[Internal]: The `How to add non-ECS fields to Attack Discovery` documentation is missing an `Update presets` step

[andrew-goldstein]

Description

What: "The How to add non-ECS fields to Attack Discovery callout in the Set up Attack Discovery documentation is missing an Update presets step, which is required to achieve the task.

When: This feature is in production

Why: Users cannot add additional fields to their anonymization settings without this step.

Consider adding something like:

4. Check the `Update presets` box to add the Allowed fields to the space's default Anonymization settings.

Resources

The documentation is published to https://www.elastic.co/docs/solutions/security/ai/attack-discovery#set-up-attack-discovery

Which documentation set does this change impact?

Elastic On-Prem and Cloud (all)

Feature differences

The feature is identical in all deployment methods.

What release is this request related to?

9.2

Serverless release

This feature is already in production

Collaboration model

The documentation team

Point of contact.

Main contact: @jamesspi

Stakeholders: CC: @andrew-goldstein

[andrew-goldstein]

For additional context, the user must perform the following steps to add additional fields to the (space-specific) Anonymization defaults:

1. In Security > Alerts, open an alert in the flyout
2. Click Ask AI Assistant
3. Expand the > Alert (from summary)
4. Click Edit
5. Click the Allowed toggle for any non-default Anonymization fields
6. Click Update presets
7. Click Save

as illustrated by the following screenshot: