Merge branch 'main' into 5606-cspm-agentless-onboard-beta

benironside · web-flow · commit 6084b216adb3 · 2024-10-31T16:26:35.000-04:00
diff --git a/.mergify.yml b/.mergify.yml
@@ -13,6 +13,19 @@ pull_request_rules:
             git merge upstream/{{base}}
             git push upstream {{head}}
             ```
+  - name: backport patches to main branch
+    conditions:
+      - merged
+      - label=backport-main
+    actions:
+      backport:
+        assignees:
+          - "{{ author }}"
+        labels:
+          - "backport"
+        branches:
+          - "main"
+        title: "[{{ destination_branch }}] {{ title }} (backport #{{ number }})"
   - name: backport patches to 8.17 branch
     conditions:
       - merged
diff --git a/docs/advanced-entity-analytics/api/asset-criticality-api-overview.asciidoc b/docs/advanced-entity-analytics/api/asset-criticality-api-overview.asciidoc
@@ -8,4 +8,4 @@
 For the most up-to-date API details, refer to {api-kibana}/group/endpoint-security-entity-analytics-api[Entity Analytics APIs].
 --
 
-You can manage <<asset-criticality, asset criticality>> records through the API. To use this API, you must first turn on the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>>.
+You can manage <<asset-criticality, asset criticality>> records through the API.
diff --git a/docs/advanced-entity-analytics/asset-criticality.asciidoc b/docs/advanced-entity-analytics/asset-criticality.asciidoc
@@ -4,12 +4,7 @@
 .Requirements
 [sidebar]
 --
-To view and assign asset criticality, you must:
-
-* Have the appropriate user role.
-* Turn on the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>>.
-
-For more information, refer to <<ers-requirements, Entity risk scoring prerequisites>>.
+To view and assign asset criticality, you must have the appropriate user role. For more information, refer to <<ers-requirements, Entity risk scoring prerequisites>>.
 --
 
 The asset criticality feature allows you to classify your organization's entities based on various operational factors that are important to your organization. Through this classification, you can improve your threat detection capabilities by focusing your alert triage, threat-hunting, and investigation activities on high-impact entities.
diff --git a/docs/advanced-entity-analytics/entity-risk-scoring.asciidoc b/docs/advanced-entity-analytics/entity-risk-scoring.asciidoc
@@ -30,11 +30,7 @@ Entity risk scores are determined by the following risk inputs:
 
 The resulting entity risk scores are stored in the `risk-score.risk-score-<space-id>` data stream alias.
 
-[NOTE]
-======
-* Entities without any alerts, or with only `Closed` alerts, are not assigned a risk score.
-* To use asset criticality, you must enable the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>>.
-======
+NOTE: Entities without any alerts, or with only `Closed` alerts, are not assigned a risk score.
 
 [discrete]
 [[how-is-risk-score-calculated]]
diff --git a/docs/advanced-entity-analytics/ers-req.asciidoc b/docs/advanced-entity-analytics/ers-req.asciidoc
@@ -45,8 +45,6 @@ The risk scoring engine uses an internal user role to score all hosts and users,
 [discrete]
 == Asset criticality
 
-To use the asset criticality feature, turn on the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>>.
-
 [discrete]
 === Privileges
 
diff --git a/docs/detections/alerts-view-details.asciidoc b/docs/detections/alerts-view-details.asciidoc
@@ -124,10 +124,32 @@ image::images/visualizations-section-rp.png[Visualizations section of the Overvi
 
 Click **Visualizations** to display the following previews:
 
-* **Session view preview**: Shows a preview of <<session-view,session view>> data. Click **Session viewer preview** to open the **Session View** tab in Timeline. 
+* **Session viewer preview**: Shows a preview of <<session-view,Session View>> data. Click **Session viewer preview** to open the **Session View** tab in Timeline. 
 
 * **Analyzer preview**: Shows a preview of the <<visual-event-analyzer,visual analyzer graph>>. The preview displays up to three levels of the analyzed event's ancestors and up to three levels of the event's descendants and children. The ellipses symbol (**`...`**) indicates the event has more ancestors and descendants to examine. Click **Analyzer preview** to open the **Event Analyzer** tab in Timeline.
 
