[REQUEST]: Table tab enhancements in alert/event flyout

[christineweng]

Description

in 8.19 and 9.1 We are introducing pinning and other enhancements in table tab in alert/event flyout. Note that PR elastic/kibana#218686 is not behind a feature flag, so once merged it will take effect in Serverless.

Users can now:

• Pin and unpin fields of choice
• Access table settings such as:
  • Show highlighted fields only
  • Hide empty fields
  • Hide alert related fields (field name starts with kibana.alert. and signal)

We should update docs to highlighted the pinning feature and update screenshots (if needed)

Resources

PR: elastic/kibana#218686
Issues: https://github.com/elastic/security-team/issues/9379, https://github.com/elastic/security-team/issues/9513

Which documentation set does this change impact?

Elastic On-Prem and Cloud (all)

Feature differences

No difference

What release is this request related to?

N/A

Collaboration model

The documentation team

Point of contact.

Main contact: @christineweng

Stakeholders: @paulewing

[nastasha-solomon]

This likely needs release notes only as the menu is self-descriptive.

[nastasha-solomon]

@christineweng here are my suggestions. Feel free to drop your questions or suggestions as comments in the google doc. Thanks!

cc: @paulewing

[nastasha-solomon]

Re-opening this after discussing community feedback that @nerophon received:

As for the field hiding, the PR does explain which fields would be hidden - but the setting itself (and documentation currently) does not, making the users guess or go to source.

I'll be adding docs for these options to the page that explains the alert details flyout. the page about the alert details flyout.

• 8.19 docs: https://www.elastic.co/guide/en/security/8.19/view-alert-details.html
• 9.1/9.xx/Serverless docs: https://www.elastic.co/docs/solutions/security/detect-and-alert/view-detection-alert-details