diff --git a/solutions/images/elasticsearch-reference-ccs-dont-min-roundtrip-shard-results.svg b/solutions/images/elasticsearch-reference-ccs-dont-min-roundtrip-shard-results.svg new file mode 100644 index 0000000000..3c48418b9c --- /dev/null +++ b/solutions/images/elasticsearch-reference-ccs-dont-min-roundtrip-shard-results.svg @@ -0,0 +1,83 @@ + + + + Slice 1 + Created with Sketch. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/solutions/images/elasticsearch-reference-ccs-dont-min-roundtrip-shard-search.svg b/solutions/images/elasticsearch-reference-ccs-dont-min-roundtrip-shard-search.svg new file mode 100644 index 0000000000..dbf852edd4 --- /dev/null +++ b/solutions/images/elasticsearch-reference-ccs-dont-min-roundtrip-shard-search.svg @@ -0,0 +1,83 @@ + + + + Slice 1 + Created with Sketch. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/solutions/images/elasticsearch-reference-ccs-min-roundtrip-client-request.svg b/solutions/images/elasticsearch-reference-ccs-min-roundtrip-client-request.svg new file mode 100644 index 0000000000..7224a25c24 --- /dev/null +++ b/solutions/images/elasticsearch-reference-ccs-min-roundtrip-client-request.svg @@ -0,0 +1,81 @@ + + + + Slice 1 + Created with Sketch. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/solutions/images/elasticsearch-reference-ccs-min-roundtrip-client-response.svg b/solutions/images/elasticsearch-reference-ccs-min-roundtrip-client-response.svg new file mode 100644 index 0000000000..e806b2c473 --- /dev/null +++ b/solutions/images/elasticsearch-reference-ccs-min-roundtrip-client-response.svg @@ -0,0 +1,79 @@ + + + + Slice 1 + Created with Sketch. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/solutions/images/elasticsearch-reference-ccs-min-roundtrip-cluster-results.svg b/solutions/images/elasticsearch-reference-ccs-min-roundtrip-cluster-results.svg new file mode 100644 index 0000000000..9ffb651b9d --- /dev/null +++ b/solutions/images/elasticsearch-reference-ccs-min-roundtrip-cluster-results.svg @@ -0,0 +1,77 @@ + + + + Slice 1 + Created with Sketch. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/solutions/images/elasticsearch-reference-ccs-min-roundtrip-cluster-search.svg b/solutions/images/elasticsearch-reference-ccs-min-roundtrip-cluster-search.svg new file mode 100644 index 0000000000..eb48118295 --- /dev/null +++ b/solutions/images/elasticsearch-reference-ccs-min-roundtrip-cluster-search.svg @@ -0,0 +1,77 @@ + + + + Slice 1 + Created with Sketch. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/solutions/images/elasticsearch-reference-full-text-search-overview.svg b/solutions/images/elasticsearch-reference-full-text-search-overview.svg new file mode 100644 index 0000000000..e7a1c5ba14 --- /dev/null +++ b/solutions/images/elasticsearch-reference-full-text-search-overview.svg @@ -0,0 +1,81 @@ + + + + + + + + + + + + + + + Full-text search with Elasticsearch + + + + + Source documents + + + + Analysis pipeline + Transforms text to normalized terms + + + + Inverted index + Search-optimized data structure + + + + Search query + + + + Relevance scoring + Similarity algorithm scores documents + + + + Search results + Most relevant first + + + + + + + + + + + + + + \ No newline at end of file diff --git a/solutions/images/elasticsearch-reference-ingest-pipeline-ent-search-ui.png b/solutions/images/elasticsearch-reference-ingest-pipeline-ent-search-ui.png new file mode 100644 index 0000000000..e0fc7d1ba8 Binary files /dev/null and b/solutions/images/elasticsearch-reference-ingest-pipeline-ent-search-ui.png differ diff --git a/solutions/images/elasticsearch-reference-learning-to-rank-feature-extraction.png b/solutions/images/elasticsearch-reference-learning-to-rank-feature-extraction.png new file mode 100644 index 0000000000..6dc2ee3190 Binary files /dev/null and b/solutions/images/elasticsearch-reference-learning-to-rank-feature-extraction.png differ diff --git a/solutions/images/elasticsearch-reference-learning-to-rank-judgment-list.png b/solutions/images/elasticsearch-reference-learning-to-rank-judgment-list.png new file mode 100644 index 0000000000..3f0c212df3 Binary files /dev/null and b/solutions/images/elasticsearch-reference-learning-to-rank-judgment-list.png differ diff --git a/solutions/images/elasticsearch-reference-learning-to-rank-overview.png b/solutions/images/elasticsearch-reference-learning-to-rank-overview.png new file mode 100644 index 0000000000..ea9557a70a Binary files /dev/null and b/solutions/images/elasticsearch-reference-learning-to-rank-overview.png differ diff --git a/solutions/images/elasticsearch-reference-rag-schema.svg b/solutions/images/elasticsearch-reference-rag-schema.svg new file mode 100644 index 0000000000..f26edac6c0 --- /dev/null +++ b/solutions/images/elasticsearch-reference-rag-schema.svg @@ -0,0 +1,73 @@ + + + + + + + + + + + + + + + Define how the model should + parse and render information + + Custom instructions + + + + + + Full-text, semantic + or hybrid search + + Search strategy + + + + + + + 1 + + + 2 + + + 3 + + + 4 + + + + + + User query + + + + Elasticsearch + + Retrieves relevant + documents + + + + Language model + Processes context & + + generates answer + + + + + + + + + Response + \ No newline at end of file diff --git a/solutions/images/elasticsearch-reference-rag-venn-diagram.svg b/solutions/images/elasticsearch-reference-rag-venn-diagram.svg new file mode 100644 index 0000000000..9906aaefab --- /dev/null +++ b/solutions/images/elasticsearch-reference-rag-venn-diagram.svg @@ -0,0 +1,19 @@ + + + + + + + + + Information + retrieval + + + Generative + AI + + + + RAG + \ No newline at end of file diff --git a/solutions/images/elasticsearch-reference-semantic-options.svg b/solutions/images/elasticsearch-reference-semantic-options.svg new file mode 100644 index 0000000000..c4d68b19b5 --- /dev/null +++ b/solutions/images/elasticsearch-reference-semantic-options.svg @@ -0,0 +1,59 @@ + + + + + + + semantic_text + (Recommended) + + + + Inference API + + + + Model Deployment + + + Complexity: Low + Complexity: Medium + Complexity: High + + + + + + Create Inference Endpoint + + + Define Index Mapping + + + + Create Inference Endpoint + + + Configure Model Settings + + + Define Index Mapping + + + Setup Ingest Pipeline + + + + Select NLP Model + + + Deploy with Eland Client + + + Define Index Mapping + + + Setup Ingest Pipeline + + + diff --git a/solutions/images/getting-started-threat-intelligence-view.png b/solutions/images/getting-started-threat-intelligence-view.png new file mode 100644 index 0000000000..32bc70d5df Binary files /dev/null and b/solutions/images/getting-started-threat-intelligence-view.png differ diff --git a/solutions/images/kibana-api-keys-search-bar.png b/solutions/images/kibana-api-keys-search-bar.png new file mode 100644 index 0000000000..d8767cb8b5 Binary files /dev/null and b/solutions/images/kibana-api-keys-search-bar.png differ diff --git a/solutions/images/kibana-case-button-osquery.png b/solutions/images/kibana-case-button-osquery.png new file mode 100644 index 0000000000..9fc908984d Binary files /dev/null and b/solutions/images/kibana-case-button-osquery.png differ diff --git a/solutions/images/kibana-chat-interface.png b/solutions/images/kibana-chat-interface.png new file mode 100644 index 0000000000..8af0c23178 Binary files /dev/null and b/solutions/images/kibana-chat-interface.png differ diff --git a/solutions/images/kibana-click-create-api-key.png b/solutions/images/kibana-click-create-api-key.png new file mode 100644 index 0000000000..3f98b06890 Binary files /dev/null and b/solutions/images/kibana-click-create-api-key.png differ diff --git a/solutions/images/kibana-cloud-id.png b/solutions/images/kibana-cloud-id.png new file mode 100644 index 0000000000..4afd10a89a Binary files /dev/null and b/solutions/images/kibana-cloud-id.png differ diff --git a/solutions/images/kibana-data-button.png b/solutions/images/kibana-data-button.png new file mode 100644 index 0000000000..21253708de Binary files /dev/null and b/solutions/images/kibana-data-button.png differ diff --git a/solutions/images/kibana-discover-button-osquery.png b/solutions/images/kibana-discover-button-osquery.png new file mode 100644 index 0000000000..599f3f3578 Binary files /dev/null and b/solutions/images/kibana-discover-button-osquery.png differ diff --git a/solutions/images/kibana-enter-query.png b/solutions/images/kibana-enter-query.png new file mode 100644 index 0000000000..83f6eb08e6 Binary files /dev/null and b/solutions/images/kibana-enter-query.png differ diff --git a/solutions/images/kibana-get-started.png b/solutions/images/kibana-get-started.png new file mode 100644 index 0000000000..c51417af43 Binary files /dev/null and b/solutions/images/kibana-get-started.png differ diff --git a/solutions/images/kibana-lens-button-osquery.png b/solutions/images/kibana-lens-button-osquery.png new file mode 100644 index 0000000000..92c79f0f20 Binary files /dev/null and b/solutions/images/kibana-lens-button-osquery.png differ diff --git a/solutions/images/kibana-live-query-check-results.png b/solutions/images/kibana-live-query-check-results.png new file mode 100644 index 0000000000..758b543367 Binary files /dev/null and b/solutions/images/kibana-live-query-check-results.png differ diff --git a/solutions/images/kibana-manage-deployment.png b/solutions/images/kibana-manage-deployment.png new file mode 100644 index 0000000000..6fb4aa20da Binary files /dev/null and b/solutions/images/kibana-manage-deployment.png differ diff --git a/solutions/images/kibana-mapped-icon.png b/solutions/images/kibana-mapped-icon.png new file mode 100644 index 0000000000..66f2361c15 Binary files /dev/null and b/solutions/images/kibana-mapped-icon.png differ diff --git a/solutions/images/kibana-play-icon.png b/solutions/images/kibana-play-icon.png new file mode 100644 index 0000000000..724d17b5a3 Binary files /dev/null and b/solutions/images/kibana-play-icon.png differ diff --git a/solutions/images/kibana-query-interface.png b/solutions/images/kibana-query-interface.png new file mode 100644 index 0000000000..496dfd5733 Binary files /dev/null and b/solutions/images/kibana-query-interface.png differ diff --git a/solutions/images/kibana-scheduled-pack.png b/solutions/images/kibana-scheduled-pack.png new file mode 100644 index 0000000000..f48f5be333 Binary files /dev/null and b/solutions/images/kibana-scheduled-pack.png differ diff --git a/solutions/images/kibana-serverless-connection-details.png b/solutions/images/kibana-serverless-connection-details.png new file mode 100644 index 0000000000..ba65001003 Binary files /dev/null and b/solutions/images/kibana-serverless-connection-details.png differ diff --git a/solutions/images/kibana-serverless-create-an-api-key.png b/solutions/images/kibana-serverless-create-an-api-key.png new file mode 100644 index 0000000000..2ab9a76509 Binary files /dev/null and b/solutions/images/kibana-serverless-create-an-api-key.png differ diff --git a/solutions/images/kibana-table-icon.png b/solutions/images/kibana-table-icon.png new file mode 100644 index 0000000000..5c4e9e78d9 Binary files /dev/null and b/solutions/images/kibana-table-icon.png differ diff --git a/solutions/images/kibana-view-code-button.png b/solutions/images/kibana-view-code-button.png new file mode 100644 index 0000000000..bb50078a61 Binary files /dev/null and b/solutions/images/kibana-view-code-button.png differ diff --git a/solutions/images/kibana-view-osquery-details.png b/solutions/images/kibana-view-osquery-details.png new file mode 100644 index 0000000000..3dc0daca5a Binary files /dev/null and b/solutions/images/kibana-view-osquery-details.png differ diff --git a/solutions/images/observability-EC2-instances.png b/solutions/images/observability-EC2-instances.png new file mode 100644 index 0000000000..1fb32cbd0e Binary files /dev/null and b/solutions/images/observability-EC2-instances.png differ diff --git a/solutions/images/observability-S3-Server-Access-Logs.png b/solutions/images/observability-S3-Server-Access-Logs.png new file mode 100644 index 0000000000..aa274470d3 Binary files /dev/null and b/solutions/images/observability-S3-Server-Access-Logs.png differ diff --git a/solutions/images/observability-Server-Access-Logging.png b/solutions/images/observability-Server-Access-Logging.png new file mode 100644 index 0000000000..d7a60918a9 Binary files /dev/null and b/solutions/images/observability-Server-Access-Logging.png differ diff --git a/solutions/images/observability-action-alert-summary.png b/solutions/images/observability-action-alert-summary.png new file mode 100644 index 0000000000..89157d6629 Binary files /dev/null and b/solutions/images/observability-action-alert-summary.png differ diff --git a/solutions/images/observability-active-alert-service.png b/solutions/images/observability-active-alert-service.png new file mode 100644 index 0000000000..7d7deaf078 Binary files /dev/null and b/solutions/images/observability-active-alert-service.png differ diff --git a/solutions/images/observability-add-fleet-server.png b/solutions/images/observability-add-fleet-server.png new file mode 100644 index 0000000000..fd0bc971bf Binary files /dev/null and b/solutions/images/observability-add-fleet-server.png differ diff --git a/solutions/images/observability-advanced-arch-observability.png b/solutions/images/observability-advanced-arch-observability.png new file mode 100644 index 0000000000..9a4b0dd220 Binary files /dev/null and b/solutions/images/observability-advanced-arch-observability.png differ diff --git a/solutions/images/observability-advanced-discover.png b/solutions/images/observability-advanced-discover.png new file mode 100644 index 0000000000..5291526783 Binary files /dev/null and b/solutions/images/observability-advanced-discover.png differ diff --git a/solutions/images/observability-agent-settings-migration.png b/solutions/images/observability-agent-settings-migration.png new file mode 100644 index 0000000000..a1f1c12c12 Binary files /dev/null and b/solutions/images/observability-agent-settings-migration.png differ diff --git a/solutions/images/observability-agent-tut-azure-activity-log-settings.png b/solutions/images/observability-agent-tut-azure-activity-log-settings.png new file mode 100644 index 0000000000..1e15371cb0 Binary files /dev/null and b/solutions/images/observability-agent-tut-azure-activity-log-settings.png differ diff --git a/solutions/images/observability-agent-tut-azure-activity-logs-dashboard.png b/solutions/images/observability-agent-tut-azure-activity-logs-dashboard.png new file mode 100644 index 0000000000..0975bf2946 Binary files /dev/null and b/solutions/images/observability-agent-tut-azure-activity-logs-dashboard.png differ diff --git a/solutions/images/observability-agent-tut-azure-add-role-assignment.png b/solutions/images/observability-agent-tut-azure-add-role-assignment.png new file mode 100644 index 0000000000..60892db7d5 Binary files /dev/null and b/solutions/images/observability-agent-tut-azure-add-role-assignment.png differ diff --git a/solutions/images/observability-agent-tut-azure-billing-dashboard.png b/solutions/images/observability-agent-tut-azure-billing-dashboard.png new file mode 100644 index 0000000000..18db8a8196 Binary files /dev/null and b/solutions/images/observability-agent-tut-azure-billing-dashboard.png differ diff --git a/solutions/images/observability-agent-tut-azure-click-client-secret.png b/solutions/images/observability-agent-tut-azure-click-client-secret.png new file mode 100644 index 0000000000..819c3045a0 Binary files /dev/null and b/solutions/images/observability-agent-tut-azure-click-client-secret.png differ diff --git a/solutions/images/observability-agent-tut-azure-create-eventhub.png b/solutions/images/observability-agent-tut-azure-create-eventhub.png new file mode 100644 index 0000000000..5d0bd026cc Binary files /dev/null and b/solutions/images/observability-agent-tut-azure-create-eventhub.png differ diff --git a/solutions/images/observability-agent-tut-azure-event-hub-diagram.png b/solutions/images/observability-agent-tut-azure-event-hub-diagram.png new file mode 100644 index 0000000000..9c6aba4b2f Binary files /dev/null and b/solutions/images/observability-agent-tut-azure-event-hub-diagram.png differ diff --git a/solutions/images/observability-agent-tut-azure-integration-settings.png b/solutions/images/observability-agent-tut-azure-integration-settings.png new file mode 100644 index 0000000000..ff420d81f6 Binary files /dev/null and b/solutions/images/observability-agent-tut-azure-integration-settings.png differ diff --git a/solutions/images/observability-agent-tut-azure-log-categories.png b/solutions/images/observability-agent-tut-azure-log-categories.png new file mode 100644 index 0000000000..d9805cae1e Binary files /dev/null and b/solutions/images/observability-agent-tut-azure-log-categories.png differ diff --git a/solutions/images/observability-agent-tut-azure-register-app.png b/solutions/images/observability-agent-tut-azure-register-app.png new file mode 100644 index 0000000000..0aae6180af Binary files /dev/null and b/solutions/images/observability-agent-tut-azure-register-app.png differ diff --git a/solutions/images/observability-agent-tut-billing-dashboard.png b/solutions/images/observability-agent-tut-billing-dashboard.png new file mode 100644 index 0000000000..363369a1d9 Binary files /dev/null and b/solutions/images/observability-agent-tut-billing-dashboard.png differ diff --git a/solutions/images/observability-agent-tut-ec2-metrics-discover.png b/solutions/images/observability-agent-tut-ec2-metrics-discover.png new file mode 100644 index 0000000000..3ae90d8867 Binary files /dev/null and b/solutions/images/observability-agent-tut-ec2-metrics-discover.png differ diff --git a/solutions/images/observability-agent-tut-ec2-overview-dashboard.png b/solutions/images/observability-agent-tut-ec2-overview-dashboard.png new file mode 100644 index 0000000000..754aabf9e5 Binary files /dev/null and b/solutions/images/observability-agent-tut-ec2-overview-dashboard.png differ diff --git a/solutions/images/observability-agent-tut-one-bucket-archi.png b/solutions/images/observability-agent-tut-one-bucket-archi.png new file mode 100644 index 0000000000..b388181c50 Binary files /dev/null and b/solutions/images/observability-agent-tut-one-bucket-archi.png differ diff --git a/solutions/images/observability-agent-tut-s3accesslog-dashboard.png b/solutions/images/observability-agent-tut-s3accesslog-dashboard.png new file mode 100644 index 0000000000..1a2b8147f9 Binary files /dev/null and b/solutions/images/observability-agent-tut-s3accesslog-dashboard.png differ diff --git a/solutions/images/observability-agent-tut-two-buckets-archi.png b/solutions/images/observability-agent-tut-two-buckets-archi.png new file mode 100644 index 0000000000..3f877b4531 Binary files /dev/null and b/solutions/images/observability-agent-tut-two-buckets-archi.png differ diff --git a/solutions/images/observability-agent-tut-vpcflowlog-dashboard.png b/solutions/images/observability-agent-tut-vpcflowlog-dashboard.png new file mode 100644 index 0000000000..6ddbb2729d Binary files /dev/null and b/solutions/images/observability-agent-tut-vpcflowlog-dashboard.png differ diff --git a/solutions/images/observability-ai-assistant-icon.png b/solutions/images/observability-ai-assistant-icon.png new file mode 100644 index 0000000000..b49276dd4e Binary files /dev/null and b/solutions/images/observability-ai-assistant-icon.png differ diff --git a/solutions/images/observability-alert-connector.png b/solutions/images/observability-alert-connector.png new file mode 100644 index 0000000000..147d721291 Binary files /dev/null and b/solutions/images/observability-alert-connector.png differ diff --git a/solutions/images/observability-all-instances.png b/solutions/images/observability-all-instances.png new file mode 100644 index 0000000000..70028b5a9b Binary files /dev/null and b/solutions/images/observability-all-instances.png differ diff --git a/solutions/images/observability-anomalies-chart.png b/solutions/images/observability-anomalies-chart.png new file mode 100644 index 0000000000..003e06fc5e Binary files /dev/null and b/solutions/images/observability-anomalies-chart.png differ diff --git a/solutions/images/observability-ansible-automation-apm-endpoint.png b/solutions/images/observability-ansible-automation-apm-endpoint.png new file mode 100644 index 0000000000..d78de09e59 Binary files /dev/null and b/solutions/images/observability-ansible-automation-apm-endpoint.png differ diff --git a/solutions/images/observability-ansible-automation-apm-service-details.png b/solutions/images/observability-ansible-automation-apm-service-details.png new file mode 100644 index 0000000000..ade4641f1d Binary files /dev/null and b/solutions/images/observability-ansible-automation-apm-service-details.png differ diff --git a/solutions/images/observability-ansible-service-map.png b/solutions/images/observability-ansible-service-map.png new file mode 100644 index 0000000000..7ab6ffb694 Binary files /dev/null and b/solutions/images/observability-ansible-service-map.png differ diff --git a/solutions/images/observability-apm-agent-configuration.png b/solutions/images/observability-apm-agent-configuration.png new file mode 100644 index 0000000000..22fd9d75c3 Binary files /dev/null and b/solutions/images/observability-apm-agent-configuration.png differ diff --git a/solutions/images/observability-apm-agent-explorer-flyout.png b/solutions/images/observability-apm-agent-explorer-flyout.png new file mode 100644 index 0000000000..9792a93a71 Binary files /dev/null and b/solutions/images/observability-apm-agent-explorer-flyout.png differ diff --git a/solutions/images/observability-apm-agent-explorer.png b/solutions/images/observability-apm-agent-explorer.png new file mode 100644 index 0000000000..c6fb7d031e Binary files /dev/null and b/solutions/images/observability-apm-agent-explorer.png differ diff --git a/solutions/images/observability-apm-agent-policy-1.png b/solutions/images/observability-apm-agent-policy-1.png new file mode 100644 index 0000000000..af1f67bb8d Binary files /dev/null and b/solutions/images/observability-apm-agent-policy-1.png differ diff --git a/solutions/images/observability-apm-api-key-beats.png b/solutions/images/observability-apm-api-key-beats.png new file mode 100644 index 0000000000..8b7a76952c Binary