From dc84bfe0e2b0e6da43a534994f785f9fc125c53e Mon Sep 17 00:00:00 2001 From: "nastasha.solomon" Date: Mon, 20 May 2024 14:51:57 -0400 Subject: [PATCH 1/3] rule docs --- docs/detections/images/esql-ref-button.png | Bin 3453 -> 5959 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/docs/detections/images/esql-ref-button.png b/docs/detections/images/esql-ref-button.png index 0907eb64419048cc8d1b383dd5896621fab8b62f..ac6280085814cf69d4d890c0e5b854e7baf56fdb 100644 GIT binary patch delta 5922 zcmb7`#NRyw7-{VpLT-AE(dxztTJBAtSi5>g9@bUgn4 zgy+RIpL1qj%$u2Wt_P|SZXjAqLx}*F3Ks+d5vV9D>ikQCe;7T(`d3}yphyr17wMp& zprxXqz@X*fYU|)+0|F^Wr)6Mk=^B$GP=UW+6taXfvRu4WW<{hDzhw*cs(+qLEFaCs z%oY_hzKzQf6ZNc|vxB3^{7V!qUO5cyvV-9hqJx{vsr;S@pa|`Jx_^>+%4+xQ_FZq^ z%emWKm)HZ#mU;|s3mQ=(ypr@tPEcKV_saoDSt;W3PNVVdUQ~lYd4pTZ7@)*hVhO1fPTB3mAY$b6vv9`nB)iR|yzb0M z-emI37t)sDBR>U5fGDPGlL7lw%ohEnWu`QgzYXZQ40&N@21p71gDXvWpSWVG1n`HuC6H zB;&5j=Q+R1n>=JS3k(=0I)pavc$SPMfzMk!OAq%xWzO*lSnjl(T}yY*No#um4f7^> zYB>Pe%d5Szo3F=|ShAG9=7=lW3m-w;0Tx2qHX1muEl=Vh2{P z=`gE@wqem)iLerZB;Db%rdRO8EH4Ra32e~t)X}eWKc#HZPsGQ!&Cbq3pp&xU;b9HU zRWu2(XgUbg@Zq~H5(L@-gT7C?*(6V>0IS#T@+WAF9@JV%tFq)2XaeS#M+j0kbkkmP zj8H9Nob6uuUd%BD+KM3dQE-)MF6=NaQYRS^3l@gq$)wG0BFXJI3a#iEL46a)gnhrl7b9M7O0&~ZpS zM>G2cN6^cPWSBB+HYho^Iob>16>@>Nh*y7^o!B*cX3g$T+Wt8x`abnuC8@~1X4K#p zd#z5jmXp?zK~RmN7C&HM$-$*JZor{0Ug)L!JB?p%MKP;nLffP1MeKY;M_jw1V3u=|Y5Xewse~}xzBl{hjA=`r29J=C@RwM~MBr!`jSsk;>A=g8IT*(MtJ^B3_M6p^%|t#UghN=i544ExWdFo0Dvr?m@!} z&PJ>967azGOVeYY~A)k_$->|O~z!8)P2k~)#1^Gd)-Fp~_B{3|7vr=K_VAAXmg z>0K9A=I#V!*J9VvmD)Ahx9dtNozoHXFqCL~WTULNY`}0qWW06lsvPJl6y0E?~=yMkH%AXptBZP6YmvBYyGr z8dhx2Y$9Cp zmJ*YKg?SQM6Iy6J^=tN*p?rEh{Q4yegN^U_$o%v?dWDq(pM&@B>x=LUT}FNF%KdZ8 zA46Zse51LBZnpDSYSoZjl<62Mmv*w0c>KWUV!dLq_ZeAZACmvt23Q+de|SsPbuq}F zW>aKyY)oc+*o4*i&hF|P+vhfM z@4v2&PK%H_{~lpmXU{whQy0?>%}1GqU!1#Y=cpP_lh!