Skip to content

Add OOB alerts and alert rule template as asset type #3537

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 6 commits into from
Oct 22, 2025
Merged

Add OOB alerts and alert rule template as asset type #3537

merged 6 commits into from
Oct 22, 2025

Conversation

@karenzone
Copy link
Contributor

@karenzone karenzone commented Oct 17, 2025 •
edited
Loading

Related:
#2760

This PR:

  • Adds OOB alert rules for Elastic Agent
  • Adds alert templates to list of assets included with integrations
  • Restructures content for better flow and to replace several notes and admonitions with heads for better scanability and SEO performance

To Do:

  • Confirm license requirements in content and subscription page
  • List alerts
  • Add example(s) of alerts as integration assets

@karenzone karenzone self-assigned this Oct 17, 2025
@karenzone karenzone changed the title Alert rule template as asset type Add OOB alerts and alert rule template as asset type Oct 20, 2025
@github-actions
Copy link

github-actions bot commented Oct 20, 2025 •
edited
Loading

🔍 Preview links for changed docs

@karenzone karenzone marked this pull request as ready for review October 20, 2025 00:34
@karenzone karenzone requested a review from a team as a code owner October 20, 2025 00:34
@karenzone
Copy link
Contributor Author

cc:/ @nimarezainia @MichelLosier @nchaulet @kpollich Here's a draft. Please let me know what you think, and we can iterate.

@nimarezainia
Copy link

Thank you @karenzone
For the Elastic Agent ootb rules we need to provide more detail IMO. Examples of some of these alerts (as documented I the issue) and what they provide the user. @MichelLosier has explained them here for the alerts that will be in the package.

I think we need to document the alert name, condition it is looking for and a blurb description for it (which could just be copy+past from the issue).

Regarding the alerts as integration assets: if we have an example to show that would be great. I know that this content is very much dependent on what the package owner adds to their package.

vishaangelova
vishaangelova reviewed Oct 20, 2025
View reviewed changes
vishaangelova
vishaangelova reviewed Oct 20, 2025
View reviewed changes
@vishaangelova vishaangelova requested a review from a team October 20, 2025 11:22
MichelLosier
MichelLosier reviewed Oct 21, 2025
View reviewed changes
vishaangelova
vishaangelova approved these changes Oct 22, 2025
View reviewed changes
Copy link
Contributor

@vishaangelova vishaangelova left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @karenzone! LGMT 🚀 Just left some small suggestions for your consideration.

@karenzone
Copy link
Contributor Author

@vishaangelova, thank you for the review! I'm merging this now and putting up a follow-up PR to add alerts as they firm up. I'll address your comments then.

@karenzone karenzone merged commit ac79eec into elastic:main Oct 22, 2025
7 checks passed
@karenzone karenzone deleted the 2760-alert-rule branch October 22, 2025 13:44
This was referenced Oct 22, 2025
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@MichelLosier MichelLosier MichelLosier left review comments

@vishaangelova vishaangelova vishaangelova approved these changes

@nimarezainia nimarezainia nimarezainia approved these changes

Assignees

@karenzone karenzone

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@karenzone @nimarezainia @MichelLosier @vishaangelova