[BUG] The screenshot needs to be updated in the documentation as per current Kibana UI

[chetnarajput-qasource]

Documentation links

https://www.elastic.co/docs/solutions/security/detect-and-alert/create-detection-rule#indicator-value-lists

Description

Actual Screenshot

Expected Screenshot

Which documentation set(s) does this bug apply to?

ESS only

Release version

This bug applies to Elastic Stack 8.18.0 and above releases

Testing environment

Build deployed from the production cloud environment: https://cloud.elastic.co/

[chetnarajput-qasource]

@muskangulati-qasource please review!

[muskangulati-qasource]

Reviewed and assigned to @jmikell821

[nastasha-solomon]

The screenshot is outdated in 8.18, 9.0, and Serverless docs, but not because this was a change introduced in 8.18.

• 8.18: https://www.elastic.co/guide/en/security/8.18/rules-ui-create.html#indicator-value-lists
• 9.0/Serverless: https://www.elastic.co/docs/solutions/security/detect-and-alert/create-detection-rule#indicator-value-lists

I'll investigate to see when the IM rule default setup was modified to see how far back I need to backport the 8.x changes.

[nastasha-solomon]

At second look, the screenshot is not a bug. The screenshot in the docs demonstrates an example indicator match rule that's described in step 1F.