Repository navigation
[AlertZero] Add Work in AlertZero and Close false-positive alerts - #9116
Closed
nastasha-solomon wants to merge 17 commits into
Closed
nastasha-solomon wants to merge 17 commits into
nastasha-solomon wants to merge 17 commits into
Conversation
Replace the hidden stubs for Use AlertZero, Decide a proposed action, and Review closed proposed actions, and point the glossary's Use AlertZero link at the Proposed actions page. Verified against elastic/kibana branch 9.6. Part of elastic/docs-content-internal#1816. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the missing AlertZero Read prerequisites, define proposed actions in the decide page opening, correct the decline-reason description, and use 4-space nested list indentation. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Elastic Docs AI PR menuCheck the box to run an AI review for this pull request.
Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team. |
Contributor
Contributor
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
Add the Agent Builder prerequisite and a navigation step to each procedure, explain retries of failed actions on the decide page so it agrees with the closed list, move the failed-run callout out of the idle state, move final-decision and expiry facts before the steps, and give the decide headings a noun. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
State what each page helps you do, give the filter and investigation sections task headings, and cut the empty-state section, the duplicate links, and the full list of decline reasons. Turn the review step into a checklist, say that an approved action fails without its privileges, order statuses by outcome, and retitle the outcomes table. List serverless first in applies_to. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Quote the missing-privilege message instead of bolding it, add the icon for the icon-only Add or change assignees button, take bold out of the Impact filter link, and italicize the name placeholder inside the bold outcome labels. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ails Replace the privilege names and levels on Use AlertZero, Decide a proposed action, and Review closed proposed actions with links to the AlertZero privileges page, which now holds all AlertZero access content. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Decide a proposed action: shorten the intro, say that approving an action doesn't give you the privileges to run it, and add what happens when you approve or decline Alert Triage's proposals to close false positives, moved from the Alert Triage Worker page. Use AlertZero: map each Proposed actions section to the page that covers its decisions, and keep one privileges line. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…sed action
Rewrite "a {{az-worker}}" in the intro so the text still reads correctly
if the Worker name changes to one that takes "an".
AI-Assisted: Drafted with Claude Code
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Put the decision pages in a new order, and nest Track escalations under Escalate an investigation. AI-Assisted: Drafted with Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…pages Use AlertZero: retitle as Work through proposed actions, cut the setup and privilege notes, map each section to the role that usually decides it, fold the Impact filter into one sentence with its purpose, and keep only the follow-ups the UI doesn't make obvious. Each card is one proposed action, not one investigation. Decide a proposed action: fold in Review closed proposed actions, remove the privilege prerequisites, move the final-decision and expiry facts to where you decide, and replace When Workers decide for you with Check recent decisions. Redirect the removed page. Show the use pages in the navigation for the preview. AI-Assisted: Drafted with Cursor (Claude Opus 5.5) Co-authored-by: Cursor <cursoragent@cursor.com>
The section also holds the escalation pages, so the title covers more than proposed actions. Say in the intro that you can hand off or escalate an investigation, and link the escalation pages from Next steps. AI-Assisted: Drafted with Cursor (Claude Opus 5.5) Co-authored-by: Cursor <cursoragent@cursor.com>
nastasha-solomon
changed the title
…able Put Open in chat, assigning, and closing an investigation in the paragraph about cards, since they apply to every card, and the escalation link in the Respond row. Remove the Follow up section. AI-Assisted: Drafted with Cursor (Claude Opus 5.5) Co-authored-by: Cursor <cursoragent@cursor.com>
Retitle Decide a proposed action as Close false-positive alerts and write it for the triage analyst: what to check before approving a batch, what each decision does, what happens on expiry, and how to reopen alerts closed by mistake. Lead the home page intro with why to check a Worker's reasoning, and add a Where to start table. Co-authored-by: Cursor <cursoragent@cursor.com>
nastasha-solomon
changed the title
Name each Worker consistently, drop page-position language, use might for possibility, replace passive constructions, and capitalize after colons. Update the home page table to link Tune noisy rules and fill detection gaps. Co-authored-by: Cursor <cursoragent@cursor.com>
1 of 2 tasks
nastasha-solomon
added a commit
that referenced
this pull request
Nov 1, 2026
Close false-positive alerts (decide-proposed-action.md, reworked in #9116) now covers only the Alert Triage Worker's closures, not the steps every decision shares. Reword the Triage Watch and Alert Triage Worker links to match, and point the glossary's proposed action entry to Work in AlertZero. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Checked against Kibana 9.6. The 72-hour expiry has no setting that changes it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keep every AlertZero entry hidden and in its current order, and change the toc only to drop Review closed proposed actions. The other AlertZero PRs then merge without toc conflicts. A final navigation PR will set the order and which pages show. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Uses Impacted entities (was Impact), from elastic/kibana#302204. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 of 2 tasks
Member
Author
|
Closing in favor of using #9157. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the AlertZero home page and a page for closing the false-positive alerts that the Alert Triage Worker proposes. Review closed proposed actions is folded into Close false-positive alerts and redirected there.
Previews
Generative AI disclosure
Tool(s) and model(s) used: Claude Opus 5.5, via Claude Code and Cursor