From 5c199b0c6ff8f11cfe1647af35ea8854e5273981 Mon Sep 17 00:00:00 2001 From: Stef Nestor <26751266+stefnestor@users.noreply.github.com> Date: Wed, 17 Jul 2024 14:02:17 -0600 Subject: [PATCH] (Doc+) Alerts UI cannot be CCS (#5513) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * (Doc+) Alerts UI cannot be CCS 👋 howdy, team! Playing forward a couple ballpark Githubs (kindly see their sub-internal-links) https://github.com/elastic/security-docs/issues/4653 , https://github.com/elastic/kibana/issues/172534 , can we expand [this doc's](https://www.elastic.co/guide/en/security/master/data-views-in-sec.html#_create_or_modify_a_data_view) note to more heavily indicate even CCS is not possible on the Alerts UI? * feedback Co-authored-by: Joe Peeples --------- Co-authored-by: Joe Peeples --- docs/getting-started/data-views-in-sec.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started/data-views-in-sec.asciidoc b/docs/getting-started/data-views-in-sec.asciidoc index 50d4248761..7b0d75074b 100644 --- a/docs/getting-started/data-views-in-sec.asciidoc +++ b/docs/getting-started/data-views-in-sec.asciidoc @@ -28,7 +28,7 @@ image::images/dataview-filter-example.gif[video showing how to filter the active This only allows you to add index patterns that match indices that currently contain data (other index patterns are unavailable). Note that any changes made are saved in the current browser window and won't persist if you open a new tab. -NOTE: You cannot update the data view for the Alerts page. It always shows data from `.alerts-security.alerts-default`. +NOTE: You cannot update the data view for the Alerts page. This includes referencing a cross-cluster search (CCS) data view or any other data view. The Alerts page always shows data from `.alerts-security.alerts-default`. [discrete] [[default-data-view-security]]