Examine Osquery results

Author: nastasha-solomon

raw-migrated-files/docs-content/serverless/security-examine-osquery-results.md

@@ -235,7 +235,6 @@ toc:
       - file: docs-content/serverless/security-ai-usecase-incident-reporting.md
       - file: docs-content/serverless/security-alert-suppression.md
       - file: docs-content/serverless/security-alerts-manage.md
-      - file: docs-content/serverless/security-alerts-run-osquery.md
       - file: docs-content/serverless/security-automated-response-actions.md
       - file: docs-content/serverless/security-automatic-import.md
       - file: docs-content/serverless/security-behavioral-detection-use-cases.md
@@ -276,7 +275,6 @@ toc:
       - file: docs-content/serverless/security-environment-variable-capture.md
       - file: docs-content/serverless/security-ers-requirements.md
       - file: docs-content/serverless/security-event-filters.md
-      - file: docs-content/serverless/security-examine-osquery-results.md
       - file: docs-content/serverless/security-get-started-with-kspm.md
       - file: docs-content/serverless/security-host-isolation-exceptions.md
       - file: docs-content/serverless/security-ingest-data.md

raw-migrated-files/toc.yml

@@ -4,14 +4,7 @@ mapped_urls:
   - https://www.elastic.co/guide/en/serverless/current/security-examine-osquery-results.html
 ---
 
-# Examine Osquery results
-
-% What needs to be done: Align serverless/stateful
-
-% Use migrated content from existing pages that map to this page:
-
-% - [x] ./raw-migrated-files/security-docs/security/view-osquery-results.md
-% - [ ] ./raw-migrated-files/docs-content/serverless/security-examine-osquery-results.md
+# Examine Osquery results [security-examine-osquery-results]
 
 Osquery provides relevant, timely data that you can use to better understand and monitor your environment. When you run queries, results are indexed and displayed the Results table, which you can filter, sort, and interact with.
 
@@ -26,7 +19,7 @@ The Results table displays results from single queries and query packs.
 Results for single queries appear on the **Results** tab. When you run a query, the number of agents queried and query status temporarily display in a status bar above the results table. Agent responses can be `Successful`, `Not yet responded` (pending), and `Failed`.
 
 :::{image} ../../../images/security-single-query-results.png
-:alt: single query results
+:alt: Shows query results
 :class: screenshot
 :::
 
@@ -36,7 +29,7 @@ Results for single queries appear on the **Results** tab. When you run a query,
 Results for each query in the pack appear in the **Results** tab. Click the expand icon (![Click markdown icon](../../../images/security-pack-expand-button-osquery.png "")) at the far right of each query row to display query results. The number of agents that were queried and their responses are shown for each query. Agent responses are color-coded. Green is `Successful`, `Not yet responded` (pending) is gray, and `Failed` is red.
 
 :::{image} ../../../images/security-pack-query-results.png
-:alt: pack query results
+:alt: Shows query results
 :class: screenshot
 :::
 
@@ -45,13 +38,13 @@ Results for each query in the pack appear in the **Results** tab. Click the expa
 
 From the results table, you can:
 
-* Click **View in Discover** (![Click the View in Discover button](../../../images/security-discover-button-osquery.png "")) to explore the results in Discover.
-* Click **View in Lens** (![Click the View in Lens button](../../../images/security-lens-button-osquery.png "")) to navigate to Lens, where you can use the drag-and-drop **Lens** editor to create visualizations.
-* Click **Timeline** (![Click Timeline button](../../../images/security-timeline-button-osquery.png "")) to investigate a single query result in Timeline or **Add to timeline investigation** to investigate all results. This option is only available for single query results.
+* Click **View in Discover** (![View in Discover button](../../../images/security-discover-button-osquery.png "title =20x20")) to explore the results in Discover.
+* Click **View in Lens** (![View in Lens button](../../../images/security-lens-button-osquery.png "title =20x20")) to navigate to Lens, where you can use the drag-and-drop **Lens** editor to create visualizations.
+* Click **Timeline** (![Timeline button](../../../images/security-timeline-button-osquery.png "title =20x20")) to investigate a single query result in Timeline or **Add to timeline investigation** to investigate all results. This option is only available for single query results.
 
     When you open all results in Timeline, the events in Timeline are filtered based on the `action_ID` generated by the Osquery query.
 
-* Click **Add to Case** (![Click Add to Case button](../../../images/security-case-button-osquery.png "")) to add the query results to a new or existing case. If you ran a live query from an alert, the alert and query results are added to the case as comments.
+* Click **Add to Case** (![Add to Case button](../../../images/security-case-button-osquery.png "title =20x20")) to add the query results to a new or existing case. If you ran a live query from an alert, the alert and query results are added to the case as comments.
 
     ::::{note}
     If you add the results to a *new* case, you are prompted to specify the solution that you want the create the case within. Ensure you select the correct solution. From {{elastic-sec}}, you cannot access cases created in {{observability}} or Stack Management.