files /dev/null and b/solutions/images/observability-apm-api-key-beats.png differ diff --git a/solutions/images/observability-apm-app-kubernetes-filter.png b/solutions/images/observability-apm-app-kubernetes-filter.png new file mode 100644 index 0000000000..de782e846d Binary files /dev/null and b/solutions/images/observability-apm-app-kubernetes-filter.png differ diff --git a/solutions/images/observability-apm-app-landing.png b/solutions/images/observability-apm-app-landing.png new file mode 100644 index 0000000000..cf0f386cc2 Binary files /dev/null and b/solutions/images/observability-apm-app-landing.png differ diff --git a/solutions/images/observability-apm-architecture-diy.png b/solutions/images/observability-apm-architecture-diy.png new file mode 100644 index 0000000000..d4e9646608 Binary files /dev/null and b/solutions/images/observability-apm-architecture-diy.png differ diff --git a/solutions/images/observability-apm-distributed-tracing.png b/solutions/images/observability-apm-distributed-tracing.png new file mode 100644 index 0000000000..7d51e273f9 Binary files /dev/null and b/solutions/images/observability-apm-distributed-tracing.png differ diff --git a/solutions/images/observability-apm-error-group.png b/solutions/images/observability-apm-error-group.png new file mode 100644 index 0000000000..22bceb9d81 Binary files /dev/null and b/solutions/images/observability-apm-error-group.png differ diff --git a/solutions/images/observability-apm-errors-overview.png b/solutions/images/observability-apm-errors-overview.png new file mode 100644 index 0000000000..c390b7ddc0 Binary files /dev/null and b/solutions/images/observability-apm-errors-overview.png differ diff --git a/solutions/images/observability-apm-geo-ui.png b/solutions/images/observability-apm-geo-ui.png new file mode 100644 index 0000000000..69c1390a27 Binary files /dev/null and b/solutions/images/observability-apm-geo-ui.png differ diff --git a/solutions/images/observability-apm-help-me-decide.svg b/solutions/images/observability-apm-help-me-decide.svg new file mode 100644 index 0000000000..dfd0c7fe7d --- /dev/null +++ b/solutions/images/observability-apm-help-me-decide.svg @@ -0,0 +1,47 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/solutions/images/observability-apm-logs-tab.png b/solutions/images/observability-apm-logs-tab.png new file mode 100644 index 0000000000..c79be8b5eb Binary files /dev/null and b/solutions/images/observability-apm-logs-tab.png differ diff --git a/solutions/images/observability-apm-metrics.png b/solutions/images/observability-apm-metrics.png new file mode 100644 index 0000000000..c2d609c7c4 Binary files /dev/null and b/solutions/images/observability-apm-metrics.png differ diff --git a/solutions/images/observability-apm-otel-api-sdk-collector.png b/solutions/images/observability-apm-otel-api-sdk-collector.png new file mode 100644 index 0000000000..5167fc40ab Binary files /dev/null and b/solutions/images/observability-apm-otel-api-sdk-collector.png differ diff --git a/solutions/images/observability-apm-otel-api-sdk-elastic-agent.png b/solutions/images/observability-apm-otel-api-sdk-elastic-agent.png new file mode 100644 index 0000000000..a47b6b2a24 Binary files /dev/null and b/solutions/images/observability-apm-otel-api-sdk-elastic-agent.png differ diff --git a/solutions/images/observability-apm-otel-distro.png b/solutions/images/observability-apm-otel-distro.png new file mode 100644 index 0000000000..b6e3652c64 Binary files /dev/null and b/solutions/images/observability-apm-otel-distro.png differ diff --git a/solutions/images/observability-apm-query-bar.png b/solutions/images/observability-apm-query-bar.png new file mode 100644 index 0000000000..457573f485 Binary files /dev/null and b/solutions/images/observability-apm-query-bar.png differ diff --git a/solutions/images/observability-apm-roles-config.png b/solutions/images/observability-apm-roles-config.png new file mode 100644 index 0000000000..ebd992abe9 Binary files /dev/null and b/solutions/images/observability-apm-roles-config.png differ diff --git a/solutions/images/observability-apm-service-group.png b/solutions/images/observability-apm-service-group.png new file mode 100644 index 0000000000..44a0191411 Binary files /dev/null and b/solutions/images/observability-apm-service-group.png differ diff --git a/solutions/images/observability-apm-service-map-anomaly.png b/solutions/images/observability-apm-service-map-anomaly.png new file mode 100644 index 0000000000..cd59f86690 Binary files /dev/null and b/solutions/images/observability-apm-service-map-anomaly.png differ diff --git a/solutions/images/observability-apm-services-overview.png b/solutions/images/observability-apm-services-overview.png new file mode 100644 index 0000000000..0badeea3be Binary files /dev/null and b/solutions/images/observability-apm-services-overview.png differ diff --git a/solutions/images/observability-apm-services-trace.png b/solutions/images/observability-apm-services-trace.png new file mode 100644 index 0000000000..083c69318e Binary files /dev/null and b/solutions/images/observability-apm-services-trace.png differ diff --git a/solutions/images/observability-apm-span-detail.png b/solutions/images/observability-apm-span-detail.png new file mode 100644 index 0000000000..d0b6a4de3d Binary files /dev/null and b/solutions/images/observability-apm-span-detail.png differ diff --git a/solutions/images/observability-apm-traces.png b/solutions/images/observability-apm-traces.png new file mode 100644 index 0000000000..c8b8d40b01 Binary files /dev/null and b/solutions/images/observability-apm-traces.png differ diff --git a/solutions/images/observability-apm-transaction-annotation.png b/solutions/images/observability-apm-transaction-annotation.png new file mode 100644 index 0000000000..b9360db2ff Binary files /dev/null and b/solutions/images/observability-apm-transaction-annotation.png differ diff --git a/solutions/images/observability-apm-transaction-duration-dist.png b/solutions/images/observability-apm-transaction-duration-dist.png new file mode 100644 index 0000000000..9c7ab5dd67 Binary files /dev/null and b/solutions/images/observability-apm-transaction-duration-dist.png differ diff --git a/solutions/images/observability-apm-transaction-sample.png b/solutions/images/observability-apm-transaction-sample.png new file mode 100644 index 0000000000..a9490fc20d Binary files /dev/null and b/solutions/images/observability-apm-transaction-sample.png differ diff --git a/solutions/images/observability-apm-transactions-overview.png b/solutions/images/observability-apm-transactions-overview.png new file mode 100644 index 0000000000..34cd0219b8 Binary files /dev/null and b/solutions/images/observability-apm-transactions-overview.png differ diff --git a/solutions/images/observability-apm-transactions-table.png b/solutions/images/observability-apm-transactions-table.png new file mode 100644 index 0000000000..8a3415bc9a Binary files /dev/null and b/solutions/images/observability-apm-transactions-table.png differ diff --git a/solutions/images/observability-apm-ui-api-key.png b/solutions/images/observability-apm-ui-api-key.png new file mode 100644 index 0000000000..b110e4e876 Binary files /dev/null and b/solutions/images/observability-apm-ui-api-key.png differ diff --git a/solutions/images/observability-apmTrace-icon.png b/solutions/images/observability-apmTrace-icon.png new file mode 100644 index 0000000000..2c026d1892 Binary files /dev/null and b/solutions/images/observability-apmTrace-icon.png differ diff --git a/solutions/images/observability-apmTrace.svg b/solutions/images/observability-apmTrace.svg new file mode 100644 index 0000000000..800b8e51a4 --- /dev/null +++ b/solutions/images/observability-apmTrace.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-arrowLeft.svg b/solutions/images/observability-arrowLeft.svg new file mode 100644 index 0000000000..d5956d01bb --- /dev/null +++ b/solutions/images/observability-arrowLeft.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-arrowRight.svg b/solutions/images/observability-arrowRight.svg new file mode 100644 index 0000000000..b2d76bddc2 --- /dev/null +++ b/solutions/images/observability-arrowRight.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-aws-billing.png b/solutions/images/observability-aws-billing.png new file mode 100644 index 0000000000..32e8ed35d0 Binary files /dev/null and b/solutions/images/observability-aws-billing.png differ diff --git a/solutions/images/observability-azure-open-ai-data-selector.png b/solutions/images/observability-azure-open-ai-data-selector.png new file mode 100644 index 0000000000..8a02f87b4c Binary files /dev/null and b/solutions/images/observability-azure-open-ai-data-selector.png differ diff --git a/solutions/images/observability-azure-openai-apm-dashboard.png b/solutions/images/observability-azure-openai-apm-dashboard.png new file mode 100644 index 0000000000..0a23d7d74e Binary files /dev/null and b/solutions/images/observability-azure-openai-apm-dashboard.png differ diff --git a/solutions/images/observability-azure-openai-apm-discover.png b/solutions/images/observability-azure-openai-apm-discover.png new file mode 100644 index 0000000000..96991ad438 Binary files /dev/null and b/solutions/images/observability-azure-openai-apm-discover.png differ diff --git a/solutions/images/observability-azure-openai-dashboard.png b/solutions/images/observability-azure-openai-dashboard.png new file mode 100644 index 0000000000..247d117ffa Binary files /dev/null and b/solutions/images/observability-azure-openai-dashboard.png differ diff --git a/solutions/images/observability-azure-openai-discover.png b/solutions/images/observability-azure-openai-discover.png new file mode 100644 index 0000000000..539a7eade2 Binary files /dev/null and b/solutions/images/observability-azure-openai-discover.png differ diff --git a/solutions/images/observability-beaker.svg b/solutions/images/observability-beaker.svg new file mode 100644 index 0000000000..05eb97809c --- /dev/null +++ b/solutions/images/observability-beaker.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-bin-ov.png b/solutions/images/observability-bin-ov.png new file mode 100644 index 0000000000..848294ab82 Binary files /dev/null and b/solutions/images/observability-bin-ov.png differ diff --git a/solutions/images/observability-binary-yes-fm-no.svg b/solutions/images/observability-binary-yes-fm-no.svg new file mode 100644 index 0000000000..db26e2fc39 --- /dev/null +++ b/solutions/images/observability-binary-yes-fm-no.svg @@ -0,0 +1,13 @@ + + + + + + + + + + + + + diff --git a/solutions/images/observability-binary-yes-fm-yes.svg b/solutions/images/observability-binary-yes-fm-yes.svg new file mode 100644 index 0000000000..07c0a2705f --- /dev/null +++ b/solutions/images/observability-binary-yes-fm-yes.svg @@ -0,0 +1,12 @@ + + + + + + + + + + + + diff --git a/solutions/images/observability-boxesHorizontal.svg b/solutions/images/observability-boxesHorizontal.svg new file mode 100644 index 0000000000..d845a6b9db --- /dev/null +++ b/solutions/images/observability-boxesHorizontal.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-boxesVertical.svg b/solutions/images/observability-boxesVertical.svg new file mode 100644 index 0000000000..aed10b0d8e --- /dev/null +++ b/solutions/images/observability-boxesVertical.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-calendar.svg b/solutions/images/observability-calendar.svg new file mode 100644 index 0000000000..ed311de10c --- /dev/null +++ b/solutions/images/observability-calendar.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-cases-add-custom-field.png b/solutions/images/observability-cases-add-custom-field.png new file mode 100644 index 0000000000..9cc46ef848 Binary files /dev/null and b/solutions/images/observability-cases-add-custom-field.png differ diff --git a/solutions/images/observability-cases-privileges.png b/solutions/images/observability-cases-privileges.png new file mode 100644 index 0000000000..aeca46cbf8 Binary files /dev/null and b/solutions/images/observability-cases-privileges.png differ diff --git a/solutions/images/observability-cases-settings.png b/solutions/images/observability-cases-settings.png new file mode 100644 index 0000000000..0ad1b3db6f Binary files /dev/null and b/solutions/images/observability-cases-settings.png differ diff --git a/solutions/images/observability-cases.png b/solutions/images/observability-cases.png new file mode 100644 index 0000000000..2c4478c180 Binary files /dev/null and b/solutions/images/observability-cases.png differ diff --git a/solutions/images/observability-cert-expiry-settings.png b/solutions/images/observability-cert-expiry-settings.png new file mode 100644 index 0000000000..dbcfc79b83 Binary files /dev/null and b/solutions/images/observability-cert-expiry-settings.png differ diff --git a/solutions/images/observability-ci-cd-canary-deployment-pipeline.png b/solutions/images/observability-ci-cd-canary-deployment-pipeline.png new file mode 100644 index 0000000000..6cdc4711b7 Binary files /dev/null and b/solutions/images/observability-ci-cd-canary-deployment-pipeline.png differ diff --git a/solutions/images/observability-ci-cd-overview.png b/solutions/images/observability-ci-cd-overview.png new file mode 100644 index 0000000000..617c61e200 Binary files /dev/null and b/solutions/images/observability-ci-cd-overview.png differ diff --git a/solutions/images/observability-ci-cd-visualize-logs-kibana-and-jenkins-architecture.png b/solutions/images/observability-ci-cd-visualize-logs-kibana-and-jenkins-architecture.png new file mode 100644 index 0000000000..f5cfc52f6a Binary files /dev/null and b/solutions/images/observability-ci-cd-visualize-logs-kibana-and-jenkins-architecture.png differ diff --git a/solutions/images/observability-ci-cd-visualize-logs-kibana-and-jenkins-console.png b/solutions/images/observability-ci-cd-visualize-logs-kibana-and-jenkins-console.png new file mode 100644 index 0000000000..afd404a252 Binary files /dev/null and b/solutions/images/observability-ci-cd-visualize-logs-kibana-and-jenkins-console.png differ diff --git a/solutions/images/observability-ci-cd-visualize-logs-kibana-architecture.png b/solutions/images/observability-ci-cd-visualize-logs-kibana-architecture.png new file mode 100644 index 0000000000..cff1c6f83d Binary files /dev/null and b/solutions/images/observability-ci-cd-visualize-logs-kibana-architecture.png differ diff --git a/solutions/images/observability-ci-cd-visualize-logs-kibana-console.png b/solutions/images/observability-ci-cd-visualize-logs-kibana-console.png new file mode 100644 index 0000000000..e65c94642a Binary files /dev/null and b/solutions/images/observability-ci-cd-visualize-logs-kibana-console.png differ diff --git a/solutions/images/observability-concourse-ci-traces.png b/solutions/images/observability-concourse-ci-traces.png new file mode 100644 index 0000000000..349b94b1eb Binary files /dev/null and b/solutions/images/observability-concourse-ci-traces.png differ diff --git a/solutions/images/observability-configure-event-notification.png b/solutions/images/observability-configure-event-notification.png new file mode 100644 index 0000000000..451564fd94 Binary files /dev/null and b/solutions/images/observability-configure-event-notification.png differ diff --git a/solutions/images/observability-configure-notification-output.png b/solutions/images/observability-configure-notification-output.png new file mode 100644 index 0000000000..c9128ec6bb Binary files /dev/null and b/solutions/images/observability-configure-notification-output.png differ diff --git a/solutions/images/observability-configure-otel-plugin.png b/solutions/images/observability-configure-otel-plugin.png new file mode 100644 index 0000000000..5aabfc510f Binary files /dev/null and b/solutions/images/observability-configure-otel-plugin.png differ diff --git a/solutions/images/observability-contextual-logs.png b/solutions/images/observability-contextual-logs.png new file mode 100644 index 0000000000..446da630fa Binary files /dev/null and b/solutions/images/observability-contextual-logs.png differ diff --git a/solutions/images/observability-correlations-failed-transactions.png b/solutions/images/observability-correlations-failed-transactions.png new file mode 100644 index 0000000000..19221e751e Binary files /dev/null and b/solutions/images/observability-correlations-failed-transactions.png differ diff --git a/solutions/images/observability-correlations-hover.png b/solutions/images/observability-correlations-hover.png new file mode 100644 index 0000000000..9731517b32 Binary files /dev/null and b/solutions/images/observability-correlations-hover.png differ diff --git a/solutions/images/observability-create-component-template.png b/solutions/images/observability-create-component-template.png new file mode 100644 index 0000000000..cd9c18a19a Binary files /dev/null and b/solutions/images/observability-create-component-template.png differ diff --git a/solutions/images/observability-create-github-issue.png b/solutions/images/observability-create-github-issue.png new file mode 100644 index 0000000000..81ea4e5e78 Binary files /dev/null and b/solutions/images/observability-create-github-issue.png differ diff --git a/solutions/images/observability-create-jira-issue.png b/solutions/images/observability-create-jira-issue.png new file mode 100644 index 0000000000..962c98df3f Binary files /dev/null and b/solutions/images/observability-create-jira-issue.png differ diff --git a/solutions/images/observability-creating-a-queue.png b/solutions/images/observability-creating-a-queue.png new file mode 100644 index 0000000000..de1fb5d1a1 Binary files /dev/null and b/solutions/images/observability-creating-a-queue.png differ diff --git a/solutions/images/observability-creating-a-s3-bucket.png b/solutions/images/observability-creating-a-s3-bucket.png new file mode 100644 index 0000000000..a52da7feda Binary files /dev/null and b/solutions/images/observability-creating-a-s3-bucket.png differ diff --git a/solutions/images/observability-cross.svg b/solutions/images/observability-cross.svg new file mode 100644 index 0000000000..82df3e03d3 --- /dev/null +++ b/solutions/images/observability-cross.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-custom-index-template-mapped-fields.png b/solutions/images/observability-custom-index-template-mapped-fields.png new file mode 100644 index 0000000000..cfd92d2174 Binary files /dev/null and b/solutions/images/observability-custom-index-template-mapped-fields.png differ diff --git a/solutions/images/observability-custom-index-template-runtime-fields.png b/solutions/images/observability-custom-index-template-runtime-fields.png new file mode 100644 index 0000000000..a792bcc164 Binary files /dev/null and b/solutions/images/observability-custom-index-template-runtime-fields.png differ diff --git a/solutions/images/observability-data-stream-overview.png b/solutions/images/observability-data-stream-overview.png new file mode 100644 index 0000000000..503661862d Binary files /dev/null and b/solutions/images/observability-data-stream-overview.png differ diff --git a/solutions/images/observability-dependencies-drilldown.png b/solutions/images/observability-dependencies-drilldown.png new file mode 100644 index 0000000000..af82ee3d93 Binary files /dev/null and b/solutions/images/observability-dependencies-drilldown.png differ diff --git a/solutions/images/observability-dependencies.png b/solutions/images/observability-dependencies.png new file mode 100644 index 0000000000..260025d316 Binary files /dev/null and b/solutions/images/observability-dependencies.png differ diff --git a/solutions/images/observability-discover-data-view-menu.png b/solutions/images/observability-discover-data-view-menu.png new file mode 100644 index 0000000000..2fce33fcca Binary files /dev/null and b/solutions/images/observability-discover-data-view-menu.png differ diff --git a/solutions/images/observability-discover-destination-port.png b/solutions/images/observability-discover-destination-port.png new file mode 100644 index 0000000000..57104b89cf Binary files /dev/null and b/solutions/images/observability-discover-destination-port.png differ diff --git a/solutions/images/observability-discover-ip-addresses.png b/solutions/images/observability-discover-ip-addresses.png new file mode 100644 index 0000000000..d26d4230ab Binary files /dev/null and b/solutions/images/observability-discover-ip-addresses.png differ diff --git a/solutions/images/observability-discover-visualize-chart.png b/solutions/images/observability-discover-visualize-chart.png new file mode 100644 index 0000000000..67890da67b Binary files /dev/null and b/solutions/images/observability-discover-visualize-chart.png differ diff --git a/solutions/images/observability-dt-sampling-continuation-strategy-restart.png b/solutions/images/observability-dt-sampling-continuation-strategy-restart.png new file mode 100644 index 0000000000..e68e43caf7 Binary files /dev/null and b/solutions/images/observability-dt-sampling-continuation-strategy-restart.png differ diff --git a/solutions/images/observability-dt-sampling-continuation-strategy-restart_external.png b/solutions/images/observability-dt-sampling-continuation-strategy-restart_external.png new file mode 100644 index 0000000000..68b19dfc1b Binary files /dev/null and b/solutions/images/observability-dt-sampling-continuation-strategy-restart_external.png differ diff --git a/solutions/images/observability-dt-sampling-example-1.png b/solutions/images/observability-dt-sampling-example-1.png new file mode 100644 index 0000000000..07ff3fc0d5 Binary files /dev/null and b/solutions/images/observability-dt-sampling-example-1.png differ diff --git a/solutions/images/observability-dt-sampling-example-2.png b/solutions/images/observability-dt-sampling-example-2.png new file mode 100644 index 0000000000..b6fd4d3419 Binary files /dev/null and b/solutions/images/observability-dt-sampling-example-2.png differ diff --git a/solutions/images/observability-dt-sampling-example-3.png b/solutions/images/observability-dt-sampling-example-3.png new file mode 100644 index 0000000000..bd795b3783 Binary files /dev/null and b/solutions/images/observability-dt-sampling-example-3.png differ diff --git a/solutions/images/observability-dt-trace-ex1.png b/solutions/images/observability-dt-trace-ex1.png