[Internal]: Add known issue: Alert actions missing from the Observability alerts table in 9.6.0 #9257

Description

What: Add a known issue to the Elastic Observability known issues page (release-notes/elastic-observability/known-issues.md). This is a release-notes known issue, not a change to a documentation page.

After upgrading to 9.6.0, users who can update classic Observability alerts might find that alert actions (snooze, acknowledge, resolve, and editing tags and assignees) are missing from the Observability alerts table. The table only shows these actions to users who also have write access to Universal alerts. Users who only have privileges for classic alerts can't take action on alerts, even though they're authorized to.

There are two workarounds:

• Grant affected users All privileges for Universal alerts. The actions then appear for classic alerts too. This also lets users manage Universal alerts.
• Use the classic alerts table at /app/observability/alerts, where actions still work. To add it back to the navigation menu, turn on the Classic Alerting: Show Classic Alerts table advanced setting (alerting:v1:showV1ObservabilityAlertsTable). It then appears as Alerts (Classic).

When: Affects 9.6.0. A fix is tracked in elastic/kibana#303170, and the release that includes it isn't known yet.

Why: At least one customer lost the ability to act on alerts after upgrading to 9.6.0. The known issue tells affected users how to get the actions back until a fix ships.

Open questions:

• Whether serverless is also affected. The entry currently says Stack 9.6.0 only.
• Whether the problem starts on upgrade, or only once Universal alerting is turned on. This decides whether the title should say "after upgrading".
• The exact name the Roles UI uses for the Universal alerts privilege. In code, the feature's display name is Alerts.

Applies to Stack 9.6.0. Serverless is unconfirmed.

Suggested wording (placement and final wording are the writer's call):

::::{dropdown} Alert actions are missing from the {{observability}} alerts table after upgrading to 9.6.0

Applies to: {{stack}} 9.6.0

**Details**

After upgrading to 9.6.0, users who can update classic {{observability}} alerts might find that alert actions are missing from the {{observability}} alerts table. These actions include snooze, acknowledge, resolve, and editing tags and assignees. The new alerts table only shows these actions to users who also have write access to Universal alerts. Users who only have privileges for classic alerts can't take action on alerts, even though they're authorized to.

For more information, check [#303170](https://github.com/elastic/kibana/issues/303170).

**Workaround**

Use either of the following workarounds:

* Grant affected users **All** privileges for Universal alerts. The alert actions then appear in the {{observability}} alerts table for classic alerts too. This privilege also lets users manage Universal alerts, so only grant it to users who should have that access.

* Use the classic alerts table to take action on alerts. It is still available at `/app/observability/alerts`, and its actions work as before. To add the classic alerts table back to the navigation menu, turn on the **Classic Alerting: Show Classic Alerts table** advanced setting (`alerting:v1:showV1ObservabilityAlertsTable`). The table then appears in the menu as **Alerts (Classic)**.

::::

Resources

• Tracking issue and proposed fix: [Alerting v2] Unified alerts table gates write actions on the v2 privilege only, ignoring classic alert privileges kibana#303170
• Target page: https://github.com/elastic/docs-content/blob/main/release-notes/elastic-observability/known-issues.md

Which deployment methods does this change impact?

Unknown

Feature differences

Stack 9.6.0 is affected. Whether serverless is also affected is unconfirmed (see open questions).

What Elastic Stack release is this request related to?

9.6

Collaboration model

The product or engineering team will create the first draft

Point of contact.

Main contact: @dominiqueclarke

Stakeholders: