[Security][9.5 & Serverless] Document the new flyout system for alert and event details by nastasha-solomon · Pull Request #7719 · elastic/docs-content

nastasha-solomon · 2026-08-04T03:17:54Z

Summary

For 9.5, the new flyout system (EUI session flyout) goes GA in Security Solution, replacing the legacy right/left/preview panel model with a single flyout plus child flyouts that layer on top of it. This rewrites the primary affected page, adds a shared "Details flyouts" reference for the mechanics common to all of these flyouts (to avoid re-documenting the same header/footer/navigation on every page), and updates related pages that referenced the old panel structure or were missing version tags for the new behavior.

Fixes #7607.

All UI details (button labels, icons, which actions open a new flyout vs. a popover, and which behaviors are version-gated) were verified against the Kibana source rather than assumed.

Previews

View detection alert details - Full rewrite. Replaces the right/left/preview panel structure with the single flyout + child flyout model (header, footer, and each Overview tab section — About, Investigation, Visualizations, Insights, Response, Notes — now opening its own flyout). Adds a version note for the pre-9.5 legacy layout, documents a new correlation type (Attacks related to this alert), and trims the header/footer explanation in favor of linking to the new shared Details flyouts section.
Elastic Security UI - Adds a new Details flyouts section documenting the header toolbar (Share, Back, History), footer (Ask AI Assistant/Add to chat, Take action), and child flyout navigation shared across alert, event, attack, host, user, and other flyouts, so other pages can link here instead of re-describing the same mechanics.
View entity details - Replaces stale "expand the flyout" wording (Behavioral anomalies, Graph, Resolution, Insights) with accurate child flyout language, links to the shared Details flyouts section, and adds a missing applies_to tag to the Insights section.
Manage discoveries from the Attacks view - Links to the shared Details flyouts section for toolbar and footer controls that weren't previously documented on this page.
Write investigation guides - Updates references from the old "Investigation tab" to the Investigation section's flyout, with applies_to tags and legacy notes for the pre-9.5 wording.
AI Assistant - Updates the alert flyout's AI entry point from Chat to Ask AI Assistant / Add to chat, tagged to 9.5+ with a legacy note for the old wording.
View and analyze risk score data - Updates the Insights → Entities navigation description.
Configure advanced settings - Documents the new securitySolution:enableNewFlyout advanced setting, fixes a broken anchor left over from the old page structure, and points the legacy-flyout reference to the new shared Details flyouts section.
Add Osquery Response Actions - Updates the stale "Response tab in the left panel" reference to the current Response section, with a legacy note for pre-9.5 behavior.
Notes - Points the "add notes to alerts and events" guidance at the alert flyout's Notes section instead of duplicating it, and adds a legacy note for the pre-9.5 "Notes tab" behavior.

Follow-ups (not included in this PR)

A few screenshots likely still show the old flyout chrome and should be recaptured separately:

security-ig-alert-flyout.png, security-ig-alert-flyout-invest-tab.png (investigation guide)
security-alerts-flyout-rs.png, security-risk-summary.png (risk score data)
security-alerts-flyout-table.png (table settings menu)
security-osquery-results-tab.png (Osquery response actions)

Generative AI disclosure

Did you use a generative AI (GenAI) tool to assist in creating this contribution?

Yes
No

Tool(s) and model(s) used: Cursor (Claude)

… and event details Rewrites the alert details flyout page around the new EUI session flyout (main + tools flyouts, no more right/left/preview panels), and updates related pages that referenced the old panel model. Fixes #7607. Co-authored-by: Cursor <cursoragent@cursor.com>

github-actions · 2026-08-04T03:18:42Z

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

github-actions · 2026-08-04T03:19:45Z

🔍 Preview links for changed docs

Elastic Docs Style Checker (Vale)

Summary: 1 warning found

⚠️ Warnings (1): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
solutions/security/detect-and-alert/view-detection-alert-details.md	23	Elastic.DirectionalLanguage	Don't use directional language. Use 'in the following section' instead of 'described below'.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

…into issue-7607

natasha-moore-elastic

Looks good overall, added a few comments for your consideration.
Thanks!
Edit: I've also pushed a commit (b137dba) that replaces the "expand" wording in two other EA files.

natasha-moore-elastic · 2026-08-06T08:37:15Z


 ## Entity details flyout

+Refer to [Details flyouts](/solutions/security/get-started/elastic-security-ui.md#details-flyouts) for the flyout's shared header controls, footer, and child flyout navigation.


Suggested change

Refer to [Details flyouts](/solutions/security/get-started/elastic-security-ui.md#details-flyouts) for the flyout's shared header controls, footer, and child flyout navigation.

Refer to [Details flyouts](/solutions/security/get-started/elastic-security-ui.md#details-flyouts) for the toolbar controls, footer, and child flyout navigation shared across {{elastic-sec}} flyouts.