new file mode 100644 index 0000000000..ca97955ee8 Binary files /dev/null and b/solutions/images/observability-dt-trace-ex1.png differ diff --git a/solutions/images/observability-dt-trace-ex2.png b/solutions/images/observability-dt-trace-ex2.png new file mode 100644 index 0000000000..3df0827f58 Binary files /dev/null and b/solutions/images/observability-dt-trace-ex2.png differ diff --git a/solutions/images/observability-dt-trace-ex3.png b/solutions/images/observability-dt-trace-ex3.png new file mode 100644 index 0000000000..1bb666b030 Binary files /dev/null and b/solutions/images/observability-dt-trace-ex3.png differ diff --git a/solutions/images/observability-duration-anomaly-alert-default-message.png b/solutions/images/observability-duration-anomaly-alert-default-message.png new file mode 100644 index 0000000000..219193fbbc Binary files /dev/null and b/solutions/images/observability-duration-anomaly-alert-default-message.png differ diff --git a/solutions/images/observability-duration-anomaly-alert-recovery.png b/solutions/images/observability-duration-anomaly-alert-recovery.png new file mode 100644 index 0000000000..3365e0c472 Binary files /dev/null and b/solutions/images/observability-duration-anomaly-alert-recovery.png differ diff --git a/solutions/images/observability-duration-anomaly-alert-summary.png b/solutions/images/observability-duration-anomaly-alert-summary.png new file mode 100644 index 0000000000..7708ef0d8d Binary files /dev/null and b/solutions/images/observability-duration-anomaly-alert-summary.png differ diff --git a/solutions/images/observability-duration-anomaly-run-when-selection.png b/solutions/images/observability-duration-anomaly-run-when-selection.png new file mode 100644 index 0000000000..0aacb7790e Binary files /dev/null and b/solutions/images/observability-duration-anomaly-run-when-selection.png differ diff --git a/solutions/images/observability-dynamic-config.svg b/solutions/images/observability-dynamic-config.svg new file mode 100644 index 0000000000..df62a3c84f --- /dev/null +++ b/solutions/images/observability-dynamic-config.svg @@ -0,0 +1 @@ + DynamicDynamic \ No newline at end of file diff --git a/solutions/images/observability-ec2-dashboard.png b/solutions/images/observability-ec2-dashboard.png new file mode 100644 index 0000000000..cf74a789e6 Binary files /dev/null and b/solutions/images/observability-ec2-dashboard.png differ diff --git a/solutions/images/observability-ec2-overview-dashboard.png b/solutions/images/observability-ec2-overview-dashboard.png new file mode 100644 index 0000000000..6b41e78561 Binary files /dev/null and b/solutions/images/observability-ec2-overview-dashboard.png differ diff --git a/solutions/images/observability-elastic-agent-splunk.png b/solutions/images/observability-elastic-agent-splunk.png new file mode 100644 index 0000000000..0c596820d6 Binary files /dev/null and b/solutions/images/observability-elastic-agent-splunk.png differ diff --git a/solutions/images/observability-error-rate.png b/solutions/images/observability-error-rate.png new file mode 100644 index 0000000000..845fa2af07 Binary files /dev/null and b/solutions/images/observability-error-rate.png differ diff --git a/solutions/images/observability-example-metadata.png b/solutions/images/observability-example-metadata.png new file mode 100644 index 0000000000..2a5bda7f08 Binary files /dev/null and b/solutions/images/observability-example-metadata.png differ diff --git a/solutions/images/observability-expand-icon.png b/solutions/images/observability-expand-icon.png new file mode 100644 index 0000000000..e79472ccd8 Binary files /dev/null and b/solutions/images/observability-expand-icon.png differ diff --git a/solutions/images/observability-filter.png b/solutions/images/observability-filter.png new file mode 100644 index 0000000000..f1f6b588ce Binary files /dev/null and b/solutions/images/observability-filter.png differ diff --git a/solutions/images/observability-firehose-cloudtrail-cloudwatch.png b/solutions/images/observability-firehose-cloudtrail-cloudwatch.png new file mode 100644 index 0000000000..56a8010968 Binary files /dev/null and b/solutions/images/observability-firehose-cloudtrail-cloudwatch.png differ diff --git a/solutions/images/observability-firehose-cloudtrail-dashboard.png b/solutions/images/observability-firehose-cloudtrail-dashboard.png new file mode 100644 index 0000000000..0e6b4f5d3e Binary files /dev/null and b/solutions/images/observability-firehose-cloudtrail-dashboard.png differ diff --git a/solutions/images/observability-firehose-cloudtrail-discover.png b/solutions/images/observability-firehose-cloudtrail-discover.png new file mode 100644 index 0000000000..fae79c122d Binary files /dev/null and b/solutions/images/observability-firehose-cloudtrail-discover.png differ diff --git a/solutions/images/observability-firehose-cloudtrail-logsexplorer.png b/solutions/images/observability-firehose-cloudtrail-logsexplorer.png new file mode 100644 index 0000000000..de90d652bd Binary files /dev/null and b/solutions/images/observability-firehose-cloudtrail-logsexplorer.png differ diff --git a/solutions/images/observability-firehose-cloudwatch-data-stream.png b/solutions/images/observability-firehose-cloudwatch-data-stream.png new file mode 100644 index 0000000000..e70670e4f3 Binary files /dev/null and b/solutions/images/observability-firehose-cloudwatch-data-stream.png differ diff --git a/solutions/images/observability-firehose-cloudwatch-destination-errors.png b/solutions/images/observability-firehose-cloudwatch-destination-errors.png new file mode 100644 index 0000000000..471fa9fbbc Binary files /dev/null and b/solutions/images/observability-firehose-cloudwatch-destination-errors.png differ diff --git a/solutions/images/observability-firehose-cloudwatch-firehose-stream.png b/solutions/images/observability-firehose-cloudwatch-firehose-stream.png new file mode 100644 index 0000000000..b81f0b7f66 Binary files /dev/null and b/solutions/images/observability-firehose-cloudwatch-firehose-stream.png differ diff --git a/solutions/images/observability-firehose-cloudwatch-log-group.png b/solutions/images/observability-firehose-cloudwatch-log-group.png new file mode 100644 index 0000000000..44cb5e2dd9 Binary files /dev/null and b/solutions/images/observability-firehose-cloudwatch-log-group.png differ diff --git a/solutions/images/observability-firehose-cloudwatch-sample-logs.png b/solutions/images/observability-firehose-cloudwatch-sample-logs.png new file mode 100644 index 0000000000..4d6a8df618 Binary files /dev/null and b/solutions/images/observability-firehose-cloudwatch-sample-logs.png differ diff --git a/solutions/images/observability-firehose-cloudwatch-subscription-filter.png b/solutions/images/observability-firehose-cloudwatch-subscription-filter.png new file mode 100644 index 0000000000..2f7293d375 Binary files /dev/null and b/solutions/images/observability-firehose-cloudwatch-subscription-filter.png differ diff --git a/solutions/images/observability-firehose-cloudwatch-verify-discover.png b/solutions/images/observability-firehose-cloudwatch-verify-discover.png new file mode 100644 index 0000000000..bb95b164ad Binary files /dev/null and b/solutions/images/observability-firehose-cloudwatch-verify-discover.png differ diff --git a/solutions/images/observability-firehose-delivery-stream.png b/solutions/images/observability-firehose-delivery-stream.png new file mode 100644 index 0000000000..bf4226ec24 Binary files /dev/null and b/solutions/images/observability-firehose-delivery-stream.png differ diff --git a/solutions/images/observability-firehose-failed-delivery-stream.png b/solutions/images/observability-firehose-failed-delivery-stream.png new file mode 100644 index 0000000000..c68e73f9c1 Binary files /dev/null and b/solutions/images/observability-firehose-failed-delivery-stream.png differ diff --git a/solutions/images/observability-firehose-monitor-cloudtrail-logs.png b/solutions/images/observability-firehose-monitor-cloudtrail-logs.png new file mode 100644 index 0000000000..2b2f48dbea Binary files /dev/null and b/solutions/images/observability-firehose-monitor-cloudtrail-logs.png differ diff --git a/solutions/images/observability-firehose-networkfirewall-data-stream.png b/solutions/images/observability-firehose-networkfirewall-data-stream.png new file mode 100644 index 0000000000..14da07e996 Binary files /dev/null and b/solutions/images/observability-firehose-networkfirewall-data-stream.png differ diff --git a/solutions/images/observability-firehose-networkfirewall-discover.png b/solutions/images/observability-firehose-networkfirewall-discover.png new file mode 100644 index 0000000000..0a3342e5e3 Binary files /dev/null and b/solutions/images/observability-firehose-networkfirewall-discover.png differ diff --git a/solutions/images/observability-firehose-networkfirewall-firewall.png b/solutions/images/observability-firehose-networkfirewall-firewall.png new file mode 100644 index 0000000000..31a6c39e87 Binary files /dev/null and b/solutions/images/observability-firehose-networkfirewall-firewall.png differ diff --git a/solutions/images/observability-firehose-networkfirewall-logging.png b/solutions/images/observability-firehose-networkfirewall-logging.png new file mode 100644 index 0000000000..acc61d35d4 Binary files /dev/null and b/solutions/images/observability-firehose-networkfirewall-logging.png differ diff --git a/solutions/images/observability-firehose-networkfirewall-stream.png b/solutions/images/observability-firehose-networkfirewall-stream.png new file mode 100644 index 0000000000..93b71ba654 Binary files /dev/null and b/solutions/images/observability-firehose-networkfirewall-stream.png differ diff --git a/solutions/images/observability-firehose-subscription-filter.png b/solutions/images/observability-firehose-subscription-filter.png new file mode 100644 index 0000000000..858a67c4ff Binary files /dev/null and b/solutions/images/observability-firehose-subscription-filter.png differ diff --git a/solutions/images/observability-firehose-verify-events-cloudwatch.png b/solutions/images/observability-firehose-verify-events-cloudwatch.png new file mode 100644 index 0000000000..c4e33e9800 Binary files /dev/null and b/solutions/images/observability-firehose-verify-events-cloudwatch.png differ diff --git a/solutions/images/observability-firehose-waf-logs.png b/solutions/images/observability-firehose-waf-logs.png new file mode 100644 index 0000000000..0e05f6fa55 Binary files /dev/null and b/solutions/images/observability-firehose-waf-logs.png differ diff --git a/solutions/images/observability-flow-log-dashboard.png b/solutions/images/observability-flow-log-dashboard.png new file mode 100644 index 0000000000..4767e80474 Binary files /dev/null and b/solutions/images/observability-flow-log-dashboard.png differ diff --git a/solutions/images/observability-fm-ov.png b/solutions/images/observability-fm-ov.png new file mode 100644 index 0000000000..7aace8b287 Binary files /dev/null and b/solutions/images/observability-fm-ov.png differ diff --git a/solutions/images/observability-get-started.svg b/solutions/images/observability-get-started.svg new file mode 100644 index 0000000000..487355b2f9 --- /dev/null +++ b/solutions/images/observability-get-started.svg @@ -0,0 +1,21 @@ + + + + + + + + + + + + + + + + + + + + + diff --git a/solutions/images/observability-global-filters.png b/solutions/images/observability-global-filters.png new file mode 100644 index 0000000000..f93a5214c3 Binary files /dev/null and b/solutions/images/observability-global-filters.png differ diff --git a/solutions/images/observability-green-service.png b/solutions/images/observability-green-service.png new file mode 100644 index 0000000000..bbc00a3543 Binary files /dev/null and b/solutions/images/observability-green-service.png differ diff --git a/solutions/images/observability-heartbeat-indices.png b/solutions/images/observability-heartbeat-indices.png new file mode 100644 index 0000000000..a1ccb19378 Binary files /dev/null and b/solutions/images/observability-heartbeat-indices.png differ diff --git a/solutions/images/observability-help-icon.png b/solutions/images/observability-help-icon.png new file mode 100644 index 0000000000..49eefac61a Binary files /dev/null and b/solutions/images/observability-help-icon.png differ diff --git a/solutions/images/observability-ingest-options-overview.png b/solutions/images/observability-ingest-options-overview.png new file mode 100644 index 0000000000..a6c207cd06 Binary files /dev/null and b/solutions/images/observability-ingest-options-overview.png differ diff --git a/solutions/images/observability-inspect-uptime-duration-anomalies.png b/solutions/images/observability-inspect-uptime-duration-anomalies.png new file mode 100644 index 0000000000..9a015dabd4 Binary files /dev/null and b/solutions/images/observability-inspect-uptime-duration-anomalies.png differ diff --git a/solutions/images/observability-inspect.svg b/solutions/images/observability-inspect.svg new file mode 100644 index 0000000000..43374b4aa4 --- /dev/null +++ b/solutions/images/observability-inspect.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-inventory-catalog.png b/solutions/images/observability-inventory-catalog.png new file mode 100644 index 0000000000..71fe1c4849 Binary files /dev/null and b/solutions/images/observability-inventory-catalog.png differ diff --git a/solutions/images/observability-inventory-entity-detailed-view.png b/solutions/images/observability-inventory-entity-detailed-view.png new file mode 100644 index 0000000000..030b5fa978 Binary files /dev/null and b/solutions/images/observability-inventory-entity-detailed-view.png differ diff --git a/solutions/images/observability-jenkins-ansible-pipeline.png b/solutions/images/observability-jenkins-ansible-pipeline.png new file mode 100644 index 0000000000..f9f4d039ee Binary files /dev/null and b/solutions/images/observability-jenkins-ansible-pipeline.png differ diff --git a/solutions/images/observability-jenkins-concourse.png b/solutions/images/observability-jenkins-concourse.png new file mode 100644 index 0000000000..3aa2a8f628 Binary files /dev/null and b/solutions/images/observability-jenkins-concourse.png differ diff --git a/solutions/images/observability-jenkins-dashboard-import.png b/solutions/images/observability-jenkins-dashboard-import.png new file mode 100644 index 0000000000..1ec61255a7 Binary files /dev/null and b/solutions/images/observability-jenkins-dashboard-import.png differ diff --git a/solutions/images/observability-jenkins-dashboard-ready.png b/solutions/images/observability-jenkins-dashboard-ready.png new file mode 100644 index 0000000000..551c7691a7 Binary files /dev/null and b/solutions/images/observability-jenkins-dashboard-ready.png differ diff --git a/solutions/images/observability-jenkins-dashboard.png b/solutions/images/observability-jenkins-dashboard.png new file mode 100644 index 0000000000..c245580d6b Binary files /dev/null and b/solutions/images/observability-jenkins-dashboard.png differ diff --git a/solutions/images/observability-jenkins-jvm-indicators.png b/solutions/images/observability-jenkins-jvm-indicators.png new file mode 100644 index 0000000000..cec6fd9534 Binary files /dev/null and b/solutions/images/observability-jenkins-jvm-indicators.png differ diff --git a/solutions/images/observability-jenkins-kpis.png b/solutions/images/observability-jenkins-kpis.png new file mode 100644 index 0000000000..a381fdcbe4 Binary files /dev/null and b/solutions/images/observability-jenkins-kpis.png differ diff --git a/solutions/images/observability-jenkins-makefile.png b/solutions/images/observability-jenkins-makefile.png new file mode 100644 index 0000000000..806348db52 Binary files /dev/null and b/solutions/images/observability-jenkins-makefile.png differ diff --git a/solutions/images/observability-jenkins-maven-pipeline.png b/solutions/images/observability-jenkins-maven-pipeline.png new file mode 100644 index 0000000000..e672db5012 Binary files /dev/null and b/solutions/images/observability-jenkins-maven-pipeline.png differ diff --git a/solutions/images/observability-jenkins-pipeline-build.png b/solutions/images/observability-jenkins-pipeline-build.png new file mode 100644 index 0000000000..c44b321c1b Binary files /dev/null and b/solutions/images/observability-jenkins-pipeline-build.png differ diff --git a/solutions/images/observability-jenkins-pipeline-context.png b/solutions/images/observability-jenkins-pipeline-context.png new file mode 100644 index 0000000000..a884f04392 Binary files /dev/null and b/solutions/images/observability-jenkins-pipeline-context.png differ diff --git a/solutions/images/observability-jenkins-pipeline-errors.png b/solutions/images/observability-jenkins-pipeline-errors.png new file mode 100644 index 0000000000..ee126c03d5 Binary files /dev/null and b/solutions/images/observability-jenkins-pipeline-errors.png differ diff --git a/solutions/images/observability-jenkins-pipeline-overview.png b/solutions/images/observability-jenkins-pipeline-overview.png new file mode 100644 index 0000000000..11c6e4f2ae Binary files /dev/null and b/solutions/images/observability-jenkins-pipeline-overview.png differ diff --git a/solutions/images/observability-jenkins-pipeline-trace.png b/solutions/images/observability-jenkins-pipeline-trace.png new file mode 100644 index 0000000000..eee24441ec Binary files /dev/null and b/solutions/images/observability-jenkins-pipeline-trace.png differ diff --git a/solutions/images/observability-jenkins-plugin-manager.png b/solutions/images/observability-jenkins-plugin-manager.png new file mode 100644 index 0000000000..6dc30dc7b0 Binary files /dev/null and b/solutions/images/observability-jenkins-plugin-manager.png differ diff --git a/solutions/images/observability-jenkins-server.png b/solutions/images/observability-jenkins-server.png new file mode 100644 index 0000000000..3a1ec43b84 Binary files /dev/null and b/solutions/images/observability-jenkins-server.png differ diff --git a/solutions/images/observability-jenkins-servers.png b/solutions/images/observability-jenkins-servers.png new file mode 100644 index 0000000000..0e6716d8da Binary files /dev/null and b/solutions/images/observability-jenkins-servers.png differ diff --git a/solutions/images/observability-jenkins-service-map.png b/solutions/images/observability-jenkins-service-map.png new file mode 100644 index 0000000000..a01877fa09 Binary files /dev/null and b/solutions/images/observability-jenkins-service-map.png differ diff --git a/solutions/images/observability-js-errors.png b/solutions/images/observability-js-errors.png new file mode 100644 index 0000000000..224b22fabd Binary files /dev/null and b/solutions/images/observability-js-errors.png differ diff --git a/solutions/images/observability-jvm-metrics-overview.png b/solutions/images/observability-jvm-metrics-overview.png new file mode 100644 index 0000000000..c6f28f7bdf Binary files /dev/null and b/solutions/images/observability-jvm-metrics-overview.png differ diff --git a/solutions/images/observability-jvm-metrics.png b/solutions/images/observability-jvm-metrics.png new file mode 100644 index 0000000000..70f7965b72 Binary files /dev/null and b/solutions/images/observability-jvm-metrics.png differ diff --git a/solutions/images/observability-k8s-monitoring-architecture.png b/solutions/images/observability-k8s-monitoring-architecture.png new file mode 100644 index 0000000000..c1d6db61e1 Binary files /dev/null and b/solutions/images/observability-k8s-monitoring-architecture.png differ diff --git a/solutions/images/observability-kibana-agent-add-log-path.png b/solutions/images/observability-kibana-agent-add-log-path.png new file mode 100644 index 0000000000..d65240d27b Binary files /dev/null and b/solutions/images/observability-kibana-agent-add-log-path.png differ diff --git a/solutions/images/observability-kibana-agent-flyout.png b/solutions/images/observability-kibana-agent-flyout.png new file mode 100644 index 0000000000..979ae1727a Binary files /dev/null and b/solutions/images/observability-kibana-agent-flyout.png differ diff --git a/solutions/images/observability-kibana-apm-sample-data.png b/solutions/images/observability-kibana-apm-sample-data.png new file mode 100644 index 0000000000..7aeb5f1ac3 Binary files /dev/null and b/solutions/images/observability-kibana-apm-sample-data.png differ diff --git a/solutions/images/observability-kibana-fleet-integrations-apm-overview.png b/solutions/images/observability-kibana-fleet-integrations-apm-overview.png new file mode 100644 index 0000000000..9de2b9fe91 Binary files /dev/null and b/solutions/images/observability-kibana-fleet-integrations-apm-overview.png differ diff --git a/solutions/images/observability-kibana-fleet-integrations-apm.png b/solutions/images/observability-kibana-fleet-integrations-apm.png new file mode 100644 index 0000000000..69622df9d7 Binary files /dev/null and b/solutions/images/observability-kibana-fleet-integrations-apm.png differ diff --git a/solutions/images/observability-kibana-fleet-third-party-rest-api.png b/solutions/images/observability-kibana-fleet-third-party-rest-api.png new file mode 100644 index 0000000000..6a1e3dd063 Binary files /dev/null and b/solutions/images/observability-kibana-fleet-third-party-rest-api.png differ diff --git a/solutions/images/observability-kibana-fleet-third-party-rest-dataset-settings.png b/solutions/images/observability-kibana-fleet-third-party-rest-dataset-settings.png new file mode 100644 index 0000000000..a973b49499 Binary files /dev/null and b/solutions/images/observability-kibana-fleet-third-party-rest-dataset-settings.png differ diff --git a/solutions/images/observability-kibana-fleet-third-party-rest-settings.png b/solutions/images/observability-kibana-fleet-third-party-rest-settings.png new file mode 100644 index 0000000000..b496947f64 Binary files /dev/null and b/solutions/images/observability-kibana-fleet-third-party-rest-settings.png differ diff --git a/solutions/images/observability-kibana-system-policy.png b/solutions/images/observability-kibana-system-policy.png new file mode 100644 index 0000000000..f97fcb555e Binary files /dev/null and b/solutions/images/observability-kibana-system-policy.png differ diff --git a/solutions/images/observability-kibana-url.png b/solutions/images/observability-kibana-url.png new file mode 100644 index 