+[discrete]
+[[expanded-visualizations-view]]
+=== Expanded visualizations view
+
+preview::[]
+
+.Requirements
+[sidebar]
+--
+To use the **Visualize** tab, you must turn on the `securitySolution:enableVisualizationsInFlyout` <<visualizations-in-flyout,advanced setting>>. 
+--
+
+The **Visualize** tab allows you to maintain the context of the Alerts table, while providing a more detailed view of alerts that you're investigating in the event analyzer or Session View. To open the tab, click **Session viewer preview** or **Analyzer preview** from the right panel. 
+
+[role="screenshot"]
+image::images/visualize-tab-lp.png[Expanded view of visualization details, 80%]
+
+As you examine the alert's related processes, you can also preview the alerts and events which are associated with those processes. Then, if you want to learn more about a particular alert or event, you can click **Show full alert details** to open the full details flyout.
+
+[role="screenshot"]
+image::images/visualize-tab-lp-alert-details.gif[Examine alert details from event analyzer, 80%] 
+
 [discrete]
 [[insights-section]]
 == Insights 
diff --git a/docs/detections/images/visualize-tab-lp-alert-details.gif b/docs/detections/images/visualize-tab-lp-alert-details.gif
diff --git a/docs/detections/images/visualize-tab-lp.png b/docs/detections/images/visualize-tab-lp.png
diff --git a/docs/detections/visual-event-analyzer.asciidoc b/docs/detections/visual-event-analyzer.asciidoc
@@ -29,7 +29,9 @@ Or
 +
 ** `agent.type:"winlogbeat" and event.module: "sysmon" and process.entity_id : *`
 
-. Events that can be visually analyzed are denoted by a cubical **Analyze event** icon. Select this option to open the event in the visual analyzer. Alternatively, open the alert details flyout, go to the Visualizations section, then click **Analyzer preview**. This opens the **Analyzer** tab in Timeline.
+. Events that can be visually analyzed are denoted by a cubical **Analyze event** icon. Select this option to open the event in the visual analyzer. The event analyzer is accessible from the **Hosts**, **Alerts**, and **Timelines** pages, as well as the alert details flyout. 
++
+TIP: Turn on the `securitySolution:enableVisualizationsInFlyout` <<visualizations-in-flyout,advanced setting>> to access the event analyzer from the **Visualize** tab in the alert or event details flyout.
 
 +
 [role="screenshot"]
diff --git a/docs/getting-started/advanced-setting.asciidoc b/docs/getting-started/advanced-setting.asciidoc
@@ -102,17 +102,20 @@ Security *Overview* page.
 * `securitySolution:newsFeedUrl`: The URL from which the security news feed content is
 retrieved.
 
-[discrete]
-[[enable-asset-criticality]]
-== Enable asset criticality workflows
-The `securitySolution:enableAssetCriticality` setting determines whether asset criticality is included as a risk input to entity risk scoring. This setting is turned off by default. Turn it on to enable asset criticality workflows and to use asset criticality as part of entity risk scoring.
-
 [discrete]
 [[exclude-cold-frozen-tiers]]
 == Exclude cold and frozen tier data from analyzer queries
 
 Including data from cold and frozen {ref}/data-tiers.html[data tiers] in <<visual-event-analyzer, visual event analyzer>> queries may result in performance degradation. The `securitySolution:excludeColdAndFrozenTiersInAnalyzer` setting allows you to exclude this data from analyzer queries. This setting is turned off by default.
 
+[discrete]
+[[visualizations-in-flyout]]
+== Access the event analyzer and Session View from the event or alert details flyout
+
+preview::[]
+
+The `securitySolution:enableVisualizationsInFlyout` setting allows you to access the event analyzer and Session View in the **Visualize** <<expanded-visualizations-view,tab>> on the alert or event details flyout. This setting is turned off by default. 
+
 [discrete]
 == Change the default search interval and data refresh time
 
diff --git a/docs/getting-started/users-page.asciidoc b/docs/getting-started/users-page.asciidoc
@@ -36,7 +36,7 @@ A user's details page displays all relevant information for the selected user. T
 
 The user details page includes the following sections: 
 
-* **Asset Criticality**: If the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>> is on, this section displays the user's current <<asset-criticality, asset criticality level>>.
+* **Asset Criticality**: This section displays the user's current <<asset-criticality, asset criticality level>>.
 
 * *Summary*: Details such as the user ID, when the user was first and last seen, the associated IP address(es), and operating system. If the user risk score feature is enabled, this section also displays user risk score data. 
 
