[Serverless] Document impact of using logsDB for security users

docs/serverless/index.asciidoc

@@ -134,6 +134,7 @@ include::./dashboards/rule-monitoring-dashboard.asciidoc[leveloffset=+3]
 
 include::./rules/detection-engine-overview.asciidoc[leveloffset=+2]
 include::./rules/detections-permissions-section.asciidoc[leveloffset=+3]
+include::./rules/detections-logsdb-impact.asciidoc[leveloffset=+3]
 
 include::./rules/about-rules.asciidoc[leveloffset=+2]
 include::./rules/rules-ui-create.asciidoc[leveloffset=+3]

docs/serverless/rules/detection-engine-overview.asciidoc

@@ -141,3 +141,9 @@ Refer to <<enable-detections-ui,Enable and access detections>> for a list of all
 If you get this message, you do not have the
 <<detections-permissions,required privileges>> to view the **Detections** feature,
 and you should contact your project administrator.
+
+[discrete]
+[[detections-logsdb-index-mode]]
+== Using logsDB index mode 
+
+LogsDB is enabled by default for Elastic serverless. Refer to <<detections-logsdb-index-mode-impact>> to learn more. 

docs/serverless/rules/detections-logsdb-impact.asciidoc

@@ -0,0 +1,63 @@
+[[detections-logsdb-index-mode-impact]]
+= Using logsDB index mode with {sec-serverless}
+
+LogsDB is enabled by default for Elastic serverless. This topic explains the impact of using logsDB index mode with  {sec-serverless}.  
+
+With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`].
+
+When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between user's expectations and how fields are formatted.
+
+Continue reading to find out how this affects specific {sec-serverless} components. 
+
+[discrete]
+[[logsdb-alerts]]
+== Alerts
+
+When alerts are generated, the `_source` event is copied over into the alert in order to retain the original data. When the logsDB index mode is applied, the `_source` event stored in the alert is an event reconstructed using synthetic `_source`.
+
+If you're switching to use logsDB index mode, the `_source` field stored in the alert might look different in certain situations:
+
+* {ref}/mapping-source-field.html#synthetic-source-modifications-leaf-arrays[Arrays can be reconstructed differently or deduplicated]
+* {ref}/mapping-source-field.html#synthetic-source-modifications-field-names[Field names] 
+* `geo_point` data fields (refer to {ref}/mapping-source-field.html#synthetic-source-modifications-ranges[Representation of ranges] and {ref}/mapping-source-field.html#synthetic-source-precision-loss-for-point-types[Reduced precision of `geo_point` values] for more information)
+
+Alerts generated by the following rule types could be affected:
+
+* Custom query
+* Event correlation (non-sequence only)
+* Non-aggregate rule types (for example, {esql} rules that use non-aggregating queries)
+
+Alerts that are generated by threshold, {ml}, and event correlation sequence rules are not affected since they do not contain copies of the original source.
+
+[discrete]
+[[logsdb-rule-actions]]
+== Rule actions
+
+While we do not recommend using `_source` for actions, in cases where the action relies on the `_source`, the same limitations and changes apply.
+
+If you send alert notifications by enabling {kibana-ref}/alerting-getting-started.html#alerting-concepts-actions[actions], and then have logic outside of {sec-serverless} based on fields formatted from the original source, those flows may be affected. In particular, affected fields would be an array of objects.
+
+We recommend checking and adjusting the rule actions using `_source` before switching to logsDB index mode.
+
+[discrete]
+[[logsdb-runtime-fields]]
+== Runtime fields
+
+Runtime fields that reference `_source` may be affected. Some runtime fields might not work and need to be adjusted. For example, if an event was indexed with the value of `agent.name` in the dot-notation form, it will be returned in the nested form and may not work. 
+
+The following is an example of accessing `_source` that works with the logsDB index mode enabled:
+
+[source,console]
+----
+"source": """  emit(params._source.agent.name + "_____" + doc['agent.name'].value ); """ 
+"source": """  emit(params._source['agent']['name'] + "_____" + doc['agent.name'].value );  """
+"source": """  emit(field('agent.name').get(null) + "_____" + doc['agent.name'].value ); """
+"source": """  emit($('agent.name', null) + "_____" + doc['agent.name'].value ); """
+----
+
+The following will not work with synthetic source (logsDB index mode enabled):
+
+[source,console]
+----
+"source": """  emit(params._source['agent.name'] + "_____" + doc['agent.name'].value );  """
+----