0000000000..70fb3cd0c6 Binary files /dev/null and b/solutions/images/observability-kibana-url.png differ diff --git a/solutions/images/observability-kinesis-dashboard.png b/solutions/images/observability-kinesis-dashboard.png new file mode 100644 index 0000000000..b62051aa17 Binary files /dev/null and b/solutions/images/observability-kinesis-dashboard.png differ diff --git a/solutions/images/observability-kubernetes-filter.png b/solutions/images/observability-kubernetes-filter.png new file mode 100644 index 0000000000..d8b04c9d9e Binary files /dev/null and b/solutions/images/observability-kubernetes-filter.png differ diff --git a/solutions/images/observability-lambda-overview.png b/solutions/images/observability-lambda-overview.png new file mode 100644 index 0000000000..9d0558949f Binary files /dev/null and b/solutions/images/observability-lambda-overview.png differ diff --git a/solutions/images/observability-latency.png b/solutions/images/observability-latency.png new file mode 100644 index 0000000000..1c220c1a4b Binary files /dev/null and b/solutions/images/observability-latency.png differ diff --git a/solutions/images/observability-listAdd.png b/solutions/images/observability-listAdd.png new file mode 100644 index 0000000000..d6283548a6 Binary files /dev/null and b/solutions/images/observability-listAdd.png differ diff --git a/solutions/images/observability-log-categories.jpg b/solutions/images/observability-log-categories.jpg new file mode 100644 index 0000000000..74fd17acc0 Binary files /dev/null and b/solutions/images/observability-log-categories.jpg differ diff --git a/solutions/images/observability-log-event-details.png b/solutions/images/observability-log-event-details.png new file mode 100644 index 0000000000..5ce712a6b5 Binary files /dev/null and b/solutions/images/observability-log-event-details.png differ diff --git a/solutions/images/observability-log-explorer.png b/solutions/images/observability-log-explorer.png new file mode 100644 index 0000000000..9d7e3950a3 Binary files /dev/null and b/solutions/images/observability-log-explorer.png differ diff --git a/solutions/images/observability-log-menu.png b/solutions/images/observability-log-menu.png new file mode 100644 index 0000000000..07b9412bd4 Binary files /dev/null and b/solutions/images/observability-log-menu.png differ diff --git a/solutions/images/observability-log-opened.png b/solutions/images/observability-log-opened.png new file mode 100644 index 0000000000..33e07a84cb Binary files /dev/null and b/solutions/images/observability-log-opened.png differ diff --git a/solutions/images/observability-log-threshold-alert-chart-previews.png b/solutions/images/observability-log-threshold-alert-chart-previews.png new file mode 100644 index 0000000000..96bc147e06 Binary files /dev/null and b/solutions/images/observability-log-threshold-alert-chart-previews.png differ diff --git a/solutions/images/observability-log-threshold-alert-es-query-grouped.png b/solutions/images/observability-log-threshold-alert-es-query-grouped.png new file mode 100644 index 0000000000..37a39f82df Binary files /dev/null and b/solutions/images/observability-log-threshold-alert-es-query-grouped.png differ diff --git a/solutions/images/observability-log-threshold-alert-es-query-ungrouped.png b/solutions/images/observability-log-threshold-alert-es-query-ungrouped.png new file mode 100644 index 0000000000..a9e34b9edc Binary files /dev/null and b/solutions/images/observability-log-threshold-alert-es-query-ungrouped.png differ diff --git a/solutions/images/observability-log-threshold-alert-group-by.png b/solutions/images/observability-log-threshold-alert-group-by.png new file mode 100644 index 0000000000..7a46ac7eb4 Binary files /dev/null and b/solutions/images/observability-log-threshold-alert-group-by.png differ diff --git a/solutions/images/observability-log-threshold-alert-ratio.png b/solutions/images/observability-log-threshold-alert-ratio.png new file mode 100644 index 0000000000..1a9adfb49e Binary files /dev/null and b/solutions/images/observability-log-threshold-alert-ratio.png differ diff --git a/solutions/images/observability-log-threshold-alert.png b/solutions/images/observability-log-threshold-alert.png new file mode 100644 index 0000000000..8af5c4d4b6 Binary files /dev/null and b/solutions/images/observability-log-threshold-alert.png differ diff --git a/solutions/images/observability-log-threshold-breach-alert-history-chart.png b/solutions/images/observability-log-threshold-breach-alert-history-chart.png new file mode 100644 index 0000000000..bc9f274d8b Binary files /dev/null and b/solutions/images/observability-log-threshold-breach-alert-history-chart.png differ diff --git a/solutions/images/observability-log-threshold-breach-condition-chart.png b/solutions/images/observability-log-threshold-breach-condition-chart.png new file mode 100644 index 0000000000..ff4c268493 Binary files /dev/null and b/solutions/images/observability-log-threshold-breach-condition-chart.png differ diff --git a/solutions/images/observability-log-threshold-breach-log-rate-analysis.png b/solutions/images/observability-log-threshold-breach-log-rate-analysis.png new file mode 100644 index 0000000000..2854f11f19 Binary files /dev/null and b/solutions/images/observability-log-threshold-breach-log-rate-analysis.png differ diff --git a/solutions/images/observability-log-threshold-run-when-selection.png b/solutions/images/observability-log-threshold-run-when-selection.png new file mode 100644 index 0000000000..9b21a12ad1 Binary files /dev/null and b/solutions/images/observability-log-threshold-run-when-selection.png differ diff --git a/solutions/images/observability-logs-explorer-applications.png b/solutions/images/observability-logs-explorer-applications.png new file mode 100644 index 0000000000..fae8607213 Binary files /dev/null and b/solutions/images/observability-logs-explorer-applications.png differ diff --git a/solutions/images/observability-logs-overlay-containers.png b/solutions/images/observability-logs-overlay-containers.png new file mode 100644 index 0000000000..1364f296ed Binary files /dev/null and b/solutions/images/observability-logs-overlay-containers.png differ diff --git a/solutions/images/observability-logs-overlay.png b/solutions/images/observability-logs-overlay.png new file mode 100644 index 0000000000..002656477d Binary files /dev/null and b/solutions/images/observability-logs-overlay.png differ diff --git a/solutions/images/observability-logs-threshold-alert-default-message.png b/solutions/images/observability-logs-threshold-alert-default-message.png new file mode 100644 index 0000000000..beee888d75 Binary files /dev/null and b/solutions/images/observability-logs-threshold-alert-default-message.png differ diff --git a/solutions/images/observability-logs-threshold-conditional-alert.png b/solutions/images/observability-logs-threshold-conditional-alert.png new file mode 100644 index 0000000000..73f6bfc5bc Binary files /dev/null and b/solutions/images/observability-logs-threshold-conditional-alert.png differ diff --git a/solutions/images/observability-logs.png b/solutions/images/observability-logs.png new file mode 100644 index 0000000000..94d77b4749 Binary files /dev/null and b/solutions/images/observability-logs.png differ diff --git a/solutions/images/observability-metadata-icons.png b/solutions/images/observability-metadata-icons.png new file mode 100644 index 0000000000..402c0ed07c Binary files /dev/null and b/solutions/images/observability-metadata-icons.png differ diff --git a/solutions/images/observability-metadata-overlay-containers.png b/solutions/images/observability-metadata-overlay-containers.png new file mode 100644 index 0000000000..33b70cba49 Binary files /dev/null and b/solutions/images/observability-metadata-overlay-containers.png differ diff --git a/solutions/images/observability-metadata-overlay.png b/solutions/images/observability-metadata-overlay.png new file mode 100644 index 0000000000..0ab8c94952 Binary files /dev/null and b/solutions/images/observability-metadata-overlay.png differ diff --git a/solutions/images/observability-metadata-processors.png b/solutions/images/observability-metadata-processors.png new file mode 100644 index 0000000000..fae6ee6a1c Binary files /dev/null and b/solutions/images/observability-metadata-processors.png differ diff --git a/solutions/images/observability-metric-threshold-conditional-alerts.png b/solutions/images/observability-metric-threshold-conditional-alerts.png new file mode 100644 index 0000000000..44beb268fd Binary files /dev/null and b/solutions/images/observability-metric-threshold-conditional-alerts.png differ diff --git a/solutions/images/observability-metrics-alert-filters-and-group.png b/solutions/images/observability-metrics-alert-filters-and-group.png new file mode 100644 index 0000000000..07b421e78b Binary files /dev/null and b/solutions/images/observability-metrics-alert-filters-and-group.png differ diff --git a/solutions/images/observability-metrics-alert.png b/solutions/images/observability-metrics-alert.png new file mode 100644 index 0000000000..ae9de5d614 Binary files /dev/null and b/solutions/images/observability-metrics-alert.png differ diff --git a/solutions/images/observability-metrics-app.png b/solutions/images/observability-metrics-app.png new file mode 100644 index 0000000000..c7ad82851f Binary files /dev/null and b/solutions/images/observability-metrics-app.png differ diff --git a/solutions/images/observability-metrics-explorer-filter.png b/solutions/images/observability-metrics-explorer-filter.png new file mode 100644 index 0000000000..6b074c5daa Binary files /dev/null and b/solutions/images/observability-metrics-explorer-filter.png differ diff --git a/solutions/images/observability-metrics-explorer.png b/solutions/images/observability-metrics-explorer.png new file mode 100644 index 0000000000..a26251df11 Binary files /dev/null and b/solutions/images/observability-metrics-explorer.png differ diff --git a/solutions/images/observability-metrics-inventory.png b/solutions/images/observability-metrics-inventory.png new file mode 100644 index 0000000000..478888190e Binary files /dev/null and b/solutions/images/observability-metrics-inventory.png differ diff --git a/solutions/images/observability-metrics-overlay-containers.png b/solutions/images/observability-metrics-overlay-containers.png new file mode 100644 index 0000000000..bed3b15e90 Binary files /dev/null and b/solutions/images/observability-metrics-overlay-containers.png differ diff --git a/solutions/images/observability-metrics-summary.png b/solutions/images/observability-metrics-summary.png new file mode 100644 index 0000000000..97bc13cb9c Binary files /dev/null and b/solutions/images/observability-metrics-summary.png differ diff --git a/solutions/images/observability-metrics-threshold-alert-default-message.png b/solutions/images/observability-metrics-threshold-alert-default-message.png new file mode 100644 index 0000000000..96ade02db2 Binary files /dev/null and b/solutions/images/observability-metrics-threshold-alert-default-message.png differ diff --git a/solutions/images/observability-metrics-threshold-run-when-selection.png b/solutions/images/observability-metrics-threshold-run-when-selection.png new file mode 100644 index 0000000000..720242526a Binary files /dev/null and b/solutions/images/observability-metrics-threshold-run-when-selection.png differ diff --git a/solutions/images/observability-metrics-time-series.png b/solutions/images/observability-metrics-time-series.png new file mode 100644 index 0000000000..9911f7cde4 Binary files /dev/null and b/solutions/images/observability-metrics-time-series.png differ diff --git a/solutions/images/observability-minus.svg b/solutions/images/observability-minus.svg new file mode 100644 index 0000000000..763922a916 --- /dev/null +++ b/solutions/images/observability-minus.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-minusInCircle.png b/solutions/images/observability-minusInCircle.png new file mode 100644 index 0000000000..d8253e8a58 Binary files /dev/null and b/solutions/images/observability-minusInCircle.png differ diff --git a/solutions/images/observability-ml-anomalies-detection.png b/solutions/images/observability-ml-anomalies-detection.png new file mode 100644 index 0000000000..5b27f0fb0d Binary files /dev/null and b/solutions/images/observability-ml-anomalies-detection.png differ diff --git a/solutions/images/observability-ml-anomalies-explorer.png b/solutions/images/observability-ml-anomalies-explorer.png new file mode 100644 index 0000000000..05f6bbf3e9 Binary files /dev/null and b/solutions/images/observability-ml-anomalies-explorer.png differ diff --git a/solutions/images/observability-ml-anomalies-results.png b/solutions/images/observability-ml-anomalies-results.png new file mode 100644 index 0000000000..f7ab628c76 Binary files /dev/null and b/solutions/images/observability-ml-anomalies-results.png differ diff --git a/solutions/images/observability-ml-spike.png b/solutions/images/observability-ml-spike.png new file mode 100644 index 0000000000..e346a72ece Binary files /dev/null and b/solutions/images/observability-ml-spike.png differ diff --git a/solutions/images/observability-mobile-location.png b/solutions/images/observability-mobile-location.png new file mode 100644 index 0000000000..35b0d91a2d Binary files /dev/null and b/solutions/images/observability-mobile-location.png differ diff --git a/solutions/images/observability-mobile-most-used.png b/solutions/images/observability-mobile-most-used.png new file mode 100644 index 0000000000..24b29f95d4 Binary files /dev/null and b/solutions/images/observability-mobile-most-used.png differ diff --git a/solutions/images/observability-mobile-session-error-details.png b/solutions/images/observability-mobile-session-error-details.png new file mode 100644 index 0000000000..41c0bf5095 Binary files /dev/null and b/solutions/images/observability-mobile-session-error-details.png differ diff --git a/solutions/images/observability-mobile-session-explorer-apm.png b/solutions/images/observability-mobile-session-explorer-apm.png new file mode 100644 index 0000000000..55fbc85790 Binary files /dev/null and b/solutions/images/observability-mobile-session-explorer-apm.png differ diff --git a/solutions/images/observability-mobile-session-explorer-nav.png b/solutions/images/observability-mobile-session-explorer-nav.png new file mode 100644 index 0000000000..d208f40912 Binary files /dev/null and b/solutions/images/observability-mobile-session-explorer-nav.png differ diff --git a/solutions/images/observability-mobile-session-filter-discover.png b/solutions/images/observability-mobile-session-filter-discover.png new file mode 100644 index 0000000000..989284ba2a Binary files /dev/null and b/solutions/images/observability-mobile-session-filter-discover.png differ diff --git a/solutions/images/observability-mobile-tp.png b/solutions/images/observability-mobile-tp.png new file mode 100644 index 0000000000..81ce267fb8 Binary files /dev/null and b/solutions/images/observability-mobile-tp.png differ diff --git a/solutions/images/observability-monitor-azure-add-role-assignment.png b/solutions/images/observability-monitor-azure-add-role-assignment.png new file mode 100644 index 0000000000..18832c4fb6 Binary files /dev/null and b/solutions/images/observability-monitor-azure-add-role-assignment.png differ diff --git a/solutions/images/observability-monitor-azure-billing-overview-dashboard.png b/solutions/images/observability-monitor-azure-billing-overview-dashboard.png new file mode 100644 index 0000000000..e23c7a8cd6 Binary files /dev/null and b/solutions/images/observability-monitor-azure-billing-overview-dashboard.png differ diff --git a/solutions/images/observability-monitor-azure-click-app-registration.png b/solutions/images/observability-monitor-azure-click-app-registration.png new file mode 100644 index 0000000000..93bca3b54e Binary files /dev/null and b/solutions/images/observability-monitor-azure-click-app-registration.png differ diff --git a/solutions/images/observability-monitor-azure-click-client-secret.png b/solutions/images/observability-monitor-azure-click-client-secret.png new file mode 100644 index 0000000000..8553ac85ab Binary files /dev/null and b/solutions/images/observability-monitor-azure-click-client-secret.png differ diff --git a/solutions/images/observability-monitor-azure-create-elastic-resource.png b/solutions/images/observability-monitor-azure-create-elastic-resource.png new file mode 100644 index 0000000000..d5bdddbcd8 Binary files /dev/null and b/solutions/images/observability-monitor-azure-create-elastic-resource.png differ diff --git a/solutions/images/observability-monitor-azure-elastic-click-ingest-logs.png b/solutions/images/observability-monitor-azure-elastic-click-ingest-logs.png new file mode 100644 index 0000000000..59f9e1b0cc Binary files /dev/null and b/solutions/images/observability-monitor-azure-elastic-click-ingest-logs.png differ diff --git a/solutions/images/observability-monitor-azure-elastic-config-logs-metrics.png b/solutions/images/observability-monitor-azure-elastic-config-logs-metrics.png new file mode 100644 index 0000000000..91ee90b163 Binary files /dev/null and b/solutions/images/observability-monitor-azure-elastic-config-logs-metrics.png differ diff --git a/solutions/images/observability-monitor-azure-elastic-deployment.png b/solutions/images/observability-monitor-azure-elastic-deployment.png new file mode 100644 index 0000000000..59f9e1b0cc Binary files /dev/null and b/solutions/images/observability-monitor-azure-elastic-deployment.png differ diff --git a/solutions/images/observability-monitor-azure-elastic-vms.png b/solutions/images/observability-monitor-azure-elastic-vms.png new file mode 100644 index 0000000000..35b54500f9 Binary files /dev/null and b/solutions/images/observability-monitor-azure-elastic-vms.png differ diff --git a/solutions/images/observability-monitor-azure-kibana-deployment.png b/solutions/images/observability-monitor-azure-kibana-deployment.png new file mode 100644 index 0000000000..b2740a30bf Binary files /dev/null and b/solutions/images/observability-monitor-azure-kibana-deployment.png differ diff --git a/solutions/images/observability-monitor-azure-kibana-observability-page-empty.png b/solutions/images/observability-monitor-azure-kibana-observability-page-empty.png new file mode 100644 index 0000000000..a495cd5863 Binary files /dev/null and b/solutions/images/observability-monitor-azure-kibana-observability-page-empty.png differ diff --git a/solutions/images/observability-monitor-azure-kibana-security.png b/solutions/images/observability-monitor-azure-kibana-security.png new file mode 100644 index 0000000000..3462c5b145 Binary files /dev/null and b/solutions/images/observability-monitor-azure-kibana-security.png differ diff --git a/solutions/images/observability-monitor-azure-native-create-elastic-resource.png b/solutions/images/observability-monitor-azure-native-create-elastic-resource.png new file mode 100644 index 0000000000..c1e719a82e Binary files /dev/null and b/solutions/images/observability-monitor-azure-native-create-elastic-resource.png differ diff --git a/solutions/images/observability-monitor-azure-native-elastic-config-logs-metrics.png b/solutions/images/observability-monitor-azure-native-elastic-config-logs-metrics.png new file mode 100644 index 0000000000..576a54e14a Binary files /dev/null and b/solutions/images/observability-monitor-azure-native-elastic-config-logs-metrics.png differ diff --git a/solutions/images/observability-monitor-azure-native-elastic-deployment.png b/solutions/images/observability-monitor-azure-native-elastic-deployment.png new file mode 100644 index 0000000000..efefa5635e Binary files /dev/null and b/solutions/images/observability-monitor-azure-native-elastic-deployment.png differ diff --git a/solutions/images/observability-monitor-azure-native-elastic-vms.png b/solutions/images/observability-monitor-azure-native-elastic-vms.png new file mode 100644 index 0000000000..cab36818cf Binary files /dev/null and b/solutions/images/observability-monitor-azure-native-elastic-vms.png differ diff --git a/solutions/images/observability-monitor-azure-register-app.png b/solutions/images/observability-monitor-azure-register-app.png new file mode 100644 index 0000000000..a9cd6b4fb0 Binary files /dev/null and b/solutions/images/observability-monitor-azure-register-app.png differ diff --git a/solutions/images/observability-monitor-azure-search-active-directory.png b/solutions/images/observability-monitor-azure-search-active-directory.png new file mode 100644 index 0000000000..8234bb5e30 Binary files /dev/null and b/solutions/images/observability-monitor-azure-search-active-directory.png differ diff --git a/solutions/images/observability-monitor-azure-search-subscriptions.png b/solutions/images/observability-monitor-azure-search-subscriptions.png new file mode 100644 index 0000000000..f798247c47 Binary files /dev/null and b/solutions/images/observability-monitor-azure-search-subscriptions.png differ diff --git a/solutions/images/observability-monitor-duration-chart.png b/solutions/images/observability-monitor-duration-chart.png new file mode 100644 index 0000000000..bebd162724 Binary files /dev/null and b/solutions/images/observability-monitor-duration-chart.png differ diff --git a/solutions/images/observability-monitor-gcp-audit-overview-dashboard.png b/solutions/images/observability-monitor-gcp-audit-overview-dashboard.png new file mode 100644 index 0000000000..2cf738db04 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-audit-overview-dashboard.png differ diff --git a/solutions/images/observability-monitor-gcp-cloud-id.png b/solutions/images/observability-monitor-gcp-cloud-id.png new file mode 100644 index 0000000000..a44fc2efbf Binary files /dev/null and b/solutions/images/observability-monitor-gcp-cloud-id.png differ diff --git a/solutions/images/observability-monitor-gcp-compute-overview-dashboard.png b/solutions/images/observability-monitor-gcp-compute-overview-dashboard.png new file mode 100644 index 0000000000..9821a33588 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-compute-overview-dashboard.png differ diff --git a/solutions/images/observability-monitor-gcp-create-pubsub-topic.png b/solutions/images/observability-monitor-gcp-create-pubsub-topic.png