@@ -99,12 +99,6 @@ image::images/users/user-risk-inputs.png[User risk inputs]
 [[user-asset-criticality-section]]
 === Asset Criticality
 
-.Requirements
-[sidebar]
---
-The **Asset Criticality** section is only available if the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>> is on.
---
-
 The **Asset Criticality** section displays the selected user's <<asset-criticality, asset criticality level>>. Asset criticality contributes to the overall <<entity-risk-scoring, user risk score>>. The criticality level defines how impactful the user is when calculating the risk score.
 
 [role="screenshot"]
diff --git a/docs/management/hosts/hosts-overview.asciidoc b/docs/management/hosts/hosts-overview.asciidoc
@@ -42,7 +42,7 @@ A host's details page displays all relevant information for the selected host. T
 
 The host details page includes the following sections: 
 
-* **Asset Criticality**: If the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>> is on, this section displays the host's current <<asset-criticality, asset criticality level>>.
+* **Asset Criticality**: This section displays the host's current <<asset-criticality, asset criticality level>>.
 * *Summary*: Details such as the host ID, when the host was first and last seen, the associated IP addresses, and associated operating system. If the host risk score feature is enabled, this section also displays host risk score data. 
 * *Alert metrics*: The total number of alerts by severity, rule, and status (`Open`, `Acknowledged`, or `Closed`).  
 * *Data tables*: The same data tables as on the main Hosts page, except with values for the selected host instead of all hosts. 
@@ -102,12 +102,6 @@ image::images/host-risk-inputs.png[Host risk inputs]
 [[host-asset-criticality-section]]
 === Asset Criticality
 
-.Requirements
-[sidebar]
---
-The **Asset Criticality** section is only available if the `securitySolution:enableAssetCriticality` <<enable-asset-criticality, advanced setting>> is on.
---
-
 The **Asset Criticality** section displays the selected host's <<asset-criticality, asset criticality level>>. Asset criticality contributes to the overall <<entity-risk-scoring, host risk score>>. The criticality level defines how impactful the host is when calculating the risk score.
 
 [role="screenshot"]
diff --git a/docs/serverless/advanced-entity-analytics/asset-criticality.mdx b/docs/serverless/advanced-entity-analytics/asset-criticality.mdx
@@ -9,11 +9,7 @@ status: in review
 <DocBadge template="technical preview" />
 
 <DocCallOut title="Requirements">
-To view and assign asset criticality, you must:
-* Have the appropriate user role.
-* Turn on the `securitySolution:enableAssetCriticality` <DocLink slug="/serverless/security/advanced-settings" section="enable-asset-criticality-workflows" >advanced setting</DocLink>.
-
-For more information, refer to <DocLink slug="/serverless/security/ers-requirements">Entity risk scoring prerequisites</DocLink>.
+To view and assign asset criticality, you must have the appropriate user role. For more information, refer to <DocLink slug="/serverless/security/ers-requirements">Entity risk scoring prerequisites</DocLink>.
 </DocCallOut>
 
 The asset criticality feature allows you to classify your organization's entities based on various operational factors that are important to your organization. Through this classification, you can improve your threat detection capabilities by focusing your alert triage, threat-hunting, and investigation activities on high-impact entities.
diff --git a/docs/serverless/advanced-entity-analytics/entity-risk-scoring.mdx b/docs/serverless/advanced-entity-analytics/entity-risk-scoring.mdx
@@ -42,8 +42,7 @@ The resulting entity risk scores are stored in the `risk-score.risk-score-<space
 
 <DocCallOut title="Note">
 
-* Entities without any alerts, or with only `Closed` alerts, are not assigned a risk score.
-* To use asset criticality, you must enable the `securitySolution:enableAssetCriticality` <DocLink slug="/serverless/security/advanced-settings" section="enable-asset-criticality-workflows" >advanced setting</DocLink>.
+Entities without any alerts, or with only `Closed` alerts, are not assigned a risk score.
 
 </DocCallOut>
 
diff --git a/docs/serverless/advanced-entity-analytics/ers-req.mdx b/docs/serverless/advanced-entity-analytics/ers-req.mdx
@@ -41,8 +41,6 @@ To turn on the risk scoring engine, you need either the appropriate <DocLink slu
 
 ## Asset criticality
 
-To use the asset criticality feature, turn on the `securitySolution:enableAssetCriticality` <DocLink slug="/serverless/security/advanced-settings" section="enable-asset-criticality-workflows" >advanced setting</DocLink>.
-
 ### User roles
 
