Repository navigation
[AlertZero] Add the landing page - #9114
Merged
Merged
Conversation
Replace the hidden stubs for the AlertZero section landing page, the Set up AlertZero hub, and its Requirements page. UI labels, defaults, gates, privileges, and Worker dependencies are verified against elastic/kibana branch 9.6. Part of elastic/docs-content-internal#1813. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…s pages - Mark the Space requirement serverless: unavailable, and tag the subscription items with their lifecycle. - Say Continuous Threat Hunt runs every 4 hours. The schedule is read-only in 9.6. - Use the Security Analytics Complete tier name, and point the AI model examples at Elastic Managed LLM and External Inference instead of LLM connectors, which 9.6 hides. - Add the Feature Settings privileges, the Worker dependency pointer, and an ordered Turn off procedure. - Apply the AlertZero variables guide to nav labels and on-screen messages, and rewrite ambiguous or misparsed sentences. Part of elastic/docs-content-internal#1813. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Elastic Docs AI PR menuCheck the box to run an AI review for this pull request.
Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team. |
Contributor
🔍 Preview links for changed docs |
Contributor
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
Call the decision page the Proposed actions page to match the other AlertZero pages and elastic/kibana#302288. Give the landing page descriptive headings, state up front that you decide which Workers run and how much they do alone, and say that only Supervised lets Workers approve their own proposed actions. Name manage_security in the setup prerequisites, link the Worker list at the step that needs it, retitle the Space requirement as Security solution view, fold the Workflows privilege note into its table row, and cut repeated sentences. List serverless first in applies_to. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Point the Requirements privileges section at AlertZero privileges instead of repeating its table, and add the settings that are off by default and that some Workers need: the Alert analysis workflow, Attack Discovery workflows, and Context Engine. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Take bold out of link text, and quote UI messages instead of bolding them, per the style guide's emphasis and quotation mark rules. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…page #9118 splits Watches and Workers into a page per Watch, which removes the Watch anchors this table linked to. Link each Watch to the page itself so the build passes whichever PR merges first, and keep the links to the new Watch pages in a comment to uncomment after #9118 merges. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add a landing page section on how Workers in different Watches pass detection gaps and forensics handoffs through Context Engine, what happens when it's off, and the two indexes AlertZero adds, which users might notice in Index Management. Link to it from the Requirements table of settings that Workers need. Checked against elastic/kibana 9.6. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Split Requirements into what every space needs and what specific Workers need, and tell readers in the intro which parts apply to them. Move the subscription into the intro, and replace the advanced setting section with a note that setup turns it on. Add a section on workflow execution costs to the landing page for Serverless and Elastic Cloud Hosted, since costs help readers decide whether to adopt AlertZero. Move the setup privileges to the AlertZero privileges page and link to it from Requirements, Set up AlertZero, and the landing page. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Turning Workers or AlertZero off is recurring admin, not setup. Move the Worker turn-off notes from Requirements to Configure Worker settings, and Turn off AlertZero from Set up AlertZero to Manage AlertZero, with links from where they were. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Landing page: keep it to what AlertZero is, how it works with one example, what each Watch covers, how much Workers do without you, costs, and an ordered Get started path. Move the Context Engine section to the Watches and Workers page in #9118, and the indexes note to Manage AlertZero. Shorten the Watch table and the autonomy and cost sections. Set up: point Before you begin at the two Requirements sections, move the advanced setting key here, split the Workers step from its notes, and list Review your first proposed action and Manage AlertZero as next steps. Manage AlertZero: replace the placeholder intro with links to its pages. Use variables in the Manage and Configure headings, and list serverless first in their applies_to. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nastasha-solomon
added a commit
that referenced
this pull request
Oct 31, 2026
Move the Context Engine explanation here from the AlertZero landing page in #9114, which is now an entry point without implementation detail. Link each Worker to its page, and point to Requirements for the setting and to Manage AlertZero for the index it uses. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 of 2 tasks
Configure Worker settings: say up front that changing Workers needs manage_security, not to grant it only for AlertZero, and that SOC leads without it ask an administrator to apply their choices. Manage AlertZero: link to the privileges page. Landing page: point to the Watches and Workers page for what each Worker does at each autonomy level. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Rewrite "a {{az-worker}}" on the Configure Worker settings, Manage
AlertZero, and Requirements pages so the text still reads correctly if
the Worker name changes to one that takes "an".