new file mode 100644 index 0000000000..c261575984 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-create-pubsub-topic.png differ diff --git a/solutions/images/observability-monitor-gcp-create-sink.png b/solutions/images/observability-monitor-gcp-create-sink.png new file mode 100644 index 0000000000..37708defd3 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-create-sink.png differ diff --git a/solutions/images/observability-monitor-gcp-dataflow-audit-dashboard.png b/solutions/images/observability-monitor-gcp-dataflow-audit-dashboard.png new file mode 100644 index 0000000000..d5679f7351 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-dataflow-audit-dashboard.png differ diff --git a/solutions/images/observability-monitor-gcp-dataflow-jobs.png b/solutions/images/observability-monitor-gcp-dataflow-jobs.png new file mode 100644 index 0000000000..073c81f7f5 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-dataflow-jobs.png differ diff --git a/solutions/images/observability-monitor-gcp-dataflow-optional-parameters.png b/solutions/images/observability-monitor-gcp-dataflow-optional-parameters.png new file mode 100644 index 0000000000..3169a318ea Binary files /dev/null and b/solutions/images/observability-monitor-gcp-dataflow-optional-parameters.png differ diff --git a/solutions/images/observability-monitor-gcp-dataflow-pub-sub-elasticsearch.png b/solutions/images/observability-monitor-gcp-dataflow-pub-sub-elasticsearch.png new file mode 100644 index 0000000000..b592c3512f Binary files /dev/null and b/solutions/images/observability-monitor-gcp-dataflow-pub-sub-elasticsearch.png differ diff --git a/solutions/images/observability-monitor-gcp-dataflow-required-parameters.png b/solutions/images/observability-monitor-gcp-dataflow-required-parameters.png new file mode 100644 index 0000000000..c88a0ecf7b Binary files /dev/null and b/solutions/images/observability-monitor-gcp-dataflow-required-parameters.png differ diff --git a/solutions/images/observability-monitor-gcp-integration.png b/solutions/images/observability-monitor-gcp-integration.png new file mode 100644 index 0000000000..dc2dfee248 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-integration.png differ diff --git a/solutions/images/observability-monitor-gcp-kibana-integrations.png b/solutions/images/observability-monitor-gcp-kibana-integrations.png new file mode 100644 index 0000000000..b7953b72fa Binary files /dev/null and b/solutions/images/observability-monitor-gcp-kibana-integrations.png differ diff --git a/solutions/images/observability-monitor-gcp-navigate-logs-router.png b/solutions/images/observability-monitor-gcp-navigate-logs-router.png new file mode 100644 index 0000000000..3799e260e9 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-navigate-logs-router.png differ diff --git a/solutions/images/observability-monitor-gcp-pub-sub-create-subscription.png b/solutions/images/observability-monitor-gcp-pub-sub-create-subscription.png new file mode 100644 index 0000000000..ca8369e75e Binary files /dev/null and b/solutions/images/observability-monitor-gcp-pub-sub-create-subscription.png differ diff --git a/solutions/images/observability-monitor-gcp-pub-sub-subscription-id.png b/solutions/images/observability-monitor-gcp-pub-sub-subscription-id.png new file mode 100644 index 0000000000..3f7bb5f803 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-pub-sub-subscription-id.png differ diff --git a/solutions/images/observability-monitor-gcp-pub-sub.png b/solutions/images/observability-monitor-gcp-pub-sub.png new file mode 100644 index 0000000000..043f8b1afb Binary files /dev/null and b/solutions/images/observability-monitor-gcp-pub-sub.png differ diff --git a/solutions/images/observability-monitor-gcp-service-account-create-key.png b/solutions/images/observability-monitor-gcp-service-account-create-key.png new file mode 100644 index 0000000000..6c8dddd663 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-service-account-create-key.png differ diff --git a/solutions/images/observability-monitor-gcp-service-account-manage-keys.png b/solutions/images/observability-monitor-gcp-service-account-manage-keys.png new file mode 100644 index 0000000000..8f480e4b3b Binary files /dev/null and b/solutions/images/observability-monitor-gcp-service-account-manage-keys.png differ diff --git a/solutions/images/observability-monitor-gcp-service-account-menu.png b/solutions/images/observability-monitor-gcp-service-account-menu.png new file mode 100644 index 0000000000..1795cd0afc Binary files /dev/null and b/solutions/images/observability-monitor-gcp-service-account-menu.png differ diff --git a/solutions/images/observability-monitor-gcp-service-account-name.png b/solutions/images/observability-monitor-gcp-service-account-name.png new file mode 100644 index 0000000000..e12cf51ff1 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-service-account-name.png differ diff --git a/solutions/images/observability-monitor-gcp-service-account-roles-compute-viewer.png b/solutions/images/observability-monitor-gcp-service-account-roles-compute-viewer.png new file mode 100644 index 0000000000..764e7e1561 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-service-account-roles-compute-viewer.png differ diff --git a/solutions/images/observability-monitor-gcp-service-account-roles-final.png b/solutions/images/observability-monitor-gcp-service-account-roles-final.png new file mode 100644 index 0000000000..113a471208 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-service-account-roles-final.png differ diff --git a/solutions/images/observability-monitor-gcp-service-account-roles-monitoring-viewer.png b/solutions/images/observability-monitor-gcp-service-account-roles-monitoring-viewer.png new file mode 100644 index 0000000000..40a7845032 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-service-account-roles-monitoring-viewer.png differ diff --git a/solutions/images/observability-monitor-gcp-service-account-roles-pubsub-subscriber.png b/solutions/images/observability-monitor-gcp-service-account-roles-pubsub-subscriber.png new file mode 100644 index 0000000000..c3a3bd3ca3 Binary files /dev/null and b/solutions/images/observability-monitor-gcp-service-account-roles-pubsub-subscriber.png differ diff --git a/solutions/images/observability-monitor-java-app-apm-transactions.png b/solutions/images/observability-monitor-java-app-apm-transactions.png new file mode 100644 index 0000000000..8c3ecfab10 Binary files /dev/null and b/solutions/images/observability-monitor-java-app-apm-transactions.png differ diff --git a/solutions/images/observability-monitor-java-app-apm-ui-javalin-app.png b/solutions/images/observability-monitor-java-app-apm-ui-javalin-app.png new file mode 100644 index 0000000000..d8b293cafb Binary files /dev/null and b/solutions/images/observability-monitor-java-app-apm-ui-javalin-app.png differ diff --git a/solutions/images/observability-monitor-java-app-apm-ui-javalin-with-transaction-names.png b/solutions/images/observability-monitor-java-app-apm-ui-javalin-with-transaction-names.png new file mode 100644 index 0000000000..8b59680347 Binary files /dev/null and b/solutions/images/observability-monitor-java-app-apm-ui-javalin-with-transaction-names.png differ diff --git a/solutions/images/observability-monitor-java-app-apm-ui-javalin-wttr-1.png b/solutions/images/observability-monitor-java-app-apm-ui-javalin-wttr-1.png new file mode 100644 index 0000000000..8655cbf0e9 Binary files /dev/null and b/solutions/images/observability-monitor-java-app-apm-ui-javalin-wttr-1.png differ diff --git a/solutions/images/observability-monitor-java-app-apm-ui-javalin-wttr-2.png b/solutions/images/observability-monitor-java-app-apm-ui-javalin-wttr-2.png new file mode 100644 index 0000000000..09928e9a39 Binary files /dev/null and b/solutions/images/observability-monitor-java-app-apm-ui-javalin-wttr-2.png differ diff --git a/solutions/images/observability-monitor-java-app-apm-ui-logging-trace.png b/solutions/images/observability-monitor-java-app-apm-ui-logging-trace.png new file mode 100644 index 0000000000..f06aaeec41 Binary files /dev/null and b/solutions/images/observability-monitor-java-app-apm-ui-logging-trace.png differ diff --git a/solutions/images/observability-monitor-java-app-kibana-single-document.png b/solutions/images/observability-monitor-java-app-kibana-single-document.png new file mode 100644 index 0000000000..be8cf767db Binary files /dev/null and b/solutions/images/observability-monitor-java-app-kibana-single-document.png differ diff --git a/solutions/images/observability-monitor-java-app-kibana-streaming.png b/solutions/images/observability-monitor-java-app-kibana-streaming.png new file mode 100644 index 0000000000..3def600d71 Binary files /dev/null and b/solutions/images/observability-monitor-java-app-kibana-streaming.png differ diff --git a/solutions/images/observability-monitor-java-app-metrics-kibana-create-visualization-log-rate.png b/solutions/images/observability-monitor-java-app-metrics-kibana-create-visualization-log-rate.png new file mode 100644 index 0000000000..5363fb9590 Binary files /dev/null and b/solutions/images/observability-monitor-java-app-metrics-kibana-create-visualization-log-rate.png differ diff --git a/solutions/images/observability-monitor-java-app-metrics-kibana-create-visualization-open-files.png b/solutions/images/observability-monitor-java-app-metrics-kibana-create-visualization-open-files.png new file mode 100644 index 0000000000..32038da0b4 Binary files /dev/null and b/solutions/images/observability-monitor-java-app-metrics-kibana-create-visualization-open-files.png differ diff --git a/solutions/images/observability-monitor-java-app-metrics-ui-prometheus-event-counter.png b/solutions/images/observability-monitor-java-app-metrics-ui-prometheus-event-counter.png new file mode 100644 index 0000000000..d3e5121098 Binary files /dev/null and b/solutions/images/observability-monitor-java-app-metrics-ui-prometheus-event-counter.png differ diff --git a/solutions/images/observability-monitor-java-app-uptime-overview.png b/solutions/images/observability-monitor-java-app-uptime-overview.png new file mode 100644 index 0000000000..a4aa7568e5 Binary files /dev/null and b/solutions/images/observability-monitor-java-app-uptime-overview.png differ diff --git a/solutions/images/observability-monitor-k8s-metrics-explorer.png b/solutions/images/observability-monitor-k8s-metrics-explorer.png new file mode 100644 index 0000000000..494a8802a5 Binary files /dev/null and b/solutions/images/observability-monitor-k8s-metrics-explorer.png differ diff --git a/solutions/images/observability-monitor-status-alert-default-message.png b/solutions/images/observability-monitor-status-alert-default-message.png new file mode 100644 index 0000000000..f3e304009a Binary files /dev/null and b/solutions/images/observability-monitor-status-alert-default-message.png differ diff --git a/solutions/images/observability-monitor-status-alert-recovery.png b/solutions/images/observability-monitor-status-alert-recovery.png new file mode 100644 index 0000000000..613ba2ee5b Binary files /dev/null and b/solutions/images/observability-monitor-status-alert-recovery.png differ diff --git a/solutions/images/observability-monitor-status-alert.png b/solutions/images/observability-monitor-status-alert.png new file mode 100644 index 0000000000..24bd328b3b Binary files /dev/null and b/solutions/images/observability-monitor-status-alert.png differ diff --git a/solutions/images/observability-monitors-chart.png b/solutions/images/observability-monitors-chart.png new file mode 100644 index 0000000000..97e57ffe48 Binary files /dev/null and b/solutions/images/observability-monitors-chart.png differ diff --git a/solutions/images/observability-monitors-list.png b/solutions/images/observability-monitors-list.png new file mode 100644 index 0000000000..e4a1b62a67 Binary files /dev/null and b/solutions/images/observability-monitors-list.png differ diff --git a/solutions/images/observability-nginx-data-selector.png b/solutions/images/observability-nginx-data-selector.png new file mode 100644 index 0000000000..055d90697e Binary files /dev/null and b/solutions/images/observability-nginx-data-selector.png differ diff --git a/solutions/images/observability-nginx-logs-access-error-dashboard.png b/solutions/images/observability-nginx-logs-access-error-dashboard.png new file mode 100644 index 0000000000..f7964bdced Binary files /dev/null and b/solutions/images/observability-nginx-logs-access-error-dashboard.png differ diff --git a/solutions/images/observability-nginx-logs-explorer.png b/solutions/images/observability-nginx-logs-explorer.png new file mode 100644 index 0000000000..701eee80fe Binary files /dev/null and b/solutions/images/observability-nginx-logs-explorer.png differ diff --git a/solutions/images/observability-nginx-logs-overview-dashboard.png b/solutions/images/observability-nginx-logs-overview-dashboard.png new file mode 100644 index 0000000000..d87ef65f2f Binary files /dev/null and b/solutions/images/observability-nginx-logs-overview-dashboard.png differ diff --git a/solutions/images/observability-nginx-metrics-dashboard.png b/solutions/images/observability-nginx-metrics-dashboard.png new file mode 100644 index 0000000000..3f73a3c892 Binary files /dev/null and b/solutions/images/observability-nginx-metrics-dashboard.png differ diff --git a/solutions/images/observability-obs-ai-assistant-action-high-cpu.png b/solutions/images/observability-obs-ai-assistant-action-high-cpu.png new file mode 100644 index 0000000000..d8d2c686b9 Binary files /dev/null and b/solutions/images/observability-obs-ai-assistant-action-high-cpu.png differ diff --git a/solutions/images/observability-obs-ai-assistant-output.png b/solutions/images/observability-obs-ai-assistant-output.png new file mode 100644 index 0000000000..5f371f9bce Binary files /dev/null and b/solutions/images/observability-obs-ai-assistant-output.png differ diff --git a/solutions/images/observability-obs-ai-assistant-slack-message.png b/solutions/images/observability-obs-ai-assistant-slack-message.png new file mode 100644 index 0000000000..c2cd871fa6 Binary files /dev/null and b/solutions/images/observability-obs-ai-assistant-slack-message.png differ diff --git a/solutions/images/observability-obs-ai-chat.png b/solutions/images/observability-obs-ai-chat.png new file mode 100644 index 0000000000..2a5f2b3538 Binary files /dev/null and b/solutions/images/observability-obs-ai-chat.png differ diff --git a/solutions/images/observability-obs-ai-logs-prompts.png b/solutions/images/observability-obs-ai-logs-prompts.png new file mode 100644 index 0000000000..a7b262fcdd Binary files /dev/null and b/solutions/images/observability-obs-ai-logs-prompts.png differ diff --git a/solutions/images/observability-obs-ai-logs.gif b/solutions/images/observability-obs-ai-logs.gif new file mode 100644 index 0000000000..bdcfd0af1d Binary files /dev/null and b/solutions/images/observability-obs-ai-logs.gif differ diff --git a/solutions/images/observability-obs-assistant2.gif b/solutions/images/observability-obs-assistant2.gif new file mode 100644 index 0000000000..3b302141de Binary files /dev/null and b/solutions/images/observability-obs-assistant2.gif differ diff --git a/solutions/images/observability-obs-overview-ue.png b/solutions/images/observability-obs-overview-ue.png new file mode 100644 index 0000000000..5cf18ae63e Binary files /dev/null and b/solutions/images/observability-obs-overview-ue.png differ diff --git a/solutions/images/observability-one-bucket-archi.png b/solutions/images/observability-one-bucket-archi.png new file mode 100644 index 0000000000..57e8945b8a Binary files /dev/null and b/solutions/images/observability-one-bucket-archi.png differ diff --git a/solutions/images/observability-operations-detail.png b/solutions/images/observability-operations-detail.png new file mode 100644 index 0000000000..64a1c65508 Binary files /dev/null and b/solutions/images/observability-operations-detail.png differ diff --git a/solutions/images/observability-operations.png b/solutions/images/observability-operations.png new file mode 100644 index 0000000000..119f8bdf99 Binary files /dev/null and b/solutions/images/observability-operations.png differ diff --git a/solutions/images/observability-osquery-overlay.png b/solutions/images/observability-osquery-overlay.png new file mode 100644 index 0000000000..98f7fa6077 Binary files /dev/null and b/solutions/images/observability-osquery-overlay.png differ diff --git a/solutions/images/observability-overview-overlay-containers.png b/solutions/images/observability-overview-overlay-containers.png new file mode 100644 index 0000000000..63dded9a72 Binary files /dev/null and b/solutions/images/observability-overview-overlay-containers.png differ diff --git a/solutions/images/observability-overview-overlay.png b/solutions/images/observability-overview-overlay.png new file mode 100644 index 0000000000..ae501da1e6 Binary files /dev/null and b/solutions/images/observability-overview-overlay.png differ diff --git a/solutions/images/observability-page-load-duration.png b/solutions/images/observability-page-load-duration.png new file mode 100644 index 0000000000..e0595189bb Binary files /dev/null and b/solutions/images/observability-page-load-duration.png differ diff --git a/solutions/images/observability-pagesSelect-icon.png b/solutions/images/observability-pagesSelect-icon.png new file mode 100644 index 0000000000..4f624abf25 Binary files /dev/null and b/solutions/images/observability-pagesSelect-icon.png differ diff --git a/solutions/images/observability-pencil.svg b/solutions/images/observability-pencil.svg new file mode 100644 index 0000000000..cb16b5d2f0 --- /dev/null +++ b/solutions/images/observability-pencil.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-pings-over-time.png b/solutions/images/observability-pings-over-time.png new file mode 100644 index 0000000000..5efaad6394 Binary files /dev/null and b/solutions/images/observability-pings-over-time.png differ diff --git a/solutions/images/observability-plusInCircle.png b/solutions/images/observability-plusInCircle.png new file mode 100644 index 0000000000..45e19e79e4 Binary files /dev/null and b/solutions/images/observability-plusInCircle.png differ diff --git a/solutions/images/observability-pod-metrics.png b/solutions/images/observability-pod-metrics.png new file mode 100644 index 0000000000..3dc367a5a6 Binary files /dev/null and b/solutions/images/observability-pod-metrics.png differ diff --git a/solutions/images/observability-popout.svg b/solutions/images/observability-popout.svg new file mode 100644 index 0000000000..875bf6662d --- /dev/null +++ b/solutions/images/observability-popout.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-profililing-elastic-agent-creds.png b/solutions/images/observability-profililing-elastic-agent-creds.png new file mode 100644 index 0000000000..c0074b5b66 Binary files /dev/null and b/solutions/images/observability-profililing-elastic-agent-creds.png differ diff --git a/solutions/images/observability-profiling-create-component-template.png b/solutions/images/observability-profiling-create-component-template.png new file mode 100644 index 0000000000..9f4bd9709c Binary files /dev/null and b/solutions/images/observability-profiling-create-component-template.png differ diff --git a/solutions/images/observability-profiling-elastic-agent.png b/solutions/images/observability-profiling-elastic-agent.png new file mode 100644 index 0000000000..2134e1b35c Binary files /dev/null and b/solutions/images/observability-profiling-elastic-agent.png differ diff --git a/solutions/images/observability-profiling-flamegraph-detailed-view.png b/solutions/images/observability-profiling-flamegraph-detailed-view.png new file mode 100644 index 0000000000..3a6dac74b1 Binary files /dev/null and b/solutions/images/observability-profiling-flamegraph-detailed-view.png differ diff --git a/solutions/images/observability-profiling-flamegraph-differential-view.png b/solutions/images/observability-profiling-flamegraph-differential-view.png new file mode 100644 index 0000000000..77b614e931 Binary files /dev/null and b/solutions/images/observability-profiling-flamegraph-differential-view.png differ diff --git a/solutions/images/observability-profiling-flamegraph-view.png b/solutions/images/observability-profiling-flamegraph-view.png new file mode 100644 index 0000000000..474d8133ca Binary files /dev/null and b/solutions/images/observability-profiling-flamegraph-view.png differ diff --git a/solutions/images/observability-profiling-functions-default-view.png b/solutions/images/observability-profiling-functions-default-view.png new file mode 100644 index 0000000000..7c8ae01f34 Binary files /dev/null and b/solutions/images/observability-profiling-functions-default-view.png differ diff --git a/solutions/images/observability-profiling-functions-differential-view.png b/solutions/images/observability-profiling-functions-differential-view.png new file mode 100644 index 0000000000..344b465618 Binary files /dev/null and b/solutions/images/observability-profiling-functions-differential-view.png differ diff --git a/solutions/images/observability-profiling-k8s-hostagent.png b/solutions/images/observability-profiling-k8s-hostagent.png new file mode 100644 index 0000000000..2c51e3a615 Binary files /dev/null and b/solutions/images/observability-profiling-k8s-hostagent.png differ diff --git a/solutions/images/observability-profiling-self-managed-ingestion-architecture.png b/solutions/images/observability-profiling-self-managed-ingestion-architecture.png new file mode 100644 index 0000000000..573d105ac1 Binary files /dev/null and b/solutions/images/observability-profiling-self-managed-ingestion-architecture.png differ diff --git a/solutions/images/observability-profiling-setup-popup.png b/solutions/images/observability-profiling-setup-popup.png new file mode 100644 index 0000000000..55e95d467e Binary files /dev/null and b/solutions/images/observability-profiling-setup-popup.png differ diff --git a/solutions/images/observability-profiling-stacktraces-default-view.png b/solutions/images/observability-profiling-stacktraces-default-view.png new file mode 100644 index 0000000000..e5fb82b535 Binary files /dev/null and b/solutions/images/observability-profiling-stacktraces-default-view.png