ES|QL tab added to Timeline

docs/events/timeline-ui-overview.asciidoc

@@ -178,3 +178,29 @@ From the *Correlation* tab, you can also do the following:
 * Specify the date and time range that you want to investigate.
 * Reorder the columns and choose which fields to display.
 * Choose a data view and whether to show detection alerts only.
+
+[discrete]
+[[esql-in-timeline]]
+== Use ES|QL to interact with alerts 
+
+preview::[]
+
+The {ref}/esql.html[Elasticsearch Query Language (ES|QL)] provides a powerful way to filter, transform, and analyze alert data stored in Elasticsearch. ES|QL queries use "pipes" to manipulate and transform data in a step-by-step fashion. This approach allows you to compose a series of operations, where the output of one operation becomes the input for the next, enabling complex data transformations and analysis.
+
+You can use ES|QL in Timeline by opening the **ES|QL** tab. From the tab, you can: 
+
+- Explore your alerts using the default query, or creating a custom one. The default query searches the Security alert index (`.alerts-security.alerts-default`) and  indices specified in the <<update-sec-indices,Security data view>> for alerts that were generated during the last 15 minutes. The query's output is limited to the top ten results.
+- Click the help icon (image:images/esql-ref-button.png[Click the ES|QL reference button,20,20]) on the far right side of the query editor to open the in-product reference documentation for all ES|QL commands and functions.  
+- Visualize query results using {kibana-ref}/discover.html[Discover] functionality that's available in the tab.
+
+[role="screenshot"]
+image::images/esql-tab.png[a Timeline's ES|QL tab]
+
+[discrete]
+[[esql-in-timeline-resources]]
+=== Additional ES|QL resources 
+
+To get started using ES|QL, read the tutorial for {ref}/esql.html[using ES|QL in Kibana]. Much of the functionality that's offered in Kibana is also offered in Timeline.  
+
+To find examples of using ES|QL for threat hunting, check out https://www.elastic.co/blog/introduction-to-esql-new-query-language-flexible-iterative-analytics[our blog].
+