Matches the wording from manage-discoveries-from-attacks-page.md and view-detection-alert-details.md‎, which I prefer slightly since it states what surface the flyout is shared across.

natasha-moore-elastic · 2026-08-06T08:50:21Z

 You can also chat with AI Assistant from several particular pages in {{elastic-sec}} where you can easily send context-specific data and prompts to AI Assistant.

-* [Alert details](/solutions/security/detect-and-alert/view-detection-alert-details.md) or Event details flyout: Click **Chat** while viewing the details of an alert or event.
+* [Alert details](/solutions/security/detect-and-alert/view-detection-alert-details.md) or Event details flyout: {applies_to}`stack: ga 9.5+` {applies_to}`serverless: ga` Click **Ask AI Assistant** (or **Add to chat**, if [Agent Builder](/explore-analyze/ai-features/elastic-agent-builder.md) is enabled) in the footer while viewing the details of an alert or event.


The instructions in this section are specifically for opening/chatting with AI Assistant, so I think mentioning Agent Builder and its button would cause confusion (or imply that you can still chat with AI Assistant from the Agent Builder chat).

I also think that adding an applies to tag here could be misinterpreted to mean that the whole functionality described in the bullet is available from 9.5, rather than just the button's name change. I'd propose leaving it out here, and slightly rewording the version-scoped note to clarify the button's name change.

Suggested change

* [Alert details](/solutions/security/detect-and-alert/view-detection-alert-details.md) or Event details flyout: {applies_to}`stack: ga 9.5+` {applies_to}`serverless: ga` Click **Ask AI Assistant** (or **Add to chat**, if [Agent Builder](/explore-analyze/ai-features/elastic-agent-builder.md) is enabled) in the footer while viewing the details of an alert or event.

* [Alert details](/solutions/security/detect-and-alert/view-detection-alert-details.md) or Event details flyout: Click **Ask AI Assistant** in the footer while viewing the details of an alert or event.

natasha-moore-elastic · 2026-08-06T09:41:17Z

+{applies_to}`stack: ga 9.5+` {applies_to}`serverless: ga` Whenever an analyst opens an alert produced by that rule, the guide is available from the [Investigation section](/solutions/security/detect-and-alert/view-detection-alert-details.md#investigation-section) on the **Overview** tab of the alert details flyout.
+
+::::{note}
+:applies_to: stack: ga 9.0-9.4
+In these versions, the guide renders in the **Investigation** tab of the alert details flyout instead.
+::::


I'm a bit confused – I feel like line 21 is true for both pre-9.5 and 9.5+. The guide was available from the Investigation section before 9.5, right? (it just rendered differently when you clicked to open it)

The note reads like the Investigation tab was next to the Overview, Table, and JSON tabs in pre-9.5 versions, but I don't think that was the case.

natasha-moore-elastic · 2026-08-06T09:45:57Z

+1. {applies_to}`stack: ga 9.5+` {applies_to}`serverless: ga` Open an alert's details flyout, then click **Show investigation guide** in the [Investigation section](/solutions/security/detect-and-alert/view-detection-alert-details.md#investigation-section) on the **Overview** tab.
+
+    ::::{note}
+    :applies_to: stack: ga 9.0-9.4
+    In these versions, open an alert's details flyout and go to the **Investigation** tab instead.
+    ::::
+


Same as https://github.com/elastic/docs-content/pull/7719/changes#r3727637522 - I think line 239 is true across versions.
8.19 docs say that the Investigation section is located on the Overview tab with a Show investigation guide button.

natasha-moore-elastic · 2026-08-06T09:57:59Z

+When a rule generates an alert, Osquery automatically collects data on the host. 
+
+{applies_to}`stack: ga 9.5+` {applies_to}`serverless: ga` Query results are shown in the [**Response** section](/solutions/security/detect-and-alert/view-detection-alert-details.md#response-overview) on the **Overview** tab of the alert details flyout. Click **Response** to view the query results in a new flyout.
+
+::::{note}
+:applies_to: stack: ga 9.0-9.4
+In {{stack}} 9.0.x-9.4.x, query results are displayed within the **Response** tab in the left panel of the alert details flyout.
+::::


Suggested change

When a rule generates an alert, Osquery automatically collects data on the host.

{applies_to}`stack: ga 9.5+` {applies_to}`serverless: ga` Query results are shown in the [**Response** section](/solutions/security/detect-and-alert/view-detection-alert-details.md#response-overview) on the **Overview** tab of the alert details flyout. Click **Response** to view the query results in a new flyout.

::::{note}

:applies_to: stack: ga 9.0-9.4

In {{stack}} 9.0.x-9.4.x, query results are displayed within the **Response** tab in the left panel of the alert details flyout.

::::

When a rule generates an alert, Osquery automatically collects data on the host. Query results are available from the [**Response** section](/solutions/security/detect-and-alert/view-detection-alert-details.md#response-overview) on the **Overview** tab of the alert details flyout. Click **Response** to view the query results.

