[natasha-moore-elastic]

Summary

Resolves https://github.com/elastic/docs-content-internal/issues/1919.

Adds the Escalate an investigation page and the Manage escalations page. The pages stay hidden in the table of contents.

Renames the scaffolded Track escalations page to Manage escalations. The page covers more than following an escalation's status: it also covers working on an escalation with your team, changing who is assigned and who can see it, and closing it. "Track" no longer describes that, so the page is renamed. The glossary link is updated to match.

Work in AlertZero
...
└── Escalate an investigation     create an escalation or add an investigation to an existing one
    └── Manage escalations        find, work on, assign, share, and close escalations

Previews

• Escalate an investigation - How to create an escalation from an investigation, choose who can see it, and add an investigation to an existing escalation.
• Manage escalations - How to find escalations, read their summaries, work on them with your team, change assignees and visibility, and close them.

Made with Cursor

[github-actions]

🔍 Preview links for changed docs

• solutions/security/alertzero/escalate-investigation.md
• solutions/security/alertzero/glossary.md
• solutions/security/alertzero/manage-escalations.md
• solutions/security/alertzero/track-escalations.md

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[melissaburpo]

Just had one minor comment on the intro of the "Escalate an investigation" page. Everything else looked good to me, thanks @natasha-moore-elastic!

[melissaburpo]

This looks great, thanks @natasha-moore-elastic

[nastasha-solomon]

looks good overall! I left a few comments for your consideration - feel free to add to my PRs if you want to move anything out of yours.

[nastasha-solomon]

Approving to unblock, with a few suggestions.

[nastasha-solomon]

I'm wondering how much of this we truly need to doc step-by-step. I imagine the UI will change rapidly in serverless over the coming months, so it might be safer to describe key functionalities here, instead of outlining the flow. Wdyt?

An example of what might work here:

To escalate an {{az-investigation}}, select **Open an escalation** from its actions menu {icon}`boxes_vertical` on the **{{az-proposed-actions-cap}}** page, or from its details flyout. The {{az-escalation}} starts with the {{az-investigation}}'s title, which you can change, and you decide who can see it:

* **Public**: Anyone with the **Agent Builder: Read** or **Agent Builder: All** privilege can see it. This is the default.
* **Private**: Only you and the people you give access to can see it.

You become an assignee of every {{az-escalation}} you create, whether it's public or private. To add more assignees later, refer to [](manage-escalations.md#manage-escalations-assignees).

[bmorelli25]

++

[nastasha-solomon]

Same comment as above. If you're ok with taking this approach, I can take a crack at generalizing the content today.

Example:

If an {{az-investigation}} belongs to a response that's already escalated, add it to that {{az-escalation}} instead of creating a new one.

Select **Attach to an escalation** from the {{az-investigation}}'s actions menu {icon}`boxes_vertical`. Then select the open {{az-escalation}} you want. Some {{az-escalations}} are unavailable, such as one that already links the {{az-investigation}}. Hover over one to find out why.

[nastasha-solomon]

I do like the idea of having a "next steps" section instead of "related pages". If you're onboard with using this instead, I can update my PRs to match.

[bmorelli25]

++ this is more actionable