-Ci>dy6iN)2rjfTfSaNQ;l zQ255eVQYzCjbKUSy9;bp6v^(OtCXZWQ~PcCThTY)RzDXpqiUU;cWbRe){Y7|UBv~z z9+0nAYtzJ2Pu4ZoxL4P8$>5941NI}kv}RvZzM}N}4CnRV8`jp{x23c;1!gSOe*Yof ziRTO4yt@ASAoUnXRjFR7dS!WKdlK9Y@C2A0*2S7tT{#}}tUVng_GPE~PQx;)a;vI{ z9OyYJLmaJz6e9QNPb9ZJiz^l@eKcunYERijIV5hkjrtopN5bM;bIfzfr5u798}oF` zra?m1Lii#tMJ@%0guHWcB^PFo7U976+lvr^TRV=)%3LmSCCLn5m!qJ|n_TJx%{c`sBt0#{y9H(Q}X90CkVqklCBYcGvSc2E(c1*Ud`wjeltwu|p67pN z!CfH-a-Dqw3Lg}5d3L+@0rn4Kw;WHJX)>H<*n?s}Hz&P; zkyl(y7EGEl#Q?>F(W%OxxxT5`sTwoOZv0s8hnTy!m*4J9{#+HH5=Ma8k>Noa9J?Z@ z>d2g>Jw%3saA|LO?)Ka&A zX&RIr{fwZVpgxOuRL^N(8EaYnnKcK}!U^5!B?doql@|#XCPmANai&-WW#fdX4++OQ zBff>pmRh>na`+Zm2HK$p#vFJqCMWM7uOBA5i6)&UC)b{Nw%YcueKVGr!s<37?=4Ej^HSY- zDQ-0dE|VDOY=sCL>!<;}(~iHl4^?Tu`|+g`feR09L2HdHJg3l%{#!b zZlK5P=p*XUu9vFKo?`+-_9AI3mJ7MdxT?;oWQ>74-09WwCQc6hkC)M$cPUyBxkygy zcTmO8_ zoGef4wHYEY)Vg&RW;3?|#TNC2Bmqz(zP~0``!ac`2-IT_YU23sx`d~&!P~8^u9834 zE++foExRspQ0WOAT9`9#_(eMjmS7a0U15A?RAm`*i3Z5pm7qXy|T2c=(HuQqP`x`6qVPwmEt zv@4mVd1+mL3P~Z@!_NUBbf3TIIGax?nQFL&3p)P=+E`4=4P<>=wkaZ9GPmNc9uhX> zvaBa;w`y>UkA6jF4$beU>V@ip|5nMY5oyvR2fhS;wfO0Bs6!j46?bKbkF|MsY~a@& z4Eee9!^#zpfi!oMdB(#_x&>gtyv(VPdFKbvKtGS4MphthFJ|7ByeK~hg`!W@CXNp@ zywEk`qd@g+3N(zG_bL!huVr90D$$cACs|SGuQM00Vj@T9dmem8R&W_a$pq83h;(O! z=pOlX{bK^b#a)6ZfvUQ=8r+gmPEo=?XI09fb4CWf97f|Nmo0s09rrGY zrG-7p3|9LR7S^6K!VYL|#)-3n4c;oFXO+$xIW>5XbV>jFn>GzJ1`A5;e2WahXgTV37*lf3+wtR9)RuNf0KjrsI^*Ng+wja8ZKg*}}2>c%s{K!iU z77qU0-F{YMmJKiRc;_J*>AuhOrl-zRqu;j_7HvWu!>*qW629~gunsV5mdiCBIk7C05*{+JRkMIZ2@$vw9?LFl%uRb}dF)eKmy8-h@1{)~t)|FCX-GH`C--9;&EhtXFBC#vcfnnBSG z;c-|WRMR0wAd5B*)pA@#?d-2tiQA4g)4d*2K|IK?sKWS#&Q6VQOQ-7{(nZ(GEr`E# zFI`v&o9TRpNtV+83vB2=ybv3%nV|WJ!780_JaN{BBoi!L{GraZ@_I~8U0E3-B}!03 z4-oF0VA#GLs)mo>9)J&{_cKX*!75h4ttv8V%u1<^GZo_<<}jShwt*xsW?frl-I4b{ zxLi-N?