Repository navigation
[AlertZero] Add the Set up AlertZero page - #9147
Closed
nastasha-solomon wants to merge 12 commits into
Closed
nastasha-solomon wants to merge 12 commits into
nastasha-solomon wants to merge 12 commits into
Conversation
Reapply the setup, manage, and navigation changes split out of #9114. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Elastic Docs AI PR menuCheck the box to run an AI review for this pull request.
Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team. |
Contributor
🔍 Preview links for changed docs |
Contributor
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
nastasha-solomon
changed the title
Revert the Run a Worker manually rename and restore Review your first proposed action, with its toc entry, without a redirect. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Revert the Manage AlertZero changes and drop the AI models placeholder. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nastasha-solomon
changed the title
…needs Link "Decide which Workers to run" and the Context Engine paragraph to Watches and Workers, which covers what each Worker needs and what depends on it, instead of repeating that detail. Fix the link that sent readers to Configure Worker settings for Worker needs, and soften the Next steps bullet, since not every Worker's schedule or autonomy can change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ertZero Every Worker runs on a schedule, including Endpoint Analysis, whose interval is fixed and not shown as a setting. "Scheduled Workers" implied that some Workers aren't scheduled. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tarting the Workers Move the prerequisites into a Before you begin section, split into what every setup needs and what specific Workers need, with a table of each Worker's data and setup. Fold Decide which Workers to run into it, move the manage_security guidance out of a note, and turn Start the Workers into numbered steps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ures Add a choose-models snippet that describes AlertZero's model rows in Feature Settings, steers the Frontier models row away from Claude Opus 5, and explains how to change a row's model (docs-content-internal#2123). Include it in a new Choose models section in Set up AlertZero and in Set up AI features. Also add AlertZero to the privileges list, a Set up AlertZero section, and a note that the Attack Discovery Worker needs the Attack Discovery workflows setting. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Remove bold from link text, and bold the UI label next to the link instead - Use the verified UI labels Attack Discovery Workflows and Feature specific models - Use select instead of choose, and the model row variables in the table - List serverless before stack in applies_to tags and blocks - Name the Worker instead of ambiguous pronouns, and use active voice - Rewrite the mid-sentence colon in the model snippet Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…leges - Add the optional Cyber domain models row to the model guidance - Show Context Engine as optional for Attack Discovery and Continuous Threat Hunt, needed only for handoffs - List the AlertZero and Workflows privileges that starting the Workers needs Verified against Kibana origin/9.6 (inference_features.ts, worker_dependencies_callout.tsx, update_worker.ts). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…AlertZero PR - Add the default embedding endpoint to the Continuous Threat Hunt row. - Match the model wording and Feature Settings link from #9144. - Correct the after-merge link plan: per-Worker anchors, and the threat intelligence requirements section that owns these details. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 of 2 tasks
Member
Author
|
Closing in favor of using #9158. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Contributes to elastic/docs-content-internal#1813. Split out of #9114, which now covers only the AlertZero landing page.
Adds the content for Set up AlertZero. It lists what you need before you begin, for every setup and for specific Workers, then explains how to turn AlertZero on in a space, select models for the Workers, and start them through onboarding. The Requirements page is removed and redirected to Set up AlertZero.
Adds a shared snippet with AlertZero model guidance, including steering the Frontier models row away from Claude Opus 5 (elastic/docs-content-internal#2123) and the optional Cyber domain models row. Set up AlertZero and Set up AI features both include it.
Updates Set up AI features with AlertZero: the privileges link, the model guidance, a Set up AlertZero section, and a note that the AlertZero Attack Discovery Worker needs the Attack Discovery workflows setting.
Previews
Generative AI disclosure
Tool(s) and model(s) used: Claude Opus 5.5, via Claude Code and Cursor
🤖 Generated with Claude Code