elastic · nastasha-solomon · Oct 29, 2024 · Oct 20, 2024 · Oct 20, 2024 · Oct 21, 2024
@@ -128,6 +128,28 @@ Click **Visualizations** to display the following previews:
 
 * **Analyzer preview**: Shows a preview of the <<visual-event-analyzer,visual analyzer graph>>. The preview displays up to three levels of the analyzed event's ancestors and up to three levels of the event's descendants and children. The ellipses symbol (**`...`**) indicates the event has more ancestors and descendants to examine. Click **Analyzer preview** to open the **Event Analyzer** tab in Timeline.
 
+[discrete]
+[[expanded-visualizations-view]]
+=== Expanded visualizations view
+
+preview:[]
+
+.Requirements
+[sidebar]
+--
+To use the **Visualize** tab, you must turn on the `securitySolution:enableVisualizationsInFlyout` <<visualizations-in-flyout,advanced setting>>. 
+--
+
+The **Visualize** tab allows you to maintain the context of the Alerts table, while providing a more detailed view of alerts that you're investigating in the event analyzer or session view. To open the tab, click **Session view preview** or **Analyzer preview** from the right panel. 
+
+[role="screenshot"]
+image::images/visualize-tab-lp.png[Expanded view of visualization details, 70%]
+
+As you examine the alert's related processes, you can also preview the alerts and events which are associated with those processes. Then, if you want to learn more about a particular alert or event, you can click **Show full alert details** to open the full details flyout.
+
+[role="screenshot"]
+image::images/visualize-tab-lp-alert-details.gif[Examine alert details from event analyzer, 65%] 
+
 [discrete]
 [[insights-section]]
 == Insights 

@@ -29,7 +29,9 @@ Or
 +
 ** `agent.type:"winlogbeat" and event.module: "sysmon" and process.entity_id : *`
 
-. Events that can be visually analyzed are denoted by a cubical **Analyze event** icon. Select this option to open the event in the visual analyzer. Alternatively, open the alert details flyout, go to the Visualizations section, then click **Analyzer preview**. This opens the **Analyzer** tab in Timeline.
+. Events that can be visually analyzed are denoted by a cubical **Analyze event** icon. Select this option to open the event in the visual analyzer. The event analyzer is accessible from the Hosts, Alerts, and Timelines pages, as well as the alert details flyout. 
++
+TIP: Turn on the `securitySolution:enableVisualizationsInFlyout` <<visualizations-in-flyout,advanced setting>> to access the event analyzer from the **Visualize** tab in the alert or event details flyout.
 
 +
 [role="screenshot"]

@@ -113,6 +113,14 @@ The `securitySolution:enableAssetCriticality` setting determines whether asset c
 
 Including data from cold and frozen {ref}/data-tiers.html[data tiers] in <<visual-event-analyzer, visual event analyzer>> queries may result in performance degradation. The `securitySolution:excludeColdAndFrozenTiersInAnalyzer` setting allows you to exclude this data from analyzer queries. This setting is turned off by default.
 
+[discrete]
+[[visualizations-in-flyout]]
+== Access the event analyzer and session view from the event or alert details flyout
+
+preview:[]
+
+The `securitySolution:enableVisualizationsInFlyout` setting allows you to access the event analyzer and session viewer in the **Visualize** tab on the alert or event details flyout. This setting is turned off by default. 
+
 [discrete]
 == Change the default search interval and data refresh time
 

@@ -128,6 +128,24 @@ Click **Visualizations** to display the following previews:
 
 * **Analyzer preview**: Shows a preview of the <DocLink slug="/serverless/security/visual-event-analyzer">visual analyzer graph</DocLink>. The preview displays up to three levels of the analyzed event's ancestors and up to three levels of the event's descendants and children. The ellipses symbol (**`...`**) indicates the event has more ancestors and descendants to examine. Click **Analyzer preview** to open the **Event Analyzer** tab in Timeline.
 
+<div id="expanded-visualizations-view"></div>
+
+### Expanded visualizations view
+
+<DocCallOut template="technical_preview" />
+
+<DocCallOut title="Requirements">
+To use the **Visualize** tab, you must turn on the `securitySolution:enableVisualizationsInFlyout` <DocLink slug="/serverless/security/advanced-settings" section="visualizations-in-flyout" >advanced setting</DocLink>.
+</DocCallOut>
+
+The **Visualize** tab allows you to maintain the context of the Alerts table, while providing a more detailed view of alerts that you're investigating in the event analyzer or session view. To open the tab, click **Session view preview** or **Analyzer preview** from the right panel. 
+
+<DocImage size="l" url="../images/view-alert-details/-detections-visualize-tab-lp.png" alt="Expanded view of visualization details"/>
+
+As you examine the alert's related processes, you can also preview the alerts and events which are associated with those processes. Then, if you want to learn more about a particular alert or event, you can click **Show full alert details** to open the full details flyout.
+
+![Examine alert details from event analyzer](../images/view-alert-details/-detections-visualize-tab-lp-alert-details.gif)
+
 <div id="insights-section"></div>
 
 ## Insights 

@@ -39,7 +39,11 @@ To find events that can be visually analyzed:
 
     * `agent.type:"winlogbeat" and event.module: "sysmon" and process.entity_id : *`
 
-1. Events that can be visually analyzed are denoted by a cubical **Analyze event** icon. Select this option to open the event in the visual analyzer.
+1. Events that can be visually analyzed are denoted by a cubical **Analyze event** icon. Select this option to open the event in the visual analyzer. The event analyzer is accessible from the Hosts, Alerts, and Timelines pages, as well as the alert details flyout. 
+
+    <DocCallOut title="Tip">
+    Turn on the `securitySolution:enableVisualizationsInFlyout` <DocLink slug="/serverless/security/advanced-settings" section="visualizations-in-flyout">advanced setting</DocLink> to access the event analyzer from the **Visualize** tab in the alert or event details flyout.
+     </DocCallOut>
 
     <DocImage size="xl" url="../images/visual-event-analyzer/-detections-analyze-event-button.png" alt="Shows analyze event option" />
 

@@ -134,6 +134,14 @@ The `securitySolution:enableAssetCriticality` setting determines whether asset c
 
 Including data from cold and frozen [data tiers](((ref))/data-tiers.html) in <DocLink slug="/serverless/security/visual-event-analyzer">visual event analyzer</DocLink> queries may result in performance degradation. The `securitySolution:excludeColdAndFrozenTiersInAnalyzer` setting allows you to exclude this data from analyzer queries. This setting is turned off by default.
 
+<div id="visualizations-in-flyout"></div>
+
+## Access the event analyzer and session view from the event or alert details flyout 
+
+<DocCallOut template="technical_preview" />
+
+The `securitySolution:enableVisualizationsInFlyout` setting allows you to access the event analyzer and session viewer in the **Visualize** tab on the alert or event details flyout. This setting is turned off by default. 
+
 ## Change the default search interval and data refresh time
 
 These settings determine the default time interval and refresh rate ((elastic-sec))