&a6sPLM3*QZ4$oxuf1>rBy+pqn~COLIay|7@~1?Y@&xT%f?X-OgQ;cnso1! z$tFKNSn(oj7c8qeuCSnsrKv0dmkJ$10P{lHb~TJj?XX!W^52jOLw9U6CHGu(u?TH3 zahfxSQh>u6J)(@)J7>Je>SuZMjs5|Z^}dvoK3UCwulK&cw<)P-?tSfi>qo#o5+FtN zjpR-Q2!2lXM7cBvDjx5|MvPBr88@FlMs_%Q4H2rK9n}jlFZL~y;)Us)D0vS9KHHZJ zbP>5>e|9Co*T0&3cIvNFAEvsg962$ZlII8&l?!vly_fc5^k0GvX5{<{qI=iP^o+f|2KLV6Acy12zb^%3OHZw36eq z8Vm<-1{K!&qmZ-P{-%<4z?UT1DDZR`g!z`)eKkIhPIsNxM>v^B+&O=r)v6{er zw6O*E6Z*W$Ng>b&?vs2b+ zG%J|U0u4E+Zv58zfL=c5hmBUy1mcWvkf}t8^6m8#|0=YAZl3$EH^2GH?dMyI4)Wkv zznXR+kqYq7O5%$uM5wR|ghm2NrMYIh%s3wDd~jgLRf!4(X{eMOFV0ya#j{HSvb&uh_GCEj&yvh(2Po%8*#sc0C0A|xddwjk>I45IOvdl2&z#+<-<;aL z(zHp5x`7|@q2W}?n9CcK5?*C#UugWuS2di@Ip>Q|Aa8j`ii0RoMvP=5*$Fs_{D0In z_586RRC$ZfiOmO5`HXy%))3If=;PC@otg5VGy|AaPO%%+TN?fU^M93B8j7{@=Ar)wJ?uJx delta 3399 zcmV-N4Y=~hF8vyRiBL{Q4GJ0x0000DNk~Le0000Y0000e2nGNE0Gr$>qyPX4vuQ&^ zP)S2WAW(8|W@&6?002mdm6r!pQ|S_b|9jIzLQ9B%l+c^>7C=e}Er5b_uo03FLWwaX zfY?x3T)~Qp2$mIH6;ZHJ#D<7sTND(qFUTUGtcwLvQF#}CI0Sd!dGDP!=ggTellf=n zzvut&nF|1!$`OlGVPyc)L{dqZzc)Q5Hja+#14N*XC>fY?xaneMXlO7%WXk?sK6U_T z+}^hw&-L&B|5s7r@zc2gK%odH@Y1{05m)@i^Z=m?}XUMEL1A z3nqDJoD(L07>%BYi3npMtPTL4#NkK;0FVq3KRtshK=P1$5VjHVgd&8I-@qd+Z3z!y zq%JT;V#ElK=Vv7RkVo*hoC)%r9F9QFlY5yEypJ$loXT1De?E@?EorH;sT#(Jl9D6= zVTeWgf*z(U36irYVQ$D23waaq6PzRqh@4_>IxB8}ig_HLAo<$VxxrJMDD-2?^GMkd zQ_N5I4WDAkk}!F#L$(+E@DF(s7AJ9Q0NCi?L0UY25gg^xNQhwI> z83n8*;$;${AW2GRBDaiBXN$O2v*>m!-0bBvs!EJC4w1X$0 z3-p55UOQIq zHHi9*#-b@`I@%KLh7LeSqPgg$=vC-{jp!2eQFINu34I^kjUGaO$B;2v7z>OmhK-5A z2r!wLJWLVhFs2%F4bzV4#eBqKu{5j+))^asjm0Komt!|#_hPHC4cJy}4|W)b!)f3w zaPGJe90w=G<>7YYj^i%l+Hk$NPk05qF5V9BhmXUH@N4l!_+$7>_%?hWew3hpOfVw2 z5<&<(!ZN}Z!XZLE;Vz+inIf+GDK$4L*la7!YNRLSG$z-xI*^3-UmXbG<%gI;C&&i(@DT-E# zY(<{pYQ<8;8pSrnH%bI0BPFJP(juj7r6Q#>N_Uk8l?lqm$}DA$@+#$0<#WoN%EKxY z6gE@nLKV!p;${B4l zM$~7jd#Ur)^VO@=+tt5l&^3HDQZ%+{)M`A_L~ELB&eP1)+^2a>b8segrrS*J%>0?B zXFk?~wam4`w3cff)ViZJtgWN%uPxTzt$kH{P=}`DrIW0)L+6stfG$PXLszJ~L-(@o zE4mt;Nl&F0)0^l+dRlsa0eUjM19~lbqxvTLk@{=(tMs245Dgdxi3U3i8V!aFbq(hj zt}v`Hd~8H8Vi+YE?J{aM8ZkC8jy7IzTx;BKqHe-A$u_Ald1^{F^)y{-T4wsd3~R

