-elastic reviewed Mar 10, 2026

View reviewed changes

alaudazzi reviewed Mar 10, 2026

View reviewed changes

solutions/security/detect-and-alert/turn-on-detections.md Outdated Show resolved Hide resolved

natasha-moore-elastic reviewed Mar 10, 2026

View reviewed changes

solutions/security/detect-and-alert/tune-detection-rules.md Show resolved Hide resolved

solutions/security/detect-and-alert/tune-detection-rules.md Outdated Show resolved Hide resolved

nastasha-solomon and others added 20 commits March 10, 2026 16:28

Update solutions/security/detect-and-alert/manage-detection-alerts.md

56c8239

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/detect-and-alert/manage-detection-alerts.md

2bea355

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/detect-and-alert/view-detection-alert-detai…

8e485ae

…ls.md

Merge origin/main into issue-797

45f57a9

Resolved modify/delete conflict for create-detection-rule.md by keeping the deletion (content was restructured into using-the-rule-builder.md and rule type-specific pages). Made-with: Cursor

Update solutions/security/detect-and-alert/using-the-rule-builder.md

ff00a70

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/detect-and-alert/using-the-rule-builder.md

141eaca

Update solutions/security/detect-and-alert/author-rules.md

dac5a93

Update solutions/security/detect-and-alert/rule-types.md

e8409ea

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/detect-and-alert/using-the-rule-builder.md

959c36b

Merge branch 'issue-797' of https://github.com/elastic/docs-content i…

1cba50b

…nto issue-797

using the rule ui file name update

e018dbc

Rename about-prebuilt-rules.md file

ed79faf

addresses editorial feedback

c8d3294

Don't need screenshot

39aae13

updated examples

9b9a363

tweak intro to "Choose the right rule type" page

a9b4e1a

no notes

b1efae5

Merge branch 'main' into issue-797

a46e4b8

rewrote sentences with parthen

b5a5104

Merge branch 'main' into issue-797

dfeca05

georgewallace approved these changes Mar 10, 2026

View reviewed changes

nastasha-solomon and others added 2 commits March 10, 2026 20:27

removed duplicate section

47d614a

Merge branch 'main' into issue-797

19362c7

natasha-moore-elastic approved these changes Mar 11, 2026

View reviewed changes

Merge branch 'main' into issue-797

d6cc455

vitaliidm approved these changes Mar 12, 2026

View reviewed changes

approksiu requested changes Mar 12, 2026

View reviewed changes

Conversation

nastasha-solomon commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Review requests

For technical reviewers

Rule type pages (new)

Reference and decision guides (new or heavily rewritten to improve clarity and findability)

Other rewritten pages

For editorial reviewers

Generative AI disclosure

Uh oh!

github-actions bot commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Vale Linting Results

Uh oh!

github-actions bot commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

natasha-moore-elastic left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

natasha-moore-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

georgewallace left a comment

Choose a reason for hiding this comment

Uh oh!

natasha-moore-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

vitaliidm left a comment

Choose a reason for hiding this comment

Uh oh!

approksiu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

nastasha-solomon commented Feb 21, 2026 •

edited

Loading

github-actions bot commented Feb 21, 2026 •

edited

Loading

github-actions bot commented Feb 21, 2026 •

edited

Loading

natasha-moore-elastic left a comment •

edited

Loading