 To use asset criticality, you need either the appropriate <DocLink slug="/serverless/general/assign-user-roles">predefined Security user role</DocLink> or a <DocLink slug="/serverless/custom-roles">custom role</DocLink> with the right privileges:
diff --git a/docs/serverless/alerts/view-alert-details.mdx b/docs/serverless/alerts/view-alert-details.mdx
@@ -124,10 +124,28 @@ The Visualizations section is located on the **Overview** tab in the right panel
 
 Click **Visualizations** to display the following previews:
 
-* **Session view preview**: Shows a preview of <DocLink slug="/serverless/security/session-view">session view</DocLink> data. Click **Session viewer preview** to open the **Session View** tab in Timeline. 
+* **Session view preview**: Shows a preview of <DocLink slug="/serverless/security/session-view">Session View</DocLink> data. Click **Session viewer preview** to open the **Session View** tab in Timeline. 
 
 * **Analyzer preview**: Shows a preview of the <DocLink slug="/serverless/security/visual-event-analyzer">visual analyzer graph</DocLink>. The preview displays up to three levels of the analyzed event's ancestors and up to three levels of the event's descendants and children. The ellipses symbol (**`...`**) indicates the event has more ancestors and descendants to examine. Click **Analyzer preview** to open the **Event Analyzer** tab in Timeline.
 
+<div id="expanded-visualizations-view"></div>
+
+### Expanded visualizations view
+
+<DocCallOut template="technical_preview" />
+
+<DocCallOut title="Requirements">
+To use the **Visualize** tab, you must turn on the `securitySolution:enableVisualizationsInFlyout` <DocLink slug="/serverless/security/advanced-settings" section="visualizations-in-flyout" >advanced setting</DocLink>.
+</DocCallOut>
+
+The **Visualize** tab allows you to maintain the context of the Alerts table, while providing a more detailed view of alerts that you're investigating in the event analyzer or Session View. To open the tab, click **Session view preview** or **Analyzer preview** from the right panel. 
+
+<DocImage size="xl" url="../images/view-alert-details/-detections-visualize-tab-lp.png" alt="Expanded view of visualization details"/>
+
+As you examine the alert's related processes, you can also preview the alerts and events which are associated with those processes. Then, if you want to learn more about a particular alert or event, you can click **Show full alert details** to open the full details flyout.
+
+![Examine alert details from event analyzer](../images/view-alert-details/-detections-visualize-tab-lp-alert-details.gif)
+
 <div id="insights-section"></div>
 
 ## Insights 
diff --git a/docs/serverless/alerts/visual-event-analyzer.mdx b/docs/serverless/alerts/visual-event-analyzer.mdx
@@ -39,7 +39,11 @@ To find events that can be visually analyzed:
 
     * `agent.type:"winlogbeat" and event.module: "sysmon" and process.entity_id : *`
 
-1. Events that can be visually analyzed are denoted by a cubical **Analyze event** icon. Select this option to open the event in the visual analyzer.
+1. Events that can be visually analyzed are denoted by a cubical **Analyze event** icon. Select this option to open the event in the visual analyzer. The event analyzer is accessible from the Hosts, Alerts, and Timelines pages, as well as the alert details flyout. 
+
+    <DocCallOut title="Tip">
+    Turn on the `securitySolution:enableVisualizationsInFlyout` <DocLink slug="/serverless/security/advanced-settings" section="visualizations-in-flyout">advanced setting</DocLink> to access the event analyzer from the **Visualize** tab in the alert or event details flyout.
+     </DocCallOut>
 
     <DocImage size="xl" url="../images/visual-event-analyzer/-detections-analyze-event-button.png" alt="Shows analyze event option" />
 
diff --git a/docs/serverless/explore/hosts-overview.mdx b/docs/serverless/explore/hosts-overview.mdx
@@ -50,7 +50,7 @@ A host's details page displays all relevant information for the selected host. T
 
 The host details page includes the following sections: 
 
-* **Asset Criticality**: If the `securitySolution:enableAssetCriticality` <DocLink slug="/serverless/security/advanced-settings" section="enable-asset-criticality-workflows" >advanced setting</DocLink> is on, this section displays the host's current <DocLink slug="/serverless/security/asset-criticality">asset criticality level</DocLink>.
+* **Asset Criticality**: This section displays the host's current <DocLink slug="/serverless/security/asset-criticality">asset criticality level</DocLink>.
 * **Summary**: Details such as the host ID, when the host was first and last seen, the associated IP addresses, and associated operating system. If the entity risk score feature is enabled, this section also displays host risk score data. 
 * **Alert metrics**: The total number of alerts by severity, rule, and status (`Open`, `Acknowledged`, or `Closed`).  
 * **Data tables**: The same data tables as on the main Hosts page, except with values for the selected host instead of all hosts. 
@@ -99,10 +99,6 @@ If more than 10 alerts contributed to the risk scoring calculation, the remainin
 
