diff --git a/docs/osquery/osquery-response-action.asciidoc b/docs/osquery/osquery-response-action.asciidoc index f51f72d085..4f5fac0bff 100644 --- a/docs/osquery/osquery-response-action.asciidoc +++ b/docs/osquery/osquery-response-action.asciidoc @@ -16,6 +16,7 @@ Osquery Response Actions allow you to add live queries to custom query rules so * The {kibana-ref}/manage-osquery-integration.html[Osquery manager integration] must be installed. * {agent}'s {fleet-guide}/monitor-elastic-agent.html[status] must be `Healthy`. Refer to {fleet-guide}/fleet-troubleshooting.html[{fleet} Troubleshooting] if it isn't. * Your role must have {kibana-ref}/osquery.html[Osquery feature privileges]. +* You can only add Osquery Response Actions to custom query rules. -- [role="screenshot"]