Wrong details in Session Viewer preview for non session alert in documentation

[ghost]

Description

Wrong details in Session Viewer preview for non session alert in documentation

Steps

• Navigate to https://www.elastic.co/guide/en/security/8.10/view-alert-details.html#visualizations-section
• incorrect details of session showing in documentation

Expected

Screen-Shot:

[nastasha-solomon]

Hey, thanks for filing this, @karanbirsingh-qasource. I think the current screenshot is still correct, since it shows what users would see if they had enabled the session view features. @christineweng would you mind verifying whether the screenshot that's currently in the docs is correct: https://www.elastic.co/guide/en/security/current/view-alert-details.html#visualizations-section

Thanks, both!

[christineweng]

@karanbirsingh-qasource I think the screenshot is correct as well, just to clarify, the error message (expected screenshot) should be present when session view icon is not available

I wonder if unknown and fake entry somewhat indicate there is an error? @nastasha-solomon I wonder if other instances have session views that are more meaningful?

[nastasha-solomon]

@karanbirsingh-qasource following up on this, would you mind elaborating on the bug you noticed? I followed with with Christine (above) and the screenshot looks correct from our standpoints.

[ghost]

@nastasha-solomon yes please find below the details we have for this bug.

actually this error "unknow started fake entry at Dec 31, 1969 @ 19:00:00.000 with rule alert suppression" used to show in the early BC of 8.10 release work when the alert does not actually have session data linked with it that why unknown is mentioned where correct user name is expected to show in session preview section but latter we logged the elastic/kibana#164392 and by this new message that is supposed to show when alert doesn't include session data is "You can only view linux details ...." which is what we are expecting to show in documentation.

[nastasha-solomon]

Thanks for the additional context, @karanbirsingh-qasource! When you have a chance, the updates are ready for review at #4051.

[nastasha-solomon]

Serverless docs updated at https://github.com/elastic/staging-serverless-security-docs/pull/198.

[ghost]

Hi @nastasha-solomon

thanks for the update.

we have validated this issue on shared preview and changes are now corrected.

Hence we are Closing this issue and adding "QA:Validated" tag to it.

thanks !!