[Serverless] Document impact of using logsDB for security users

docs/serverless/index.asciidoc

@@ -134,6 +134,7 @@ include::./dashboards/rule-monitoring-dashboard.asciidoc[leveloffset=+3]
 
 include::./rules/detection-engine-overview.asciidoc[leveloffset=+2]
 include::./rules/detections-permissions-section.asciidoc[leveloffset=+3]
+include::./rules/detections-logsdb-impact.asciidoc[leveloffset=+3]
 
 include::./rules/about-rules.asciidoc[leveloffset=+2]
 include::./rules/rules-ui-create.asciidoc[leveloffset=+3]

docs/serverless/rules/detection-engine-overview.asciidoc

@@ -141,3 +141,9 @@ Refer to <<enable-detections-ui,Enable and access detections>> for a list of all
 If you get this message, you do not have the
 <<detections-permissions,required privileges>> to view the **Detections** feature,
 and you should contact your project administrator.
+
+[discrete]
+[[detections-logsdb-index-mode]]
+== Using logsDB index mode 
+
+LogsDB is enabled by default for Elastic serverless. Refer to <<detections-logsdb-index-mode-impact>> to learn more. 

docs/serverless/rules/detections-logsdb-impact.asciidoc

@@ -0,0 +1,63 @@
+[[detections-logsdb-index-mode-impact]]
+= The impact of usage of logsDB index mode with {sec-serverless}
+
+LogsDB is enabled by default for Elastic serverless.
+
+With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`].
+
+During the reconstruction of the `_source`, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications compared] to the original data are possible. There could however happen to be a mismatch between how users expect field values to be formatted.
+
+What does it mean for you?
+
+[discrete]
+[[logsdb-alerts]]
+== Alerts
+
+During alert creation, the `_source` event is copied over into the alert in order to keep reference to the original data. When the logsDB index mode is applied, the `_source` event stored in the alert will be an event reconstructed using synthetic `_source`.
+
+If you are switching to using logsDB index mode, the `_source` field stored in the alert might look different in certain situations:
+
+* {ref}/mapping-source-field.html#synthetic-source-modifications-leaf-arrays[Arrays can be reconstructed differently or deduplicated]
+* {ref}/mapping-source-field.html#synthetic-source-modifications-field-names[Field names] 
+
+Alerts produced by the following rule types could be affected:
+
+* Custom query
+* Event correlation (non-sequence only)
+* Non-aggregate rule types
+
+Alerts that are generated by threshold, {ml}, and event correlation sequence rules are not affected as they do not contain copies of the original source.
+
+[discrete]
+[[logsdb-rule-actions]]
+== Rule actions
+
+While we do not recommend using `_source` for actions, in case when the action relies on the `_source`, the same limitations and changes apply.
+
+If you send out your alerts using actions and then have logic outside of {sec-serverless} that is based on fields being in the format of the original source, their flows may be affected. In particular, affected fields would be array of objects.
+
+We recommend checking and adjusting the rule actions using `_source` before switching to logsDB index mode.
+
+[discrete]
+[[logsdb-runtime-fields]]
+== Runtime fields
+
+Runtime fields on alerts index that reference `_source` may be affected.
+Changes may be needed to the runtime field settings.
+
+Here is an example of accessing `_source` that works with logsDB index mode enabled:
+
+[source,console]
+----
+"source": """  emit(params._source.agent.name + "_____" + doc['agent.name'].value ); """ 
+"source": """  emit(params._source['agent']['name'] + "_____" + doc['agent.name'].value );  """
+"source": """  emit(field('agent.name').get(null) + "_____" + doc['agent.name'].value ); """
+"source": """  emit($('agent.name', null) + "_____" + doc['agent.name'].value ); """
+----
+
+The following will not work with synthetic source (logsDB index mode enabled):
+
+[source,console]
+----
+"source": """  emit(params._source['agent.name'] + "_____" + doc['agent.name'].value );  """
+----