Minor tweaks

Author: nastasha-solomon

docs/detections/alerts-view-details.asciidoc

@@ -67,13 +67,13 @@ The left panel provides an expanded view of what's shown in the right panel. To
 +
 
 [role="screenshot"]
-image::images/expand-details-button.png[Expand details button at the top of the alert details flyout, 45%]
+image::images/expand-details-button.png[Expand details button at the top of the alert details flyout, 65%]
 
 * Click one of the section titles on the **Overview** tab within the right panel. 
 +
 
 [role="screenshot"]
-image::images/alert-details-flyout-left-panel.png[Left panel of the alert details flyout, 45%]
+image::images/alert-details-flyout-left-panel.png[Left panel of the alert details flyout, 65%]
 
 [discrete]
 [[about-section]]
@@ -201,7 +201,7 @@ From the right panel, click **Threat intelligence** to open the expanded Threat
 NOTE: The expanded threat intelligence view queries indices specified in the `securitySolution:defaultThreatIndex` advanced setting. Refer to <<update-threat-intel-indices, Update default Elastic Security threat intelligence indices>> to learn more about threat intelligence indices. 
 
 [role="screenshot"]
-image::images/expanded-threat-intelligence-view.png[Expanded view of threat intelligence on the alert, 70%]
+image::images/expanded-threat-intelligence-view.png[Expanded view of threat intelligence on the alert, 80%]
 
 The expanded Threat intelligence view shows individual indicators within the alert document. You can expand and collapse indicator details by clicking the arrow button at the end of the indicator label. Each indicator is labeled with values from the `matched.field` and `matched.atomic` fields and displays the threat intelligence provider. 
 
@@ -256,7 +256,7 @@ NOTE: To access data about alerts related by process ancestry, you must have a h
 From the right panel, click **Correlations** to open the expanded Correlations view within the left panel. 
 
 [role="screenshot"]
-image::images/expanded-correlations-view.png[Expanded view of correlation data, 65%]
+image::images/expanded-correlations-view.png[Expanded view of correlation data, 75%]
 
 In the expanded view, corelation data is organized into several tables:
 

docs/events/timeline-ui-overview.asciidoc

@@ -101,7 +101,7 @@ TIP: Collapse the query builder to provide more space for Timeline results by cl
 Click a filter to access additional operations such as *Add filter*, *Clear all*, *Load saved query*, and more:
 
 [role="screenshot"]
-image::images/timeline-ui-filter-options.png[width=30%]
+image::images/timeline-ui-filter-options.png[width=60%]
 
 Here are examples of various types of filters:
 

docs/serverless/alerts/view-alert-details.asciidoc

@@ -75,11 +75,11 @@ The left panel provides an expanded view of what's shown in the right panel. To
 * Click **Expand details** at the top of the right panel.
 +
 [role="screenshot"]
-image:images/view-alert-details/-detections-expand-details-button.png[Expand details button at the top of the alert details flyout, 45%]
+image:images/view-alert-details/-detections-expand-details-button.png[Expand details button at the top of the alert details flyout, 65%]
 * Click one of the section titles on the **Overview** tab within the right panel.
 +
 [role="screenshot"]
-image:images/view-alert-details/-detections-alert-details-flyout-left-panel.png[Left panel of the alert details flyout]
+image:images/view-alert-details/-detections-alert-details-flyout-left-panel.png[Left panel of the alert details flyout, 65%]
 
 [discrete]
 [[about-section]]
@@ -210,7 +210,7 @@ The expanded threat intelligence view queries indices specified in the `security
 ====
 
 [role="screenshot"]
-image::images/view-alert-details/-detections-expanded-threat-intelligence-view.png[Expanded view of threat intelligence on the alert, 70%]
+image::images/view-alert-details/-detections-expanded-threat-intelligence-view.png[Expanded view of threat intelligence on the alert, 80%]
 
 The expanded Threat intelligence view shows individual indicators within the alert document. You can expand and collapse indicator details by clicking the arrow button at the end of the indicator label. Each indicator is labeled with values from the `matched.field` and `matched.atomic` fields and displays the threat intelligence provider.
 
@@ -266,7 +266,7 @@ The Correlations overview provides the following information:
 From the right panel, click **Correlations** to open the expanded Correlations view within the left panel.
 
 [role="screenshot"]
-image::images/view-alert-details/-detections-expanded-correlations-view.png[Expanded view of correlation data, 65%]
+image::images/view-alert-details/-detections-expanded-correlations-view.png[Expanded view of correlation data, 75%]
 
 In the expanded view, corelation data is organized into several tables:
 

docs/serverless/investigate/timelines-ui.asciidoc

@@ -112,7 +112,7 @@ Collapse the query builder and provide more space for Timeline results by clicki
 Click a filter to access additional operations such as **Add filter**, **Clear all**, **Load saved query**, and more:
 
 [role="screenshot"]
-image::images/timelines-ui/-events-timeline-ui-filter-options.png[width=30%]
+image::images/timelines-ui/-events-timeline-ui-filter-options.png[width=60%]
 
 Here are examples of various types of filters:
 

docs/serverless/rules/interactive-investigation-guides.asciidoc

@@ -9,7 +9,7 @@ preview:[]
 Detection rule investigation guides suggest steps for triaging, analyzing, and responding to potential security issues. For custom rules, you can create an interactive investigation guide that includes buttons for launching runtime queries in <<security-timelines-ui,Timeline>>, using alert data and hard-coded literal values. This allows you to start detailed Timeline investigations directly from an alert using relevant data.
 
 [role="screenshot"]
-image::images/interactive-investigation-guides/-detections-ig-alert-flyout.png[Alert details flyout with interactive investigation guide]
+image::images/interactive-investigation-guides/-detections-ig-alert-flyout.png[Alert details flyout with interactive investigation guide,400]
 
 Under the Investigation section, click **Show investigation guide** to open the **Investigation** tab in the left panel of the alert details flyout.