~nbNNO7FwxZbhR@tc#glfq!2xV+!+;G9Tc)P52x#05I z)yY-rdfN3bH%qsF6t`n;{j*JG^JgEL-Q%wB&T&8B-sM5}i1+x#qsvpzljB+D`NGS< zi|2LNtB+~MOlBTuzVWv4mUvftkFZ=>D_IRbC?9{He4iFyRo_V865r>3`hEhx3cn$L zNB`yi4FQ;dpnz=woosD3mtD>t3Um%!8Q2s=3JMP@33?HKY#uBLuAc+X37oTi&eOR@ zb47D&LqG^SWP8Z7P?ON5q37pe=Y`HIo%b@#Hf%*$b2ue@arm+Dj}hJxTOyuBnnubZ z8>5t>7DSatjYRuI7e;r*SjVi4xgDz+D~zp+!^K6#9gZ8G?>m3z{N4qQ3-T6pEHqh| zweaR5%|)qyi!Lr!TFhB|CLR+X9e*tTD<_0g#u-jvC+tZW;1y2UbC=5>_>?Hdvjzx;Mu^=ja;Z znv^xat+iQOxc0-k=ymnE+POKoJwN&XRFS8cC&}wv@3wyb&*-0pKeueK->`eb_k3Rd ztpb~Wf}(=28@U^AZL-}|ylHH6;^vkuPFwbE#cmaC?bznI?P#G&VRm89_Bq>YcF=d^ z@A$BD@y?q?4n_NS5qHUUbrlB}*X=gky><83lBAOMQt#5LJz9G<>>1h1+uOF!YhUGl z?fnJ&zx*Qn<>3MU12tvFWkmuA`~rgG=< z@?%=Zwp73svWkJ@3y$AA;d7#{(z5bE6|Jh^BseKM`RY{ssgBb@ryI{O&QzW?I=iQu zQk`D|)hw$Ss!gixs*9~_Jr{VcvEHq|`n=WoBNy~8lwMT3xaAV@QtqX(%h{KQ8^jHN zgI5GsdKwouKDiom^+D6Trj~0#*KS<*yMDEq*?jqi`;7}XU2mSd#kf^_+v#@A9mhM> zzd8O^-Qv_zbJzK9-949k^{um8FSU8LUAgab|M~;=gWK(M+gm##J05l}==ya_YL+?bChdMfi&+J=~txf29BMwKw-A z`DIa`ZeMx7UH^pvzkz$N=D+HFEq*;ZnD?j3pL^bzzB&7s*I##rVupI(O5TpW+xTAN z{gDq29~y^4ho65;`#3t1|4HN1(a(&}&0nIw^o?eI#eFUQX7;WAd(ii%V`*c5V`7ek zGcgLF5QP&H0eE)=0CFq<6l8`V&YzsACj^@O4wxYDpLlZao)9MhDiJe28nGGxIEkon z4ggAC0E~}C5ncecx0mbG{5vtLkBbiStuS8-2!aofH$Bb)|B%T!{)fK*X~B3_2k=k( zFZ^{3m6ApKl>h($Y-LzUW=&0#?Fw0cBA^2R1ONa40RR91C;$Ke03zT}^8f$<32;bR za{vGqB>(^xB>_oNB=7(L0r*KoK~z`??U+4Q0x=NBgU=(#1(d?=*aKjR*KkX0C_D*` zmUsetx8(rPVSye%vGM@QKRR(pvM$L4*ym%KU9w5$m-)yfv|isoK2-zcr~wRr8lf>D z$3BaUALnZJvQ*Q>o9}aywxXY@;xaRHIUvKk$yNbKGZxBa4dmkH!F6pscy1^19^^0T%xFt!08J~6?1Uq1Q1@2t&$kjC!m3BB(0 z>43y)C)dV~PXYpn;q64n)m}k=5X=bjZYSQYCTn6>LgSEW5=r732>^{1Sp<6x-<)U< zqRB&^jj@Ob1i?AF?kN;7sfb)dTYuHI9Req^NQk1kzW);h)mmrLDw{$jxkZr9Jf$}U z5(O()f;~hcNkI77GZrSfYYrf>7O=-TF@j@0FJ?