Similar to previous comments about the Investigation section, I think we can phrase this with language that's true across versions and avoids adding applies tags.

…ls.md Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

…ls.md Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

nastasha-solomon requested a review from a team as a code owner August 4, 2026 03:17

nastasha-solomon marked this pull request as draft August 4, 2026 03:19

github-actions Bot deployed to docs-preview August 4, 2026 03:21 View deployment

Merge branch 'main' into issue-7607

41ce1e5

bmorelli25 mentioned this pull request Aug 5, 2026

[Q1 Release] Security solution 9.5 updates #4839

Open

47 tasks

nastasha-solomon and others added 2 commits August 5, 2026 11:41

consolidate

512059b

Merge branch 'main' into issue-7607

fddf732

github-actions Bot deployed to docs-preview August 5, 2026 15:47 View deployment

nastasha-solomon and others added 5 commits August 5, 2026 11:51

Merge branch 'main' into issue-7607

171266e

Adds applies_to for AD

ce0a935

Merge branch 'main' into issue-7607

c64763a

Adds more applies_to tags

fc2ec46

Merge branch 'issue-7607' of https://github.com/elastic/docs-content …

da8a516

…into issue-7607

github-actions Bot deployed to docs-preview August 5, 2026 16:09 View deployment

nastasha-solomon added 2 commits August 5, 2026 12:10

Merge branch 'main' into issue-7607

5ba843b

Merge branch 'main' into issue-7607

68b59a2

nastasha-solomon marked this pull request as ready for review August 5, 2026 16:14

nastasha-solomon self-assigned this Aug 5, 2026

nastasha-solomon requested review from PhilippeOberti and natasha-moore-elastic August 5, 2026 16:14

github-actions Bot deployed to docs-preview August 5, 2026 16:18 View deployment

Merge branch 'main' into issue-7607

d34452d

github-actions Bot deployed to docs-preview August 5, 2026 18:09 View deployment

natasha-moore-elastic reviewed Aug 6, 2026

View reviewed changes

replace expand wording

b137dba

github-actions Bot deployed to docs-preview August 6, 2026 10:05 View deployment

nastasha-solomon and others added 4 commits August 6, 2026 09:22

Update solutions/security/advanced-entity-analytics/view-entity-detai…

fd07780

…ls.md Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/ai/ai-assistant.md

8d0d7a3

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/detect-and-alert/view-detection-alert-detai…

6052500

…ls.md Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/advanced-entity-analytics/view-entity-detai…

376839d

…ls.md Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

github-actions Bot deployed to docs-preview August 6, 2026 13:27 View deployment

nastasha-solomon marked this pull request as draft August 6, 2026 21:37

Navigation Menu

Uh oh!

[Security][9.5 & Serverless] Document the new flyout system for alert and event details - #7719

[Security][9.5 & Serverless] Document the new flyout system for alert and event details#7719
nastasha-solomon wants to merge 17 commits into
mainfrom
issue-7607

nastasha-solomon commented Aug 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

natasha-moore-elastic left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

natasha-moore-elastic Aug 6, 2026

Uh oh!

natasha-moore-elastic Aug 6, 2026

Uh oh!

Uh oh!

Uh oh!

natasha-moore-elastic Aug 6, 2026 •

edited

Loading

Uh oh!

natasha-moore-elastic Aug 6, 2026

Uh oh!

natasha-moore-elastic Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		## Entity details flyout

		Refer to [Details flyouts](/solutions/security/get-started/elastic-security-ui.md#details-flyouts) for the flyout's shared header controls, footer, and child flyout navigation.

	* [Alert details](/solutions/security/detect-and-alert/view-detection-alert-details.md) or Event details flyout: {applies_to}`stack: ga 9.5+` {applies_to}`serverless: ga` Click Ask AI Assistant (or Add to chat, if [Agent Builder](/explore-analyze/ai-features/elastic-agent-builder.md) is enabled) in the footer while viewing the details of an alert or event.
	* [Alert details](/solutions/security/detect-and-alert/view-detection-alert-details.md) or Event details flyout: Click Ask AI Assistant in the footer while viewing the details of an alert or event.

Uh oh!

Conversation

nastasha-solomon commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Previews

Follow-ups (not included in this PR)

Generative AI disclosure

Uh oh!

github-actions Bot commented Aug 4, 2026

Elastic Docs AI PR menu

Uh oh!

github-actions Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

github-actions Bot commented Aug 4, 2026

Elastic Docs Style Checker (Vale)

Uh oh!

natasha-moore-elastic left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

natasha-moore-elastic Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

natasha-moore-elastic Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

natasha-moore-elastic Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

natasha-moore-elastic Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

natasha-moore-elastic Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nastasha-solomon commented Aug 4, 2026 •

edited

Loading

github-actions Bot commented Aug 4, 2026 •

edited

Loading

natasha-moore-elastic left a comment •

edited

Loading

natasha-moore-elastic Aug 6, 2026 •

edited

Loading