Add requirement on 'search.allow_expensive_queries' to detections-requirement.md

Author: sdesalas

solutions/security/detect-and-alert/detections-requirements.md

@@ -28,11 +28,17 @@ stack:
 These steps are only required for **self-managed** deployments:
 
 * HTTPS must be configured for communication between [{{es}} and {{kib}}](/deploy-manage/security/set-up-basic-security-plus-https.md#encrypt-kibana-http).
-* In the `elasticsearch.yml` configuration file, set the `xpack.security.enabled` setting to `true`. Also, remove the line `search.allow_expensive_queries=false` if you find it. For more information, refer to [Configuring {{es}}](/deploy-manage/deploy/self-managed/configure-elasticsearch.md) and [Security settings in {{es}}](elasticsearch://reference/elasticsearch/configuration-reference/security-settings.md).
-* In [`kibana.yml`](/deploy-manage/stack-settings.md), add the `xpack.encryptedSavedObjects.encryptionKey` setting with any alphanumeric value of at least 32 characters. For example:
+* In [`kibana.yml`](/deploy-manage/stack-settings.md):
+
+  Add the `xpack.encryptedSavedObjects.encryptionKey` setting with any alphanumeric value of at least 32 characters. For example:
 
     `xpack.encryptedSavedObjects.encryptionKey: 'fhjskloppd678ehkdfdlliverpoolfcr'`
 
+* In [`elasticsearch.yml`](/deploy-manage/deploy/self-managed/configure-elasticsearch.md):
+    1. We need to enable the `xpack.security.enabled` setting to `true`.
+    2. We need the `search.allow_expensive_queries` setting to be left on its default value of `true` for key detection features like [alerting](https://www.elastic.co/docs/explore-analyze/alerts-cases/alerts/alerting-setup#alerting-prerequisites) to work. Please remove the line `search.allow_expensive_queries=false` if you find it.
+
+For more information, also refer to [Security settings in {{es}}](elasticsearch://reference/elasticsearch/configuration-reference/security-settings.md).
 
 ::::{important}
 After changing the `xpack.encryptedSavedObjects.encryptionKey` value and restarting {{kib}}, you must restart all detection rules.