$dTrpA!9mwtZ91wJWv^(3s?MYJn zc0e#`iX!HN Date: Mon, 20 May 2024 16:03:41 -0400 Subject: [PATCH 2/3] Adding image --- docs/events/images/esql-ref-button.png | Bin 0 -> 5959 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 docs/events/images/esql-ref-button.png diff --git a/docs/events/images/esql-ref-button.png b/docs/events/images/esql-ref-button.png new file mode 100644 index 0000000000000000000000000000000000000000..ac6280085814cf69d4d890c0e5b854e7baf56fdb GIT binary patch literal 5959 zcmbVu^;gtU*ZpUPZiE@SM35S~I~9;_5Tv`iks+j{8)>9FhmvkYIt3{uqy`Y_czwR# zcRhc=d)C@#?{)9K>;7`iT02@@RUQwU0viATJVgaL&3~->5Biws|GJA25D5U-2s>F> zbwycOI(2s!Ydc3P08ofd%fL|AG9ZN`1Aad*WDKWgym+a=1WzS=%N*)i|16nMCYqap zIVxs+8=EyI3bUN8gSE)?a}+gBIShQ+LH7~f!9n6!eosIa+WB<9xp?$PbD-oBS} zx4SO72a+mvAKd2CCx?3`X%n3wRTAPpmidtSTfvI z?uD21l@=++m_e!#lV{9_FIZ1ls_AHQD%^r$P{|>&c(uep=kGb2EUHAe4LfedN24se zHrKC}8!X-0#PpKGhjPs0Ek){J{BNAqcAIw2no?d^lnQB)iQB~RYQ6|94bpe-lq2D& z%jZ15%9}i7G70b>COCvP?s$}pC4tUcJW3DuK4#8w^P2CpoLx(F&q-*w2RF0^SdLpcZH%V)_tm&1}VV0*Tr6>k4JazOd-B&(a=p*6rZL^aTKX6huJUpzbwh9&n z38e!-!~5^n2msgt0pBNGt&%4cSFhb3*mb%K1$XYenf}<3v?sXr!EA+V3YzYppF$#*|KY6LS=WRY04=?&~rmM zWR?mz_CfPFc+xI~oLty1`?U2j1VU{3a5J$m`jSq;`T%E0)0UVou@SmnU*s10HGLpT zH_BBn=hicb6ib0Eb5JTYCd9l@M&qoUAr-ZSNC(dPN~h3X<6F7zJi9i*0rY^E;$vyS zZ(FuzN)dqi!){SVfnJed!Pgm#8NB_k`-c0*7hJcZ5wSDF`sPO5j>@ptaD$k!kyP_b zivw;wE+4LkOagsadIbNFhy_Z$+cMohVORZ+Lx}*A$ zZeWd^I*+b7E4%i%E~}16p{LgGG#=>{xvY{24dV);xZ3#sF!rRq2p^5xX?X8bz* z7%jFfR`yVPn+1Pc=1*90DoUTBGx2jLv)$!~<-7|w2Zsv|3!Mv+_7l^mvzrbO+j+aS znd>6OrHcjSg|(uU@*6pv8mmHnJ%@@#jvBVNb=K-OZQnL0nKRu2hh?4gS7k(v0@^Q) zkG+qdQNN=Orf!(T&s7qs^R(+Q?qKO)?AY^+ykPdH@t5f$>iXl)xo_|JQasN1b&oRb z;?g3)bjEMw404*5pNl_=N8du-=5#R8c9ct*2gdElO(ihPi_JaGUCHfltITCh#zg5N z=*<6UYi>_u(KuN=V>zuokm~fw>8-`>a;)R79b&M0{0Jeum}8b_-#zzb4vcVZRzQ^3 zx7lGCiWp$C`@Hr3HaOv##q!C3|4$xtEXFR)PRC-wL8S>FVQlfk_Q5}Wruy2z(7I*v z*7>JxignY}ZcO@qNN|tI# z7$NlD!