 ### Asset Criticality
 
-<DocCallOut title="Requirements">
-The **Asset Criticality** section is only available if the `securitySolution:enableAssetCriticality` <DocLink slug="/serverless/security/advanced-settings" section="enable-asset-criticality-workflows" >advanced setting</DocLink> is on.
-</DocCallOut>
-
 The **Asset Criticality** section displays the selected host's <DocLink slug="/serverless/security/asset-criticality">asset criticality level</DocLink>. Asset criticality contributes to the overall <DocLink slug="/serverless/security/entity-risk-scoring" >host risk score</DocLink>. The criticality level defines how impactful the host is when calculating the risk score.
 
 ![Asset criticality](../images/hosts-overview/-host-asset-criticality.png)
diff --git a/docs/serverless/explore/users-page.mdx b/docs/serverless/explore/users-page.mdx
@@ -41,7 +41,7 @@ A user's details page displays all relevant information for the selected user. T
 
 The user details page includes the following sections: 
 
-* **Asset Criticality**: If the `securitySolution:enableAssetCriticality` <DocLink slug="/serverless/security/advanced-settings" section="enable-asset-criticality-workflows" >advanced setting</DocLink> is on, this section displays the user's current <DocLink slug="/serverless/security/asset-criticality">asset criticality level</DocLink>.
+* **Asset Criticality**: This section displays the user's current <DocLink slug="/serverless/security/asset-criticality">asset criticality level</DocLink>.
 
 * **Summary**: Details such as the user ID, when the user was first and last seen, the associated IP address(es), and operating system. If the entity risk score feature is enabled, this section also displays user risk score data. 
 
@@ -93,10 +93,6 @@ If more than 10 alerts contributed to the risk scoring calculation, the remainin
 
 ### Asset Criticality
 
-<DocCallOut title="Requirement">
-The **Asset Criticality** section is only available if the `securitySolution:enableAssetCriticality` <DocLink slug="/serverless/security/advanced-settings" section="enable-asset-criticality-workflows" >advanced setting</DocLink> is on.
-</DocCallOut>
-
 The **Asset Criticality** section displays the selected user's <DocLink slug="/serverless/security/asset-criticality">asset criticality level</DocLink>. Asset criticality contributes to the overall <DocLink slug="/serverless/security/entity-risk-scoring" >user risk score</DocLink>. The criticality level defines how impactful the user is when calculating the risk score.
 
 ![Asset criticality](../images/users-page/-user-asset-criticality.png)
diff --git a/docs/serverless/images/view-alert-details/-detections-visualize-tab-lp-alert-details.gif b/docs/serverless/images/view-alert-details/-detections-visualize-tab-lp-alert-details.gif
diff --git a/docs/serverless/images/view-alert-details/-detections-visualize-tab-lp.png b/docs/serverless/images/view-alert-details/-detections-visualize-tab-lp.png
diff --git a/docs/serverless/settings/advanced-settings.mdx b/docs/serverless/settings/advanced-settings.mdx

Original file line number	Diff line number	Diff line change
`@@ -29,7 +29,9 @@ Or`
`29`	`29`	`+`
`30`	`30`	** `agent.type:"winlogbeat" and event.module: "sysmon" and process.entity_id : *`
`31`	`31`
`32`		`-. Events that can be visually analyzed are denoted by a cubical Analyze event icon. Select this option to open the event in the visual analyzer. Alternatively, open the alert details flyout, go to the Visualizations section, then click Analyzer preview. This opens the Analyzer tab in Timeline.`
	`32`	`+. Events that can be visually analyzed are denoted by a cubical Analyze event icon. Select this option to open the event in the visual analyzer. The event analyzer is accessible from the Hosts, Alerts, and Timelines pages, as well as the alert details flyout.`
	`33`	`++`
	`34`	+TIP: Turn on the `securitySolution:enableVisualizationsInFlyout` <<visualizations-in-flyout,advanced setting>> to access the event analyzer from the Visualize tab in the alert or event details flyout.
`33`	`35`
`34`	`36`	`+`
`35`	`37`	`[role="screenshot"]`