AI-Assisted: Drafted with Claude Code
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fold the Requirements page into Set up AlertZero so readers check what they need and turn AlertZero on in one place. Remove Review your first proposed action, since one walkthrough can't fit every setup. Add redirects for both removed pages. Link to Configure Worker settings by page until #9118 merges, with comments saying which anchors to add then. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nastasha-solomon
added a commit
that referenced
this pull request
Nov 1, 2026
The Requirements page is merging into Set up AlertZero in #9114, so link there instead. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Landing page: rewrite the intro and define Workers, fold How it works into the intro, explain that Watches group Workers, rename headings to answer reader questions, correct billing to match Kibana's metering, and trim Get started to three links. Set up: drop requirements every user already meets, the per-Worker requirements and error messages (onboarding and #9118 cover them), and point to onboarding. Add a section on deciding which Workers to run. Manage: remove the cost section and the index details, rewrite the intro as prose, and spell out the steps to turn AlertZero off. Show the AlertZero pages in the navigation for the preview, and rename Run a Worker on demand to Manually run a Worker. AI-Assisted: Drafted with Cursor (Claude Opus 5.5) Co-authored-by: Cursor <cursoragent@cursor.com>
Checked against Kibana 9.6. All six Workers run as billable workflows, not only the Hunt Watch and Detection Watch ones. The rule that at least one Worker stays selected applies only in onboarding. Onboarding blocks on a missing model but doesn't check for data. Rule Coverage and Endpoint Analysis need Context Engine, and Attack Discovery and Continuous Threat Hunt need it to pass work on. The Attack Discovery Worker can't be run manually. Retitle the run page to match #9118. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
#9118 deletes Watches and Workers and moves its content to configure-worker-settings.md, so links to it fail the build once that PR merges. Point the Watch table, the handoff link, and the Set up AlertZero link to the configure page, which exists on main and in #9118. Note the anchors to add after #9118 merges. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add a note that Enable and run needs the privileges for turning on Workers: All for AlertZero, manage_security, and the Workflows Update and Update managed workflows privileges. Checked against Kibana 9.6, where onboarding calls the same route as the Watch pages. Keep only this PR's pages (the landing page, Set up AlertZero, and Manage AlertZero) visible in the navigation. Other AlertZero pages, including the privileges page, stay hidden until their own PRs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keep every AlertZero entry hidden, and change the toc only to drop Requirements and Review your first proposed action. The other AlertZero PRs then merge without toc conflicts. A final navigation PR will set the order and which pages show. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the user outcomes from review to the intro, the Watches paragraph, and the Watches table. Apply each change to the commented 9.6 versions too, so the restored links carry the same wording. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cthulhusec
reviewed
Nov 5, 2026
vitaliidm
reviewed
Nov 6, 2026
AI-Assisted: Drafted with Cursor (Claude Opus 5.5) Co-authored-by: Cursor <cursoragent@cursor.com>
andrew-goldstein
approved these changes
Nov 6, 2026
andrew-goldstein
left a comment
andrew-goldstein
left a comment
There was a problem hiding this comment.
Thanks @nastasha-solomon for the landing page!
LGTM 🚀
Member
Author
|
Hey, all - the page was starting to get way too long and repetitive, so I trimmed it to make it easier to read. If folks could take one more look, just to make sure nothing critical was omitted, that'd be much appreciated. @tinnytintin10 and @jamesspi not sure if you've seen this page yet, so tagging you here too in case you wanted to review it. |
nastasha-solomon
requested review from
cthulhusec,
natasha-moore-elastic and
vitaliidm
November 6, 2026 20:00
cthulhusec
approved these changes
Nov 6, 2026
Member
Author
|
Merging this page today and then opening a new PR to unhide it from the TOC. |
nastasha-solomon
enabled auto-merge
November 6, 2026 20:19
bmorelli25
reviewed
Nov 6, 2026
|
|
||
| ## Get started [alertzero-get-started] | ||
|
|
||
| {{alertzero}} is off by default, and you turn it on separately in each space. To start, turn on the **{{alertzero}}** setting in **Advanced Settings**, then select **{{alertzero}}** in the navigation menu and follow the onboarding steps. |
Member
There was a problem hiding this comment.
Do we need to say anything about needing the appropriate license to use it?
1 of 2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Contributes to elastic/docs-content-internal#1813.
Adds the content for the AlertZero landing page. It explains what AlertZero Workers do, how much they can do on their own, what you're billed for, and where to go next to set up and use AlertZero.
Previews
Generative AI disclosure
Tool(s) and model(s) used: Claude Opus 5.5, via Claude Code and Cursor