`(YsXh8%|m{OQYNKa(LLY>?!7B5zSH1=cbSJn((j{JAIMkTc)@1ES7+?BjU ze+dY!dI|(zcCQ4Tpr24(iJyqmcqX7Gn27m{{S_C^)5)9qg4^Y5eAk7ZxjO;bHQRM? zp>&D%>AI3nXLCS13?&#J*(mER8_-)29B*B_s>lz?@2wklS>BilZh!g!C`+mLro#gq zsRc6LeWStm#5a28D;x!ZJkzGRfGyMO6RlB!BT*w9@%+R_eB*6ZEtoN_BAxMqh^#3P z3`ZA6M{D)%P>=k`)rh_D*4OIvB(JDqt_gor8$fQD$6;?s7Kmyf;*uRAw-&K#%5KVP zN7c*F2Epy-?Ql1hv$pH~>xZ)!e**WMvX>+`+}=Olcj73M!VF!V3K#pEKiH76uy4ae zlHiI_ibAQUX~g3d+p!Fd#B9Wo?XVN?6Qw-Tx^TfkpFPq)7|ClXF)8S1C!sZ=g_cvl zW`F6)q}Ll=zhtDd@);kQpPomlu(0E{^ZI>#5q_aXucJ}9e{TL`=qrg&H2cuab{=D` z5`vvP9aZttMv5GV=TotEv9Ntc*4X>xzt;Yix|Z+XQgmGm@}yZ6SsfdY7#udCH$F55 zzl%4Xe7BzbIloDy%m>Y5C@*b#d@zl@3RiEZ=3wgYlz7{xHW9DCE)I^1kUGB}0c$6Z zJXK?7;|;Y($%S8RyGrNC8V|$PJDZEC{(RBJ)w+#_#{f{>rhlP|ncdbB-WuML;CE-( zst|(3PD?&XYo_+w^0%UIKCQma!ur*kIq%k5`7Iq}vAT*2emx*wt=6WAq@Jv+u5qlc zYmpc&HV@d2>{6S2P5Fw{_SKu$vDd4uyKhTrZ3@U(s{Q^$q!Y&{_~zC1*9Y;(0E$ZG z$~RZ$SJo#%-JJd=hjpPBNlWBn8k{?&_rQjvs5WiP0 zw%Ee#(V|iC_uGpQ-dh{i$;w=I5qYr;ALpaM%bO&eZJas|Y>vwon7yAT%jN9xR}W4f zBdm^D?*-&RiLUkGjldOxcgd(Ow_~zx-FM*kYuQeVfCrcOo&_HvFTOR;?v?r9vny-- zorgxPHdjN260NoC)*Ib!Hj}xvof_ zvhQkD?**T_YDX&e9P89v?wX=(5^mdqIG;wZe>w!Odz}B71$BiSNO$(}%D$J)<=pMs z4`z8Ue9QWzmL|z&lHDb7ld)uSJkT)k;KJZCyzcBLt8@xT%9Uzkfl)swybr|dbdNnLFe}M~rq4oM2LVlx}1_az>9t1P_ z|8<*r^$6Wn1WBJhZVgAaZ_@Itj6A7dN%E5=8~~3MPiUC6xRvPMk&pj^tfQ5_qP2<& z!1_;P0;nJg0PUXw{euLE^1u2uh#5fnf9GHTh_nMx|JS4XkN;DN|L~tT|DVAH;Qu;w z3sC;6_5Wj?h&O=$BP>@10}lWoVf+t3ikb|k0D#k@C?~D$3p&nra-kf7ei%t+&sxlW zrHC+U5m*ya*ea5eV3ZW^DLjrO*~cN8|FG4p3Sskav5H7$*^}_`E<dIDL)$4f-Xx zicxPZYlYWlvdhEfa=7Y;AX3(1>{+IwvAI^ki)kP`8WXP`uRe=#RNHZ28GTt9(~=co z=7{3>5|szK%7p+45QDQ~oXA#zY^)IFA%R#Y__uJWQgat;R-YpC02}1Mm>uWE4h~8yk3oRs24@ z)f`ii|3C$5y;0LfuKARY?FR6)E6JsK2`xV|F@D&?&jEfE@4qNmn@=g3O4x-9 znqLB}%qFD=vc4@_72z+LT5wbk3Fxt#*WfXMyVAo&-@H54_3aLV{M`9r;eta)oV&>|i$A@Vf!