Docs for "Alert User Assignment" feature

[e40pud]

Security solution ticket with detailed feature description https://github.com/elastic/security-team/issues/2504

Description

We need to add documentation for the new alert assignments feature. It is planned to merge changes this or next week.

The key items of the Alert User Assignment feature:

• It is possible to assign a user/s to alert/s
• There is a new "Assignees" column in the alerts table which displays avatars of assigned users
• There is a bulk action to update assignees for multiple alerts
• It is possible to see and update assignees inside the alert details flyout component
• There is an "Assignees" filter button on the Alerts page which allows to filter alerts by assignees

This feature will be available in both ESS and Serverless

280417832-8eeb13f3-2d16-4fba-acdf-755024a59fc2.mov

[nastasha-solomon]

Serverless doc updates:

• Alerts | Take actions on alerts:

  • Add bullet to list -- users can assign alerts to users

  • Add new section for assigning alerts, removing assignees, and filtering assigned alerts from the Alerts page. Place the new section between the Apply and filter alert tags and Add an endpoint exception from an alert sections. A couple of additional notes on this new content:

    • When users filter for alerts assigned to specific assignees using the Assignees filter above the Alerts table, this doesn't affect KQL query at the top of the page. Example:
      
    • Add a reference to the alert details page, where there's functionality that allows users to add assignees to an alert. Note: Users can also assign alerts to users from the alert details flyout in Timeline.
    • The Remove all assignees option in the bulk overflow menu is used to bulk unassign users.
    • This iteration of the feature doesn't include email or other notification types. In other words, users are not notified that they're assigned to an alert.
    • Up to four assignee avatars show up in the table. Five or more assignees are shown as a number badge.

  • Update the following outdated images that show older versions of the bulk actions menu:

    • -detections-alert-change-status.png
    • -detections-bulk-add-alerts-to-timeline.png

• View detection alert details

  • Update -detections-open-alert-details-flyout.gif

• Right panel

  • Update -detections-alert-details-flyout-right-panel.png
  • In list under the screenshot, explain how to add assignees. Note: Will need to refresh the Share alert feature description since the flyout UI design has changed. (issue and PR are TBD)

• Preview panel

  • Update -detections-alert-details-flyout-preview-panel.gif

• Left panel

  • Update -detections-expand-details-button.png

• Alert schema

  • Document the kibana.alert.workflow_assignee_ids field. A few notes about this new field:
    • Description: Is an array of user profile IDs. User profile IDs (string) are a unique identifier for the user profile.
    • Type: string
    • Multiple assignees are represented as an array
    • The field value is the user profile ID. ATM, there's no easy way to find this in Kibana. Might be worth explaining how to find the UID:
      To find UIDs, open an alert's details, go to the Table tab, and search for the kibana.alert.workflow_assignee_ids field.

[nastasha-solomon]

UI copy work being tracked in #4295

[nastasha-solomon]

@e40pud and @yctercero - https://github.com/elastic/staging-serverless-security-docs/pull/232 contains a first draft of the alert assignment feature docs. I'm going to update all the outdated screenshots, add some ones, and finalize the content once I'm back from PTO.

cc: @jmikell821