differ diff --git a/solutions/images/observability-profiling-stacktraces-show-more.png b/solutions/images/observability-profiling-stacktraces-show-more.png new file mode 100644 index 0000000000..2dc82bd7d9 Binary files /dev/null and b/solutions/images/observability-profiling-stacktraces-show-more.png differ diff --git a/solutions/images/observability-profiling-stacktraces-smaller-graphs.png b/solutions/images/observability-profiling-stacktraces-smaller-graphs.png new file mode 100644 index 0000000000..29941942b1 Binary files /dev/null and b/solutions/images/observability-profiling-stacktraces-smaller-graphs.png differ diff --git a/solutions/images/observability-profiling-stacktraces-unsymbolized.png b/solutions/images/observability-profiling-stacktraces-unsymbolized.png new file mode 100644 index 0000000000..f5a2058a5d Binary files /dev/null and b/solutions/images/observability-profiling-stacktraces-unsymbolized.png differ diff --git a/solutions/images/observability-profiling-symbolizer-url.png b/solutions/images/observability-profiling-symbolizer-url.png new file mode 100644 index 0000000000..1f3d7b366e Binary files /dev/null and b/solutions/images/observability-profiling-symbolizer-url.png differ diff --git a/solutions/images/observability-pytest-otel-pipeline.png b/solutions/images/observability-pytest-otel-pipeline.png new file mode 100644 index 0000000000..d0dc2e85df Binary files /dev/null and b/solutions/images/observability-pytest-otel-pipeline.png differ diff --git a/solutions/images/observability-quickstart-aws-firehose-dashboards.png b/solutions/images/observability-quickstart-aws-firehose-dashboards.png new file mode 100644 index 0000000000..cd7b9132d4 Binary files /dev/null and b/solutions/images/observability-quickstart-aws-firehose-dashboards.png differ diff --git a/solutions/images/observability-quickstart-aws-firehose-entry-point.png b/solutions/images/observability-quickstart-aws-firehose-entry-point.png new file mode 100644 index 0000000000..6a0bbe3399 Binary files /dev/null and b/solutions/images/observability-quickstart-aws-firehose-entry-point.png differ diff --git a/solutions/images/observability-quickstart-aws-firehose-vpc-flow.png b/solutions/images/observability-quickstart-aws-firehose-vpc-flow.png new file mode 100644 index 0000000000..7bf577aa99 Binary files /dev/null and b/solutions/images/observability-quickstart-aws-firehose-vpc-flow.png differ diff --git a/solutions/images/observability-quickstart-host-overview.png b/solutions/images/observability-quickstart-host-overview.png new file mode 100644 index 0000000000..bf94de5fe6 Binary files /dev/null and b/solutions/images/observability-quickstart-host-overview.png differ diff --git a/solutions/images/observability-quickstart-k8s-entry-point.png b/solutions/images/observability-quickstart-k8s-entry-point.png new file mode 100644 index 0000000000..e558f81054 Binary files /dev/null and b/solutions/images/observability-quickstart-k8s-entry-point.png differ diff --git a/solutions/images/observability-quickstart-k8s-otel-dashboard.png b/solutions/images/observability-quickstart-k8s-otel-dashboard.png new file mode 100644 index 0000000000..0e6013f99d Binary files /dev/null and b/solutions/images/observability-quickstart-k8s-otel-dashboard.png differ diff --git a/solutions/images/observability-quickstart-k8s-otel-entry-point.png b/solutions/images/observability-quickstart-k8s-otel-entry-point.png new file mode 100644 index 0000000000..739832bac2 Binary files /dev/null and b/solutions/images/observability-quickstart-k8s-otel-entry-point.png differ diff --git a/solutions/images/observability-quickstart-k8s-overview.png b/solutions/images/observability-quickstart-k8s-overview.png new file mode 100644 index 0000000000..a9df91c81d Binary files /dev/null and b/solutions/images/observability-quickstart-k8s-overview.png differ diff --git a/solutions/images/observability-quickstart-monitor-hosts-entry-point.png b/solutions/images/observability-quickstart-monitor-hosts-entry-point.png new file mode 100644 index 0000000000..d59756fa2d Binary files /dev/null and b/solutions/images/observability-quickstart-monitor-hosts-entry-point.png differ diff --git a/solutions/images/observability-quickstart-monitor-hosts-otel-entry-point.png b/solutions/images/observability-quickstart-monitor-hosts-otel-entry-point.png new file mode 100644 index 0000000000..fc5a000c9e Binary files /dev/null and b/solutions/images/observability-quickstart-monitor-hosts-otel-entry-point.png differ diff --git a/solutions/images/observability-red-service.png b/solutions/images/observability-red-service.png new file mode 100644 index 0000000000..be7a62b177 Binary files /dev/null and b/solutions/images/observability-red-service.png differ diff --git a/solutions/images/observability-refresh.svg b/solutions/images/observability-refresh.svg new file mode 100644 index 0000000000..58662be4af --- /dev/null +++ b/solutions/images/observability-refresh.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-response-durations-alert.png b/solutions/images/observability-response-durations-alert.png new file mode 100644 index 0000000000..4926699b59 Binary files /dev/null and b/solutions/images/observability-response-durations-alert.png differ diff --git a/solutions/images/observability-run-standalone-option.png b/solutions/images/observability-run-standalone-option.png new file mode 100644 index 0000000000..0b63f0676a Binary files /dev/null and b/solutions/images/observability-run-standalone-option.png differ diff --git a/solutions/images/observability-s3-dashboard.png b/solutions/images/observability-s3-dashboard.png new file mode 100644 index 0000000000..0a37d71a2b Binary files /dev/null and b/solutions/images/observability-s3-dashboard.png differ diff --git a/solutions/images/observability-scale-apm.png b/solutions/images/observability-scale-apm.png new file mode 100644 index 0000000000..5792ba4680 Binary files /dev/null and b/solutions/images/observability-scale-apm.png differ diff --git a/solutions/images/observability-schema-agent.png b/solutions/images/observability-schema-agent.png new file mode 100644 index 0000000000..8e65de97cf Binary files /dev/null and b/solutions/images/observability-schema-agent.png differ diff --git a/solutions/images/observability-server-api-key-create.png b/solutions/images/observability-server-api-key-create.png new file mode 100644 index 0000000000..d21c440b19 Binary files /dev/null and b/solutions/images/observability-server-api-key-create.png differ diff --git a/solutions/images/observability-service-maps-java.png b/solutions/images/observability-service-maps-java.png new file mode 100644 index 0000000000..aa8e5dc505 Binary files /dev/null and b/solutions/images/observability-service-maps-java.png differ diff --git a/solutions/images/observability-simple-arch-observability.png b/solutions/images/observability-simple-arch-observability.png new file mode 100644 index 0000000000..91f61c653c Binary files /dev/null and b/solutions/images/observability-simple-arch-observability.png differ diff --git a/solutions/images/observability-slo-burn-rate-breach.png b/solutions/images/observability-slo-burn-rate-breach.png new file mode 100644 index 0000000000..e8332751aa Binary files /dev/null and b/solutions/images/observability-slo-burn-rate-breach.png differ diff --git a/solutions/images/observability-slo-dashboard.png b/solutions/images/observability-slo-dashboard.png new file mode 100644 index 0000000000..6c08697da5 Binary files /dev/null and b/solutions/images/observability-slo-dashboard.png differ diff --git a/solutions/images/observability-slo-es-priv-editor.png b/solutions/images/observability-slo-es-priv-editor.png new file mode 100644 index 0000000000..1304c99ccc Binary files /dev/null and b/solutions/images/observability-slo-es-priv-editor.png differ diff --git a/solutions/images/observability-slo-es-priv-viewer.png b/solutions/images/observability-slo-es-priv-viewer.png new file mode 100644 index 0000000000..23508ef8b7 Binary files /dev/null and b/solutions/images/observability-slo-es-priv-viewer.png differ diff --git a/solutions/images/observability-slo-kibana-priv-all.png b/solutions/images/observability-slo-kibana-priv-all.png new file mode 100644 index 0000000000..860b0afb3c Binary files /dev/null and b/solutions/images/observability-slo-kibana-priv-all.png differ diff --git a/solutions/images/observability-slo-kibana-priv-read.png b/solutions/images/observability-slo-kibana-priv-read.png new file mode 100644 index 0000000000..a35a888f68 Binary files /dev/null and b/solutions/images/observability-slo-kibana-priv-read.png differ diff --git a/solutions/images/observability-slo-overview-embeddable-widget.png b/solutions/images/observability-slo-overview-embeddable-widget.png new file mode 100644 index 0000000000..79c4d46b68 Binary files /dev/null and b/solutions/images/observability-slo-overview-embeddable-widget.png differ diff --git a/solutions/images/observability-sortDown.svg b/solutions/images/observability-sortDown.svg new file mode 100644 index 0000000000..7efa30e917 --- /dev/null +++ b/solutions/images/observability-sortDown.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-sortUp.svg b/solutions/images/observability-sortUp.svg new file mode 100644 index 0000000000..c5d0f004ad --- /dev/null +++ b/solutions/images/observability-sortUp.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/observability-source-map-after.png b/solutions/images/observability-source-map-after.png new file mode 100644 index 0000000000..feec9e7c23 Binary files /dev/null and b/solutions/images/observability-source-map-after.png differ diff --git a/solutions/images/observability-source-map-before.png b/solutions/images/observability-source-map-before.png new file mode 100644 index 0000000000..a92baef141 Binary files /dev/null and b/solutions/images/observability-source-map-before.png differ diff --git a/solutions/images/observability-spans-dependencies.png b/solutions/images/observability-spans-dependencies.png new file mode 100644 index 0000000000..558099dd45 Binary files /dev/null and b/solutions/images/observability-spans-dependencies.png differ diff --git a/solutions/images/observability-spans-transactions-and-traces.png b/solutions/images/observability-spans-transactions-and-traces.png new file mode 100644 index 0000000000..06badc4454 Binary files /dev/null and b/solutions/images/observability-spans-transactions-and-traces.png differ diff --git a/solutions/images/observability-specific-transaction-search.png b/solutions/images/observability-specific-transaction-search.png new file mode 100644 index 0000000000..4ed548f015 Binary files /dev/null and b/solutions/images/observability-specific-transaction-search.png differ diff --git a/solutions/images/observability-specific-transaction.png b/solutions/images/observability-specific-transaction.png new file mode 100644 index 0000000000..52073bf765 Binary files /dev/null and b/solutions/images/observability-specific-transaction.png differ diff --git a/solutions/images/observability-sqs-dashboard.png b/solutions/images/observability-sqs-dashboard.png new file mode 100644 index 0000000000..ddfe150d9d Binary files /dev/null and b/solutions/images/observability-sqs-dashboard.png differ diff --git a/solutions/images/observability-storage-explorer-expanded.png b/solutions/images/observability-storage-explorer-expanded.png new file mode 100644 index 0000000000..844f07b6f8 Binary files /dev/null and b/solutions/images/observability-storage-explorer-expanded.png differ diff --git a/solutions/images/observability-storage-explorer-overview.png b/solutions/images/observability-storage-explorer-overview.png new file mode 100644 index 0000000000..d3fcccca5f Binary files /dev/null and b/solutions/images/observability-storage-explorer-overview.png differ diff --git a/solutions/images/observability-synthetic-monitor-lifecycle.png b/solutions/images/observability-synthetic-monitor-lifecycle.png new file mode 100644 index 0000000000..711fb1a6f0 Binary files /dev/null and b/solutions/images/observability-synthetic-monitor-lifecycle.png differ diff --git a/solutions/images/observability-synthetics-analyze-individual-monitor-details.png b/solutions/images/observability-synthetics-analyze-individual-monitor-details.png new file mode 100644 index 0000000000..1e7c380132 Binary files /dev/null and b/solutions/images/observability-synthetics-analyze-individual-monitor-details.png differ diff --git a/solutions/images/observability-synthetics-analyze-individual-monitor-errors.png b/solutions/images/observability-synthetics-analyze-individual-monitor-errors.png new file mode 100644 index 0000000000..a478f3408b Binary files /dev/null and b/solutions/images/observability-synthetics-analyze-individual-monitor-errors.png differ diff --git a/solutions/images/observability-synthetics-analyze-individual-monitor-header.png b/solutions/images/observability-synthetics-analyze-individual-monitor-header.png new file mode 100644 index 0000000000..0e8d3a6d8c Binary files /dev/null and b/solutions/images/observability-synthetics-analyze-individual-monitor-header.png differ diff --git a/solutions/images/observability-synthetics-analyze-individual-monitor-history.png b/solutions/images/observability-synthetics-analyze-individual-monitor-history.png new file mode 100644 index 0000000000..bf3d325b3c Binary files /dev/null and b/solutions/images/observability-synthetics-analyze-individual-monitor-history.png differ diff --git a/solutions/images/observability-synthetics-analyze-journeys-over-time.png b/solutions/images/observability-synthetics-analyze-journeys-over-time.png new file mode 100644 index 0000000000..b9acdffd23 Binary files /dev/null and b/solutions/images/observability-synthetics-analyze-journeys-over-time.png differ diff --git a/solutions/images/observability-synthetics-analyze-one-run-code-executed.png b/solutions/images/observability-synthetics-analyze-one-run-code-executed.png new file mode 100644 index 0000000000..f65f26934d Binary files /dev/null and b/solutions/images/observability-synthetics-analyze-one-run-code-executed.png differ diff --git a/solutions/images/observability-synthetics-analyze-one-run-compare-steps.png b/solutions/images/observability-synthetics-analyze-one-run-compare-steps.png new file mode 100644 index 0000000000..28a663c74b Binary files /dev/null and b/solutions/images/observability-synthetics-analyze-one-run-compare-steps.png differ diff --git a/solutions/images/observability-synthetics-analyze-one-step-metrics.png b/solutions/images/observability-synthetics-analyze-one-step-metrics.png new file mode 100644 index 0000000000..d9d0d1bc83 Binary files /dev/null and b/solutions/images/observability-synthetics-analyze-one-step-metrics.png differ diff --git a/solutions/images/observability-synthetics-analyze-one-step-network.png b/solutions/images/observability-synthetics-analyze-one-step-network.png new file mode 100644 index 0000000000..b448e474b1 Binary files /dev/null and b/solutions/images/observability-synthetics-analyze-one-step-network.png differ diff --git a/solutions/images/observability-synthetics-analyze-one-step-object.png b/solutions/images/observability-synthetics-analyze-one-step-object.png new file mode 100644 index 0000000000..4846992088 Binary files /dev/null and b/solutions/images/observability-synthetics-analyze-one-step-object.png differ diff --git a/solutions/images/observability-synthetics-analyze-one-step-screenshot.png b/solutions/images/observability-synthetics-analyze-one-step-screenshot.png new file mode 100644 index 0000000000..97a687d6f7 Binary files /dev/null and b/solutions/images/observability-synthetics-analyze-one-step-screenshot.png differ diff --git a/solutions/images/observability-synthetics-analyze-one-step-timing.png b/solutions/images/observability-synthetics-analyze-one-step-timing.png new file mode 100644 index 0000000000..0bd844384f Binary files /dev/null and b/solutions/images/observability-synthetics-analyze-one-step-timing.png differ diff --git a/solutions/images/observability-synthetics-create-test-script-recorder.png b/solutions/images/observability-synthetics-create-test-script-recorder.png new file mode 100644 index 0000000000..6d488b8276 Binary files /dev/null and b/solutions/images/observability-synthetics-create-test-script-recorder.png differ diff --git a/solutions/images/observability-synthetics-get-started-heartbeat.png b/solutions/images/observability-synthetics-get-started-heartbeat.png new file mode 100644 index 0000000000..7049966ff8 Binary files /dev/null and b/solutions/images/observability-synthetics-get-started-heartbeat.png differ diff --git a/solutions/images/observability-synthetics-get-started-projects.png b/solutions/images/observability-synthetics-get-started-projects.png new file mode 100644 index 0000000000..fff6175555 Binary files /dev/null and b/solutions/images/observability-synthetics-get-started-projects.png differ diff --git a/solutions/images/observability-synthetics-get-started-ui-lightweight.png b/solutions/images/observability-synthetics-get-started-ui-lightweight.png new file mode 100644 index 0000000000..9e68d3343a Binary files /dev/null and b/solutions/images/observability-synthetics-get-started-ui-lightweight.png differ diff --git a/solutions/images/observability-synthetics-get-started-ui.png b/solutions/images/observability-synthetics-get-started-ui.png new file mode 100644 index 0000000000..3be1e0278c Binary files /dev/null and b/solutions/images/observability-synthetics-get-started-ui.png differ diff --git a/solutions/images/observability-synthetics-monitor-page.png b/solutions/images/observability-synthetics-monitor-page.png new file mode 100644 index 0000000000..e5a79c1d6a Binary files /dev/null and b/solutions/images/observability-synthetics-monitor-page.png differ diff --git a/solutions/images/observability-synthetics-params-secrets-kibana-define.png b/solutions/images/observability-synthetics-params-secrets-kibana-define.png new file mode 100644 index 0000000000..e07aa48064 Binary files /dev/null and b/solutions/images/observability-synthetics-params-secrets-kibana-define.png differ diff --git a/solutions/images/observability-synthetics-params-secrets-kibana-use-lightweight.png b/solutions/images/observability-synthetics-params-secrets-kibana-use-lightweight.png new file mode 100644 index 0000000000..52fb703128 Binary files /dev/null and b/solutions/images/observability-synthetics-params-secrets-kibana-use-lightweight.png differ diff --git a/solutions/images/observability-synthetics-retest.png b/solutions/images/observability-synthetics-retest.png new file mode 100644 index 0000000000..b55b96615d Binary files /dev/null and b/solutions/images/observability-synthetics-retest.png differ diff --git a/solutions/images/observability-synthetics-settings-alerting.png b/solutions/images/observability-synthetics-settings-alerting.png new file mode 100644 index 0000000000..ed22aaa52b Binary files /dev/null and b/solutions/images/observability-synthetics-settings-alerting.png differ diff --git a/solutions/images/observability-synthetics-settings-api-keys.png b/solutions/images/observability-synthetics-settings-api-keys.png new file mode 100644 index 0000000000..8b102a7d04 Binary files /dev/null and b/solutions/images/observability-synthetics-settings-api-keys.png differ diff --git a/solutions/images/observability-synthetics-settings-data-retention.png b/solutions/images/observability-synthetics-settings-data-retention.png new file mode 100644 index 0000000000..74ac7d7276 Binary files /dev/null and b/solutions/images/observability-synthetics-settings-data-retention.png differ diff --git a/solutions/images/observability-synthetics-settings-disable-default-rules.png b/solutions/images/observability-synthetics-settings-disable-default-rules.png new file mode 100644 index 0000000000..68feec575b Binary files /dev/null and b/solutions/images/observability-synthetics-settings-disable-default-rules.png differ diff --git a/solutions/images/observability-synthetics-settings-global-parameters.png b/solutions/images/observability-synthetics-settings-global-parameters.png new file mode 100644 index 0000000000..ce0ef86ebf Binary files /dev/null and b/solutions/images/observability-synthetics-settings-global-parameters.png differ diff --git a/solutions/images/observability-synthetics-settings-private-locations.png b/solutions/images/observability-synthetics-settings-private-locations.png new file mode 100644 index 0000000000..17571d3a90 Binary files /dev/null and b/solutions/images/observability-synthetics-settings-private-locations.png differ diff --git a/solutions/images/observability-synthetics-traffic-filters-create-filter.png b/solutions/images/observability-synthetics-traffic-filters-create-filter.png new file mode 100644 index 0000000000..d5380e4144 Binary files /dev/null and b/solutions/images/observability-synthetics-traffic-filters-create-filter.png differ diff --git a/solutions/images/observability-synthetics-ui-inline-script.png b/solutions/images/observability-synthetics-ui-inline-script.png new file mode 100644 index 0000000000..fcfccc9309 Binary files /dev/null and b/solutions/images/observability-synthetics-ui-inline-script.png differ diff --git a/solutions/images/observability-table-view-icon.png b/solutions/images/observability-table-view-icon.png new file mode 100644 index 0000000000..c761abfb38 Binary files /dev/null and b/solutions/images/observability-table-view-icon.png differ diff --git a/solutions/images/observability-time-series-expected-bounds-comparison.png b/solutions/images/observability-time-series-expected-bounds-comparison.png new file mode 100644 index 0000000000..6e705064e6 Binary files /dev/null and b/solutions/images/observability-time-series-expected-bounds-comparison.png differ diff --git a/solutions/images/observability-tls-certificates.png b/solutions/images/observability-tls-certificates.png new file mode 100644 index 0000000000..1fe565d5d4 Binary files /dev/null and b/solutions/images/observability-tls-certificates.png differ diff --git a/solutions/images/observability-tls-rule-synthetics-action-types-each-alert.png b/solutions/images/observability-tls-rule-synthetics-action-types-each-alert.png new file mode 100644 index 0000000000..681755ac0e Binary files /dev/null and