-)jOOl*qL8i0L zP{4$S7@hBV@EKXbrV}FJOWPvQn&GE;=y$@gaGu>f&w;|9pJ$u>k)dd4}5- z=HAO(WE6|k8P^ilnY0VBiZZZZ1c4W_>{YQ{@z9aEG}vnyAB4hh1>1;%=Iy@k|t3J2PhQ>AdOh>FMLF z{--zOL+A8#+&T0HP0m|7&^nG?B6BlaqzSC{B`mBxXM{yCDJ6^35{%lBaZ3CK#O=2aCF9P0xY8V6*T~`HqK_h)4t_0%t%UBVfdfTL zq}=&aj1KrZP$_YP@PXqU92ZIFn}z}1FP~#HLX`$O*V~5h?t|D(&4~P8wKaN>QG;3( z43k1cdixb*Sb<>;yRitPeui0k)F_uR&%&DHlAr|qHMKiHsy zF)) zKL9xZ^~)pDE-0)6Bx>;}luM9z(;A;+Mck|HSVR<(WXsX2N74qf7Uy8s!o<~ALvW2v z$P-h|y72z;L4S8s>GjjOjrq37OvJbaHxcz-!7-Br*r~%|2K>1!egTY79U2NKS>QCL z{tz70#n|Ij9|B)#crSi4NZPHsX*jNrk9ubdGM@#slSP)DS2KD%15_j zE4AV__c3cb0!NDK=W2n`4dHR<@86_D^Z~Or);HzYavIrRuM)Q%tfqV2#REAJVNr$g z3!R;+-PQTzVdoZT3JB>A})kiLyNz2f@=MCsM=`!_5gGky`M?k3sSTQYE_g}VvtX5oT(V^ zFoj`dwhbhCGH6*VXpPwaV0Ssmx|dmdJ3+LNOR?zJ=7vmtI@nuAesF5V8Ml`T`;d^y+VgBmZmcLU&?myGc2TSSHmcj4x9NS z|J_lbYK@Jik1+ewIhy=p0a3?u$F>kkov6z4zVT zs-&Kw_qEflFCNQ?zc|4+qC3Ihpl2jcV{yOzxs++=r4b?Gu4qr~8FjvHDX+K8i zB}jKh+7BM_*&U#-Jm^XymY9PFe68fl_#m-}Xr9uU&?6U_1BC}jpimJm&!Mk}Fe70$ z2ww>gD%bq+{9ic`{RDhRS^z$*7dKisyas~x>9d#q5VO?>po&Db=hzcXs7GhGgA z+<;?BuhZ(zR&cf4wXWjo<3;QOf6hF~9{)09%BeWF=CFd#|7HSD_hn^W1N} zS>-E-uTL!s;Lf9bHEl;E?(dhC#2r-#S7hQ1jndz5mJ~O>8ZC+WLp3;9xzyOLWJpy6 zMC?L0dbZ!9a=pfZ_xg09h{EortFolshK=0Oxl+%WWnCmBRvI5HvrKY`PYuYb`iG2) z&}ay!UAd@6;hETXfWeqs1UF8UqYi~-Zi)~;v>w+>xRhSDLhBQD!Qeo9R^_ENnr_;D zbsHq|gH!gU`NVW)E3zw|MNDe9^ZlMA>-|}hDfIyP+$b|IgsJ4JZC{%qWJ7u2U*eMV zed;r1aqKsxbgMLOlBaCofxmA!l{aAb0#d@O%xwz|9=WTA)7j>H;IgDG?})MBB?|D7 zYy=A)8-d@Cx~85#R``lqaZN>_p&TnFoqP8DX!_|%#SIG1 zjEwWUG%oLDl+-LE{HpP*8R>d$&4R2Y9j@jz1e=*-`?Fh#*syw4LWmLnSe59v4 Date: Mon, 20 May 2024 17:41:13 -0400 Subject: [PATCH 3/3] Updating file name --- ...esql-ref-button.png => esql-help-ref-button.png} | Bin docs/detections/rules-ui-create.asciidoc | 2 +- docs/events/timeline-ui-overview.asciidoc | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) rename docs/detections/images/{esql-ref-button.png => esql-help-ref-button.png} (100%) diff --git a/docs/detections/images/esql-ref-button.png b/docs/detections/images/esql-help-ref-button.png similarity index 100% rename from docs/detections/images/esql-ref-button.png rename to docs/detections/images/esql-help-ref-button.png diff --git a/docs/detections/rules-ui-create.asciidoc b/docs/detections/rules-ui-create.asciidoc index eb7acda8a4..1ffb0900e1 100644 --- a/docs/detections/rules-ui-create.asciidoc +++ b/docs/detections/rules-ui-create.asciidoc @@ -275,7 +275,7 @@ To create an {esql} rule: + NOTE: Refer to the sections below to learn more about <>, <>, and <>. + -TIP: Click the help icon (image:images/esql-ref-button.png[Click the ES|QL help icon,20,20]) to open the in-product reference documentation for all {esql} commands and functions. +TIP: Click the help icon (image:images/esql-help-ref-button.png[Click the ES|QL help icon,20,20]) to open the in-product reference documentation for all {esql} commands and functions. + . Click *Continue* to <>. diff --git a/docs/events/timeline-ui-overview.asciidoc b/docs/events/timeline-ui-overview.asciidoc index d4c46bf412..1aa844bd68 100644 --- a/docs/events/timeline-ui-overview.asciidoc +++ b/docs/events/timeline-ui-overview.asciidoc @@ -223,7 +223,7 @@ TIP: When querying indices that tend to be large (for example, `logs-*`), perfor NOTE: An error message displays when the query bar is empty. -- Click the help icon (image:images/esql-ref-button.png[Click the ES|QL reference button,20,20]) on the far right side of the query editor to open the in-product reference documentation for all {esql} commands and functions. +- Click the help icon (image:images/esql-help-ref-button.png[Click the ES|QL reference button,20,20]) on the far right side of the query editor to open the in-product reference documentation for all {esql} commands and functions. - Visualize query results using {kibana-ref}/discover.html[Discover] functionality. [role="screenshot"]