b/solutions/images/observability-tls-rule-synthetics-action-types-each-alert.png differ diff --git a/solutions/images/observability-tls-rule-synthetics-action-types-more-options.png b/solutions/images/observability-tls-rule-synthetics-action-types-more-options.png new file mode 100644 index 0000000000..0bc12004e7 Binary files /dev/null and b/solutions/images/observability-tls-rule-synthetics-action-types-more-options.png differ diff --git a/solutions/images/observability-tls-rule-synthetics-action-types-summary.png b/solutions/images/observability-tls-rule-synthetics-action-types-summary.png new file mode 100644 index 0000000000..c448efbdad Binary files /dev/null and b/solutions/images/observability-tls-rule-synthetics-action-types-summary.png differ diff --git a/solutions/images/observability-tls-rule-synthetics-action-variables.png b/solutions/images/observability-tls-rule-synthetics-action-variables.png new file mode 100644 index 0000000000..04fbbc3239 Binary files /dev/null and b/solutions/images/observability-tls-rule-synthetics-action-variables.png differ diff --git a/solutions/images/observability-tls-rule-synthetics-conditions.png b/solutions/images/observability-tls-rule-synthetics-conditions.png new file mode 100644 index 0000000000..d83c5385b6 Binary files /dev/null and b/solutions/images/observability-tls-rule-synthetics-conditions.png differ diff --git a/solutions/images/observability-tls-rule-uptime-action-types-each-alert.png b/solutions/images/observability-tls-rule-uptime-action-types-each-alert.png new file mode 100644 index 0000000000..ceff2e718e Binary files /dev/null and b/solutions/images/observability-tls-rule-uptime-action-types-each-alert.png differ diff --git a/solutions/images/observability-tls-rule-uptime-action-types-more-options.png b/solutions/images/observability-tls-rule-uptime-action-types-more-options.png new file mode 100644 index 0000000000..b82f0b185a Binary files /dev/null and b/solutions/images/observability-tls-rule-uptime-action-types-more-options.png differ diff --git a/solutions/images/observability-tls-rule-uptime-action-types-summary.png b/solutions/images/observability-tls-rule-uptime-action-types-summary.png new file mode 100644 index 0000000000..2552f0d54e Binary files /dev/null and b/solutions/images/observability-tls-rule-uptime-action-types-summary.png differ diff --git a/solutions/images/observability-tls-rule-uptime-conditions.png b/solutions/images/observability-tls-rule-uptime-conditions.png new file mode 100644 index 0000000000..f4fba73b40 Binary files /dev/null and b/solutions/images/observability-tls-rule-uptime-conditions.png differ diff --git a/solutions/images/observability-tls-rule-uptime-default-message.png b/solutions/images/observability-tls-rule-uptime-default-message.png new file mode 100644 index 0000000000..4112e68b21 Binary files /dev/null and b/solutions/images/observability-tls-rule-uptime-default-message.png differ diff --git a/solutions/images/observability-trace-explorer.png b/solutions/images/observability-trace-explorer.png new file mode 100644 index 0000000000..70c13f650e Binary files /dev/null and b/solutions/images/observability-trace-explorer.png differ diff --git a/solutions/images/observability-traffic-transactions.png b/solutions/images/observability-traffic-transactions.png new file mode 100644 index 0000000000..05e66dfaa4 Binary files /dev/null and b/solutions/images/observability-traffic-transactions.png differ diff --git a/solutions/images/observability-transaction-icon.png b/solutions/images/observability-transaction-icon.png new file mode 100644 index 0000000000..3534e6915d Binary files /dev/null and b/solutions/images/observability-transaction-icon.png differ diff --git a/solutions/images/observability-two-buckets-archi.png b/solutions/images/observability-two-buckets-archi.png new file mode 100644 index 0000000000..ad139ad621 Binary files /dev/null and b/solutions/images/observability-two-buckets-archi.png differ diff --git a/solutions/images/observability-universal-profiling-overlay.png b/solutions/images/observability-universal-profiling-overlay.png new file mode 100644 index 0000000000..94c0e05ca9 Binary files /dev/null and b/solutions/images/observability-universal-profiling-overlay.png differ diff --git a/solutions/images/observability-uptime-alert-connectors.png b/solutions/images/observability-uptime-alert-connectors.png new file mode 100644 index 0000000000..820bc7eee3 Binary files /dev/null and b/solutions/images/observability-uptime-alert-connectors.png differ diff --git a/solutions/images/observability-uptime-app.png b/solutions/images/observability-uptime-app.png new file mode 100644 index 0000000000..f3514310d4 Binary files /dev/null and b/solutions/images/observability-uptime-app.png differ diff --git a/solutions/images/observability-uptime-filter-bar.png b/solutions/images/observability-uptime-filter-bar.png new file mode 100644 index 0000000000..2eacdc4901 Binary files /dev/null and b/solutions/images/observability-uptime-filter-bar.png differ diff --git a/solutions/images/observability-uptime-history.png b/solutions/images/observability-uptime-history.png new file mode 100644 index 0000000000..e6e0e7ba95 Binary files /dev/null and b/solutions/images/observability-uptime-history.png differ diff --git a/solutions/images/observability-uptime-run-when-selection.png b/solutions/images/observability-uptime-run-when-selection.png new file mode 100644 index 0000000000..da408351e1 Binary files /dev/null and b/solutions/images/observability-uptime-run-when-selection.png differ diff --git a/solutions/images/observability-uptime-status-panel.png b/solutions/images/observability-uptime-status-panel.png new file mode 100644 index 0000000000..4a27c9305d Binary files /dev/null and b/solutions/images/observability-uptime-status-panel.png differ diff --git a/solutions/images/observability-user-exp-metrics.png b/solutions/images/observability-user-exp-metrics.png new file mode 100644 index 0000000000..e196198966 Binary files /dev/null and b/solutions/images/observability-user-exp-metrics.png differ diff --git a/solutions/images/observability-user-experience-tab.png b/solutions/images/observability-user-experience-tab.png new file mode 100644 index 0000000000..a525db7c36 Binary files /dev/null and b/solutions/images/observability-user-experience-tab.png differ diff --git a/solutions/images/observability-visitor-breakdown.png b/solutions/images/observability-visitor-breakdown.png new file mode 100644 index 0000000000..0648fef193 Binary files /dev/null and b/solutions/images/observability-visitor-breakdown.png differ diff --git a/solutions/images/observability-what-is-observability.svg b/solutions/images/observability-what-is-observability.svg new file mode 100644 index 0000000000..b92a7b4912 --- /dev/null +++ b/solutions/images/observability-what-is-observability.svg @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/solutions/images/observability-yellow-service.png b/solutions/images/observability-yellow-service.png new file mode 100644 index 0000000000..43afd6250b Binary files /dev/null and b/solutions/images/observability-yellow-service.png differ diff --git a/solutions/images/security--host-details-insights-expanded.png b/solutions/images/security--host-details-insights-expanded.png new file mode 100644 index 0000000000..cba7af9193 Binary files /dev/null and b/solutions/images/security--host-details-insights-expanded.png differ diff --git a/solutions/images/security-IP-detail-pg.png b/solutions/images/security-IP-detail-pg.png new file mode 100644 index 0000000000..cc18fd1d14 Binary files /dev/null and b/solutions/images/security-IP-detail-pg.png differ diff --git a/solutions/images/security-about-section-rp.png b/solutions/images/security-about-section-rp.png new file mode 100644 index 0000000000..754cf1c0dd Binary files /dev/null and b/solutions/images/security-about-section-rp.png differ diff --git a/solutions/images/security-actions-exception-list.png b/solutions/images/security-actions-exception-list.png new file mode 100644 index 0000000000..9a8c48bca6 Binary files /dev/null and b/solutions/images/security-actions-exception-list.png differ diff --git a/solutions/images/security-add-alert-to-case.gif b/solutions/images/security-add-alert-to-case.gif new file mode 100644 index 0000000000..5141258e0a Binary files /dev/null and b/solutions/images/security-add-alert-to-case.gif differ diff --git a/solutions/images/security-add-alert-to-existing-case.png b/solutions/images/security-add-alert-to-existing-case.png new file mode 100644 index 0000000000..27b7eaa687 Binary files /dev/null and b/solutions/images/security-add-alert-to-existing-case.png differ diff --git a/solutions/images/security-add-alert-to-new-case.png b/solutions/images/security-add-alert-to-new-case.png new file mode 100644 index 0000000000..9082c6a966 Binary files /dev/null and b/solutions/images/security-add-alert-to-new-case.png differ diff --git a/solutions/images/security-add-command-icon.png b/solutions/images/security-add-command-icon.png new file mode 100644 index 0000000000..582b272a7b Binary files /dev/null and b/solutions/images/security-add-command-icon.png differ diff --git a/solutions/images/security-add-discovery-to-assistant.gif b/solutions/images/security-add-discovery-to-assistant.gif new file mode 100644 index 0000000000..e532c7ecc0 Binary files /dev/null and b/solutions/images/security-add-discovery-to-assistant.gif differ diff --git a/solutions/images/security-add-exception-ui.png b/solutions/images/security-add-exception-ui.png new file mode 100644 index 0000000000..a8d23d0eba Binary files /dev/null and b/solutions/images/security-add-exception-ui.png differ diff --git a/solutions/images/security-add-field-button.png b/solutions/images/security-add-field-button.png new file mode 100644 index 0000000000..42d1afe44f Binary files /dev/null and b/solutions/images/security-add-field-button.png differ diff --git a/solutions/images/security-add-filter-icon.png b/solutions/images/security-add-filter-icon.png new file mode 100644 index 0000000000..ca7b2e46f2 Binary files /dev/null and b/solutions/images/security-add-filter-icon.png differ diff --git a/solutions/images/security-add-icon-blue.png b/solutions/images/security-add-icon-blue.png new file mode 100644 index 0000000000..13300e3761 Binary files /dev/null and b/solutions/images/security-add-icon-blue.png differ diff --git a/solutions/images/security-add-integrations.png b/solutions/images/security-add-integrations.png new file mode 100644 index 0000000000..c1ed72779e Binary files /dev/null and b/solutions/images/security-add-integrations.png differ diff --git a/solutions/images/security-add-new-timeline-button.png b/solutions/images/security-add-new-timeline-button.png new file mode 100644 index 0000000000..e854c2b52c Binary files /dev/null and b/solutions/images/security-add-new-timeline-button.png differ diff --git a/solutions/images/security-add-note-icon.png b/solutions/images/security-add-note-icon.png new file mode 100644 index 0000000000..e854c2b52c Binary files /dev/null and b/solutions/images/security-add-note-icon.png differ diff --git a/solutions/images/security-add-timeline-button.png b/solutions/images/security-add-timeline-button.png new file mode 100644 index 0000000000..4062c9b5f1 Binary files /dev/null and b/solutions/images/security-add-timeline-button.png differ diff --git a/solutions/images/security-add-vis-to-case.gif b/solutions/images/security-add-vis-to-case.gif new file mode 100644 index 0000000000..874611704d Binary files /dev/null and b/solutions/images/security-add-vis-to-case.gif differ diff --git a/solutions/images/security-additional-filters.png b/solutions/images/security-additional-filters.png new file mode 100644 index 0000000000..af39ef8d42 Binary files /dev/null and b/solutions/images/security-additional-filters.png differ diff --git a/solutions/images/security-agent-tamper-protection.png b/solutions/images/security-agent-tamper-protection.png new file mode 100644 index 0000000000..267d1dea23 Binary files /dev/null and b/solutions/images/security-agent-tamper-protection.png differ diff --git a/solutions/images/security-ai-assistant-button.png b/solutions/images/security-ai-assistant-button.png new file mode 100644 index 0000000000..e7349f9775 Binary files /dev/null and b/solutions/images/security-ai-assistant-button.png differ diff --git a/solutions/images/security-ai-assistant-chat.png b/solutions/images/security-ai-assistant-chat.png new file mode 100644 index 0000000000..2e5b9450ad Binary files /dev/null and b/solutions/images/security-ai-assistant-chat.png differ diff --git a/solutions/images/security-ai-triage-add-to-case.png b/solutions/images/security-ai-triage-add-to-case.png new file mode 100644 index 0000000000..06aa13ca6a Binary files /dev/null and b/solutions/images/security-ai-triage-add-to-case.png differ diff --git a/solutions/images/security-alert-assigned-alerts.png b/solutions/images/security-alert-assigned-alerts.png new file mode 100644 index 0000000000..1d63dccf53 Binary files /dev/null and b/solutions/images/security-alert-assigned-alerts.png differ diff --git a/solutions/images/security-alert-change-status.png b/solutions/images/security-alert-change-status.png new file mode 100644 index 0000000000..333366d09f Binary files /dev/null and b/solutions/images/security-alert-change-status.png differ diff --git a/solutions/images/security-alert-details-flyout-left-panel.png b/solutions/images/security-alert-details-flyout-left-panel.png new file mode 100644 index 0000000000..08e5dfe55e Binary files /dev/null and b/solutions/images/security-alert-details-flyout-left-panel.png differ diff --git a/solutions/images/security-alert-details-flyout-preview-panel.gif b/solutions/images/security-alert-details-flyout-preview-panel.gif new file mode 100644 index 0000000000..0e27cbf7dc Binary files /dev/null and b/solutions/images/security-alert-details-flyout-preview-panel.gif differ diff --git a/solutions/images/security-alert-details-flyout-right-panel.png b/solutions/images/security-alert-details-flyout-right-panel.png new file mode 100644 index 0000000000..e1072a26f5 Binary files /dev/null and b/solutions/images/security-alert-details-flyout-right-panel.png differ diff --git a/solutions/images/security-alert-filter-assigned-alerts.png b/solutions/images/security-alert-filter-assigned-alerts.png new file mode 100644 index 0000000000..98f0833897 Binary files /dev/null and b/solutions/images/security-alert-filter-assigned-alerts.png differ diff --git a/solutions/images/security-alert-flyout-assignees.png b/solutions/images/security-alert-flyout-assignees.png new file mode 100644 index 0000000000..423adfd6b7 Binary files /dev/null and b/solutions/images/security-alert-flyout-assignees.png differ diff --git a/solutions/images/security-alert-indices-ui.png b/solutions/images/security-alert-indices-ui.png new file mode 100644 index 0000000000..8344624d7a Binary files /dev/null and b/solutions/images/security-alert-indices-ui.png differ diff --git a/solutions/images/security-alert-page-dropdown-controls.png b/solutions/images/security-alert-page-dropdown-controls.png new file mode 100644 index 0000000000..fe7639fdab Binary files /dev/null and b/solutions/images/security-alert-page-dropdown-controls.png differ diff --git a/solutions/images/security-alert-page-visualizations.png b/solutions/images/security-alert-page-visualizations.png new file mode 100644 index 0000000000..685a6233f5 Binary files /dev/null and b/solutions/images/security-alert-page-visualizations.png differ diff --git a/solutions/images/security-alert-page-viz-collapsed.png b/solutions/images/security-alert-page-viz-collapsed.png new file mode 100644 index 0000000000..286128dee0 Binary files /dev/null and b/solutions/images/security-alert-page-viz-collapsed.png differ diff --git a/solutions/images/security-alert-page.png b/solutions/images/security-alert-page.png new file mode 100644 index 0000000000..23c577761d Binary files /dev/null and b/solutions/images/security-alert-page.png differ diff --git a/solutions/images/security-alert-pill.png b/solutions/images/security-alert-pill.png new file mode 100644 index 0000000000..e96fc829fd Binary files /dev/null and b/solutions/images/security-alert-pill.png differ diff --git a/solutions/images/security-alert-suppression-options.png b/solutions/images/security-alert-suppression-options.png new file mode 100644 index 0000000000..61678b5e04 Binary files /dev/null and b/solutions/images/security-alert-suppression-options.png differ diff --git a/solutions/images/security-alert-table-toolbar-buttons.png b/solutions/images/security-alert-table-toolbar-buttons.png new file mode 100644 index 0000000000..91211efadd Binary files /dev/null and b/solutions/images/security-alert-table-toolbar-buttons.png differ diff --git a/solutions/images/security-alerts-flyout-rs.png b/solutions/images/security-alerts-flyout-rs.png new file mode 100644 index 0000000000..6da59af6b9 Binary files /dev/null and b/solutions/images/security-alerts-flyout-rs.png differ diff --git a/solutions/images/security-alerts-table-rs.png b/solutions/images/security-alerts-table-rs.png new file mode 100644 index 0000000000..d572deafa7 Binary files /dev/null and b/solutions/images/security-alerts-table-rs.png differ diff --git a/solutions/images/security-alerts-viz-counts.png b/solutions/images/security-alerts-viz-counts.png new file mode 100644 index 0000000000..48176bb0be Binary files /dev/null and b/solutions/images/security-alerts-viz-counts.png differ diff --git a/solutions/images/security-alerts-viz-summary.png b/solutions/images/security-alerts-viz-summary.png new file mode 100644 index 0000000000..d15a12b714 Binary files /dev/null and b/solutions/images/security-alerts-viz-summary.png differ diff --git a/solutions/images/security-alerts-viz-treemap.png b/solutions/images/security-alerts-viz-treemap.png new file mode 100644 index 0000000000..5383244b84 Binary files /dev/null and b/solutions/images/security-alerts-viz-treemap.png differ diff --git a/solutions/images/security-alerts-viz-trend.png b/solutions/images/security-alerts-viz-trend.png new file mode 100644 index 0000000000..4ee9d47e04 Binary files /dev/null and b/solutions/images/security-alerts-viz-trend.png differ diff --git a/solutions/images/security-all-actions-timeline-ui.png b/solutions/images/security-all-actions-timeline-ui.png new file mode 100644 index 0000000000..6e2bea7e1b Binary files /dev/null and b/solutions/images/security-all-actions-timeline-ui.png differ diff --git a/solutions/images/security-all-rules.png b/solutions/images/security-all-rules.png new file mode 100644 index 0000000000..5ad7137a53 Binary files /dev/null and b/solutions/images/security-all-rules.png differ diff --git a/solutions/images/security-allow-system-ext.png b/solutions/images/security-allow-system-ext.png new file mode 100644 index 0000000000..50c64552d7 Binary files /dev/null and b/solutions/images/security-allow-system-ext.png differ diff --git a/solutions/images/security-allow_fda_ven.png b/solutions/images/security-allow_fda_ven.png new file mode 100644 index 0000000000..0ddc224224 Binary files /dev/null and b/solutions/images/security-allow_fda_ven.png differ diff --git a/solutions/images/security-allow_full_disk_access_notification_ven.png b/solutions/images/security-allow_full_disk_access_notification_ven.png new file mode 100644 index 0000000000..8383df9f48 Binary files /dev/null and b/solutions/images/security-allow_full_disk_access_notification_ven.png differ diff --git a/solutions/images/security-allow_network_filter_ven.png b/solutions/images/security-allow_network_filter_ven.png new file mode 100644 index 0000000000..fc1fdd9721 Binary files /dev/null and b/solutions/images/security-allow_network_filter_ven.png differ diff --git a/solutions/images/security-allow_system_extension_ven.png b/solutions/images/security-allow_system_extension_ven.png new file mode 100644 index 0000000000..b1499d8872 Binary files /dev/null and b/solutions/images/security-allow_system_extension_ven.png differ diff --git a/solutions/images/security-analyze-event-button.png b/solutions/images/security-analyze-event-button.png new file mode 100644 index 0000000000..4c4e122ef1 Binary files /dev/null and b/solutions/images/security-analyze-event-button.png differ diff --git a/solutions/images/security-analyze-event-timeline.png b/solutions/images/security-analyze-event-timeline.png new file mode 100644 index 0000000000..6aa6d31d5a Binary files /dev/null and b/solutions/images/security-analyze-event-timeline.png differ diff --git a/solutions/images/security-anomalies-table.png b/solutions/images/security-anomalies-table.png new file mode 100644 index 0000000000..a352bd5977 Binary files /dev/null and b/solutions/images/security-anomalies-table.png differ diff --git a/solutions/images/security-asset-criticality-impact.png b/solutions/images/security-asset-criticality-impact.png new file mode 100644 index 0000000000..23282c03cc Binary files /dev/null and b/solutions/images/security-asset-criticality-impact.png differ diff --git a/solutions/images/security-assign-alert.png b/solutions/images/security-assign-alert.png new file mode 100644 index 0000000000..e854c2b52c Binary files /dev/null and b/solutions/images/security-assign-alert.png differ diff --git a/solutions/images/security-assign-asset-criticality-host-details.png b/solutions/images/security-assign-asset-criticality-host-details.png new file mode 100644 index 0000000000..c55e4b5e7d Binary files /dev/null and b/solutions/images/security-assign-asset-criticality-host-details.png differ diff --git a/solutions/images/security-assign-asset-criticality-host-flyout.png b/solutions/images/security-assign-asset-criticality-host-flyout.png new file mode 100644 index 0000000000..cc3e8cd29d Binary files /dev/null and b/solutions/images/security-assign-asset-criticality-host-flyout.png differ diff --git a/solutions/images/security-assign-asset-criticality-timeline.png b/solutions/images/security-assign-asset-criticality-timeline.png new file mode 100644 index 0000000000..b4ce0e00a6 Binary files /dev/null and b/solutions/images/security-assign-asset-criticality-timeline.png differ diff --git a/solutions/images/security-assistant-anonymization-menu.png b/solutions/images/security-assistant-anonymization-menu.png new file mode 100644 index 0000000000..de53cfdfc9 Binary files /dev/null and b/solutions/images/security-assistant-anonymization-menu.png differ diff --git a/solutions/images/security-assistant-basic-view.png b/solutions/images/security-assistant-basic-view.png new file mode 100644 index 0000000000..8e66aa8be5 Binary files /dev/null and b/solutions/images/security-assistant-basic-view.png differ diff --git a/solutions/images/security-assistant-settings-system-prompts.png b/solutions/images/security-assistant-settings-system-prompts.png new file mode 100644 index 0000000000..b28456d8e1 Binary files /dev/null and b/solutions/images/security-assistant-settings-system-prompts.png differ diff --git a/solutions/images/security-associated-shared-exception-list.png b/solutions/images/security-associated-shared-exception-list.png new file mode 100644 index 0000000000..e0bb062d15 Binary files /dev/null and b/solutions/images/security-associated-shared-exception-list.png differ diff --git a/solutions/images/security-attack-surface-reduction.png b/solutions/images/security-attack-surface-reduction.png new file mode 100644 index 0000000000..cff71ebf2e Binary files /dev/null and b/solutions/images/security-attack-surface-reduction.png differ diff --git a/solutions/images/security-attck-disc-11-alerts-disc.png b/solutions/images/security-attck-disc-11-alerts-disc.png new file mode 100644 index 0000000000..f36bf0424a Binary files /dev/null and b/solutions/images/security-attck-disc-11-alerts-disc.png differ diff --git a/solutions/images/security-attck-disc-alerts-number-menu.png b/solutions/images/security-attck-disc-alerts-number-menu.png new file mode 100644 index 0000000000..bcbb57ccce Binary files /dev/null and b/solutions/images/security-attck-disc-alerts-number-menu.png differ diff --git a/solutions/images/security-attck-disc-esql-query-gen-example.png b/solutions/images/security-attck-disc-esql-query-gen-example.png new file mode 100644 index 0000000000..2db023e780 Binary files /dev/null and b/solutions/images/security-attck-disc-esql-query-gen-example.png differ diff --git a/solutions/images/security-attck-disc-example-disc.png b/solutions/images/security-attck-disc-example-disc.png new file mode 100644 index 0000000000..f36bf0424a Binary files /dev/null and b/solutions/images/security-attck-disc-example-disc.png differ diff --git a/solutions/images/security-attck-disc-rbac.png b/solutions/images/security-attck-disc-rbac.png new file mode 100644 index 0000000000..36a3c27e42 Binary files /dev/null and b/solutions/images/security-attck-disc-rbac.png differ diff --git a/solutions/images/security-attck-disc-remediate-threat.gif b/solutions/images/security-attck-disc-remediate-threat.gif new file mode 100644 index 0000000000..e31f84235e Binary files /dev/null and b/solutions/images/security-attck-disc-remediate-threat.gif differ diff --git a/solutions/images/security-attck-disc-select-model-empty.png b/solutions/images/security-attck-disc-select-model-empty.png new file mode 100644 index 0000000000..b1eb9488f1 Binary files /dev/null and b/solutions/images/security-attck-disc-select-model-empty.png differ diff --git a/solutions/images/security-attck-disc-translate-japanese.png b/solutions/images/security-attck-disc-translate-japanese.png new file mode 100644 index 0000000000..320b3fd1a5 Binary files /dev/null and b/solutions/images/security-attck-disc-translate-japanese.png differ diff --git a/solutions/images/security-auto-import-create-new-integration-button.png b/solutions/images/security-auto-import-create-new-integration-button.png new file mode 100644 index 0000000000..976898beb2 Binary files /dev/null and b/solutions/images/security-auto-import-create-new-integration-button.png differ diff --git a/solutions/images/security-auto-import-edit-pipeline.gif b/solutions/images/security-auto-import-edit-pipeline.gif new file mode 100644 index 0000000000..1008fb345b Binary files /dev/null and b/solutions/images/security-auto-import-edit-pipeline.gif differ diff --git a/solutions/images/security-auto-import-review-integration-page.png b/solutions/images/security-auto-import-review-integration-page.png new file mode 100644 index 0000000000..97ea0ee831 Binary files /dev/null and b/solutions/images/security-auto-import-review-integration-page.png differ diff --git a/solutions/images/security-auto-import-success-message.png b/solutions/images/security-auto-import-success-message.png new file mode 100644 index 0000000000..d7ef0a8530 Binary files /dev/null and b/solutions/images/security-auto-import-success-message.png differ diff --git a/solutions/images/security-available-response-actions-osquery.png b/solutions/images/security-available-response-actions-osquery.png new file mode 100644 index 0000000000..1d4515bb6c Binary files /dev/null and b/solutions/images/security-available-response-actions-osquery.png differ diff --git a/solutions/images/security-aws-config-finding-logs.png b/solutions/images/security-aws-config-finding-logs.png new file mode 100644 index 0000000000..ad83affa75 Binary files /dev/null and b/solutions/images/security-aws-config-finding-logs.png differ diff --git a/solutions/images/security-behavior-protection.png b/solutions/images/security-behavior-protection.png new file mode 100644 index 0000000000..a9fa3d5551 Binary files /dev/null and b/solutions/images/security-behavior-protection.png differ diff --git a/solutions/images/security-benchmark-rules.png b/solutions/images/security-benchmark-rules.png new file mode 100644 index 0000000000..107ba0ca1e Binary files /dev/null and b/solutions/images/security-benchmark-rules.png differ diff --git a/solutions/images/security-blocklist.png b/solutions/images/security-blocklist.png new file mode 100644 index 0000000000..f739e521ce Binary files /dev/null and b/solutions/images/security-blocklist.png differ diff --git a/solutions/images/security-boxesVertical.svg b/solutions/images/security-boxesVertical.svg new file mode 100644 index 0000000000..aed10b0d8e --- /dev/null +++ b/solutions/images/security-boxesVertical.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/security-bulk-add-alerts-to-timeline.png b/solutions/images/security-bulk-add-alerts-to-timeline.png new file mode 100644 index 0000000000..bfcac3e402 Binary files /dev/null and b/solutions/images/security-bulk-add-alerts-to-timeline.png differ diff --git a/solutions/images/security-bulk-apply-alert-tag.png b/solutions/images/security-bulk-apply-alert-tag.png new file mode 100644 index 0000000000..c8c1d8211b Binary files /dev/null and b/solutions/images/security-bulk-apply-alert-tag.png differ diff --git a/solutions/images/security-cancel-value-list-item-changes.png b/solutions/images/security-cancel-value-list-item-changes.png new file mode 100644 index 0000000000..cf03c456e0 Binary files /dev/null and b/solutions/images/security-cancel-value-list-item-changes.png differ diff --git a/solutions/images/security-case-button-osquery.png b/solutions/images/security-case-button-osquery.png new file mode 100644 index 0000000000..9fc908984d Binary files /dev/null and b/solutions/images/security-case-button-osquery.png differ diff --git a/solutions/images/security-cases-add-custom-field.png b/solutions/images/security-cases-add-custom-field.png new file mode 100644 index 0000000000..134ea000a8 Binary files /dev/null and b/solutions/images/security-cases-add-custom-field.png differ diff --git a/solutions/images/security-cases-add-observables.png b/solutions/images/security-cases-add-observables.png new file mode 100644 index 0000000000..659e0db868 Binary files /dev/null and b/solutions/images/security-cases-add-observables.png differ diff --git a/solutions/images/security-cases-add-template.png b/solutions/images/security-cases-add-template.png new file mode 100644 index 0000000000..5a7e369434 Binary files /dev/null and b/solutions/images/security-cases-add-template.png differ diff --git a/solutions/images/security-cases-alert-tab.png b/solutions/images/security-cases-alert-tab.png new file mode 100644 index 0000000000..211a079dc6 Binary files /dev/null and b/solutions/images/security-cases-alert-tab.png differ diff --git a/solutions/images/security-cases-copy-case-id.png b/solutions/images/security-cases-copy-case-id.png new file mode 100644 index 0000000000..cb5e57fb38 Binary files /dev/null and b/solutions/images/security-cases-copy-case-id.png differ diff --git a/solutions/images/security-cases-export-button.png b/solutions/images/security-cases-export-button.png new file mode 100644 index 0000000000..c1b17befac Binary files /dev/null and b/solutions/images/security-cases-export-button.png differ diff --git a/solutions/images/security-cases-files.png b/solutions/images/security-cases-files.png new file mode 100644 index 0000000000..784af1d72d Binary files /dev/null and b/solutions/images/security-cases-files.png differ diff --git a/solutions/images/security-cases-home-page.png b/solutions/images/security-cases-home-page.png new file mode 100644 index 0000000000..7f27d203ea Binary files /dev/null and b/solutions/images/security-cases-home-page.png differ diff --git a/solutions/images/security-cases-manage-comments.png b/solutions/images/security-cases-manage-comments.png new file mode 100644 index 0000000000..57514a879b Binary files /dev/null and b/solutions/images/security-cases-manage-comments.png differ diff --git a/solutions/images/security-cases-observable-types.png b/solutions/images/security-cases-observable-types.png new file mode 100644 index 0000000000..8ca37cb784 Binary files /dev/null and b/solutions/images/security-cases-observable-types.png differ diff --git a/solutions/images/security-cases-open-vis.png b/solutions/images/security-cases-open-vis.png new file mode 100644 index 0000000000..f1c7883f7e Binary files /dev/null and b/solutions/images/security-cases-open-vis.png differ diff --git a/solutions/images/security-cases-settings.png b/solutions/images/security-cases-settings.png new file mode 100644 index 0000000000..fd2cb81b67 Binary files /dev/null and b/solutions/images/security-cases-settings.png differ diff --git a/solutions/images/security-cases-summary.png b/solutions/images/security-cases-summary.png new file mode 100644 index 0000000000..a48379d9bf Binary files /dev/null and b/solutions/images/security-cases-summary.png differ diff --git a/solutions/images/security-cases-ui-open.png b/solutions/images/security-cases-ui-open.png new file mode 100644 index 0000000000..d71eb710f3 Binary files /dev/null and b/solutions/images/security-cases-ui-open.png differ diff --git a/solutions/images/security-ccs-local-role.png b/solutions/images/security-ccs-local-role.png new file mode 100644 index 0000000000..c8ed6c9f3d Binary files /dev/null and b/solutions/images/security-ccs-local-role.png differ diff --git a/solutions/images/security-ccs-remote-role.png b/solutions/images/security-ccs-remote-role.png new file mode 100644 index 0000000000..6d1caae33b Binary files /dev/null and b/solutions/images/security-ccs-remote-role.png differ diff --git a/solutions/images/security-ccs-rule-source.png b/solutions/images/security-ccs-rule-source.png new file mode 100644 index 0000000000..ef2a02053e Binary files /dev/null and b/solutions/images/security-ccs-rule-source.png differ diff --git a/solutions/images/security-cloned-job-details.png b/solutions/images/security-cloned-job-details.png new file mode 100644 index 0000000000..d331277668 Binary files /dev/null and b/solutions/images/security-cloned-job-details.png differ diff --git a/solutions/images/security-cloud-sec-dashboard-individual-row.png b/solutions/images/security-cloud-sec-dashboard-individual-row.png new file mode 100644 index 0000000000..57f6eb8caf Binary files /dev/null and b/solutions/images/security-cloud-sec-dashboard-individual-row.png differ diff --git a/solutions/images/security-cloud-sec-dashboard.png b/solutions/images/security-cloud-sec-dashboard.png new file mode 100644 index 0000000000..b7ab7af816 Binary files /dev/null and b/solutions/images/security-cloud-sec-dashboard.png differ diff --git a/solutions/images/security-cnvm-cloudformation.png b/solutions/images/security-cnvm-cloudformation.png new file mode 100644 index 0000000000..890be7a391 Binary files /dev/null and b/solutions/images/security-cnvm-cloudformation.png differ diff --git a/solutions/images/security-cnvm-setup-1.png b/solutions/images/security-cnvm-setup-1.png new file mode 100644 index 0000000000..3b2ce9adb6 Binary files /dev/null and b/solutions/images/security-cnvm-setup-1.png differ diff --git a/solutions/images/security-collapse-icon-horiz-down.png b/solutions/images/security-collapse-icon-horiz-down.png new file mode 100644 index 0000000000..406dfcd928 Binary files /dev/null and b/solutions/images/security-collapse-icon-horiz-down.png differ diff --git a/solutions/images/security-collapse-right-icon.png b/solutions/images/security-collapse-right-icon.png new file mode 100644 index 0000000000..b0ba90b681 Binary files /dev/null and b/solutions/images/security-collapse-right-icon.png differ diff --git a/solutions/images/security-config-status.png b/solutions/images/security-config-status.png new file mode 100644 index 0000000000..78e11ed804 Binary files /dev/null and b/solutions/images/security-config-status.png differ diff --git a/solutions/images/security-content-filtering-jamf.png b/solutions/images/security-content-filtering-jamf.png new file mode 100644 index 0000000000..0698e567c5 Binary files /dev/null and b/solutions/images/security-content-filtering-jamf.png differ diff --git a/solutions/images/security-correlation-tab-eql-query.png b/solutions/images/security-correlation-tab-eql-query.png new file mode 100644 index 0000000000..56d45538a3 Binary files /dev/null and b/solutions/images/security-correlation-tab-eql-query.png differ diff --git a/solutions/images/security-correlations-overview.png b/solutions/images/security-correlations-overview.png new file mode 100644 index 0000000000..6fec67ee03 Binary files /dev/null and b/solutions/images/security-correlations-overview.png differ diff --git a/solutions/images/security-create-a-timeline-template-field.png b/solutions/images/security-create-a-timeline-template-field.png new file mode 100644 index 0000000000..5a13242d44 Binary files /dev/null and b/solutions/images/security-create-a-timeline-template-field.png differ diff --git a/solutions/images/security-create-note-icon.png b/solutions/images/security-create-note-icon.png new file mode 100644 index 0000000000..7c0b44955e Binary files /dev/null and b/solutions/images/security-create-note-icon.png differ diff --git a/solutions/images/security-create-runtime-fields-timeline.png b/solutions/images/security-create-runtime-fields-timeline.png new file mode 100644 index 0000000000..14b95f85c0 Binary files /dev/null and b/solutions/images/security-create-runtime-fields-timeline.png differ diff --git a/solutions/images/security-cspm-aws-auth-1.png b/solutions/images/security-cspm-aws-auth-1.png new file mode 100644 index 0000000000..6a98ea85e3 Binary files /dev/null and b/solutions/images/security-cspm-aws-auth-1.png differ diff --git a/solutions/images/security-cspm-aws-auth-2.png b/solutions/images/security-cspm-aws-auth-2.png new file mode 100644 index 0000000000..515aa77492 Binary files /dev/null and b/solutions/images/security-cspm-aws-auth-2.png differ diff --git a/solutions/images/security-cspm-aws-auth-3.png b/solutions/images/security-cspm-aws-auth-3.png new file mode 100644 index 0000000000..48681cb68e Binary files /dev/null and b/solutions/images/security-cspm-aws-auth-3.png differ diff --git a/solutions/images/security-cspm-cloudformation-template.png b/solutions/images/security-cspm-cloudformation-template.png new file mode 100644 index 0000000000..64f22dad94 Binary files /dev/null and b/solutions/images/security-cspm-cloudformation-template.png differ diff --git a/solutions/images/security-cspm-cloudshell-trust.png b/solutions/images/security-cspm-cloudshell-trust.png new file mode 100644 index 0000000000..57ed37d3b4 Binary files /dev/null and b/solutions/images/security-cspm-cloudshell-trust.png differ diff --git a/solutions/images/security-customize-event-renderers.png b/solutions/images/security-customize-event-renderers.png new file mode 100644 index 0000000000..ece9382fff Binary files /dev/null and b/solutions/images/security-customize-event-renderers.png differ diff --git a/solutions/images/security-dashboards-landing-page.png b/solutions/images/security-dashboards-landing-page.png new file mode 100644 index 0000000000..c947bfab19 Binary files /dev/null and b/solutions/images/security-dashboards-landing-page.png differ diff --git a/solutions/images/security-data-qual-dash-detail.png b/solutions/images/security-data-qual-dash-detail.png new file mode 100644 index 0000000000..7e397586be Binary files /dev/null and b/solutions/images/security-data-qual-dash-detail.png differ diff --git a/solutions/images/security-data-qual-dash-history.png b/solutions/images/security-data-qual-dash-history.png new file mode 100644 index 0000000000..58e634e09a Binary files /dev/null and b/solutions/images/security-data-qual-dash-history.png differ diff --git a/solutions/images/security-data-qual-dash.png b/solutions/images/security-data-qual-dash.png new file mode 100644 index 0000000000..9310d84cf2 Binary files /dev/null and b/solutions/images/security-data-qual-dash.png differ diff --git a/solutions/images/security-data-view-selection.png b/solutions/images/security-data-view-selection.png new file mode 100644 index 0000000000..f0d15645ec Binary files /dev/null and b/solutions/images/security-data-view-selection.png differ diff --git a/solutions/images/security-dataview-button-highlighted.png b/solutions/images/security-dataview-button-highlighted.png new file mode 100644 index 0000000000..d78168a40a Binary files /dev/null and b/solutions/images/security-dataview-button-highlighted.png differ diff --git a/solutions/images/security-dataview-filter-example.gif b/solutions/images/security-dataview-filter-example.gif new file mode 100644 index 0000000000..f1c1e77411 Binary files /dev/null and b/solutions/images/security-dataview-filter-example.gif differ diff --git a/solutions/images/security-date-range-selection.png b/solutions/images/security-date-range-selection.png new file mode 100644 index 0000000000..40515f6832 Binary files /dev/null and b/solutions/images/security-date-range-selection.png differ diff --git a/solutions/images/security-detection-response-dashboard.png b/solutions/images/security-detection-response-dashboard.png new file mode 100644 index 0000000000..ae2e9cd18f Binary files /dev/null and b/solutions/images/security-detection-response-dashboard.png differ diff --git a/solutions/images/security-discover-button-osquery.png b/solutions/images/security-discover-button-osquery.png new file mode 100644 index 0000000000..599f3f3578 Binary files /dev/null and b/solutions/images/security-discover-button-osquery.png differ diff --git a/solutions/images/security-edit-value-list-item.png b/solutions/images/security-edit-value-list-item.png new file mode 100644 index 0000000000..dc189cc790 Binary files /dev/null and b/solutions/images/security-edit-value-list-item.png differ diff --git a/solutions/images/security-edit-value-lists.png b/solutions/images/security-edit-value-lists.png new file mode 100644 index 0000000000..dd53a8dc11 Binary files /dev/null and b/solutions/images/security-edit-value-lists.png differ diff --git a/solutions/images/security-endpoint-add-exp.png b/solutions/images/security-endpoint-add-exp.png new file mode 100644 index 0000000000..fe5c928264 Binary files /dev/null and b/solutions/images/security-endpoint-add-exp.png differ diff --git a/solutions/images/security-endpoint-cloud-sec-add-agent-detail.png b/solutions/images/security-endpoint-cloud-sec-add-agent-detail.png new file mode 100644 index 0000000000..f34563c789 Binary files /dev/null and b/solutions/images/security-endpoint-cloud-sec-add-agent-detail.png differ diff --git a/solutions/images/security-endpoint-cloud-sec-add-agent.png b/solutions/images/security-endpoint-cloud-sec-add-agent.png new file mode 100644 index 0000000000..052c3d0114 Binary files /dev/null and b/solutions/images/security-endpoint-cloud-sec-add-agent.png differ diff --git a/solutions/images/security-endpoint-cloud-sec-integrations-page.png b/solutions/images/security-endpoint-cloud-sec-integrations-page.png new file mode 100644 index 0000000000..5d5c31e0e3 Binary files /dev/null and b/solutions/images/security-endpoint-cloud-sec-integrations-page.png differ diff --git a/solutions/images/security-endpoint-cloud-security-configuration.png b/solutions/images/security-endpoint-cloud-security-configuration.png new file mode 100644 index 0000000000..35cf3affb3 Binary files /dev/null and b/solutions/images/security-endpoint-cloud-security-configuration.png differ diff --git a/solutions/images/security-endpoints-pg.png b/solutions/images/security-endpoints-pg.png new file mode 100644 index 0000000000..22e7410c5b Binary files /dev/null and b/solutions/images/security-endpoints-pg.png differ diff --git a/solutions/images/security-enter_login_details_to_confirm_ven.png b/solutions/images/security-enter_login_details_to_confirm_ven.png new file mode 100644 index 0000000000..ed25e4323c Binary files /dev/null and b/solutions/images/security-enter_login_details_to_confirm_ven.png differ diff --git a/solutions/images/security-entities-overview.png b/solutions/images/security-entities-overview.png new file mode 100644 index 0000000000..e27d149368 Binary files /dev/null and b/solutions/images/security-entities-overview.png differ diff --git a/solutions/images/security-entities-section.png b/solutions/images/security-entities-section.png new file mode 100644 index 0000000000..9bb4c5338d Binary files /dev/null and b/solutions/images/security-entities-section.png differ diff --git a/solutions/images/security-entity-dashboard.png b/solutions/images/security-entity-dashboard.png new file mode 100644 index 0000000000..56479b9f1e Binary files /dev/null and b/solutions/images/security-entity-dashboard.png differ diff --git a/solutions/images/security-env-var-capture-detail.png b/solutions/images/security-env-var-capture-detail.png new file mode 100644 index 0000000000..b6ed6fdafc Binary files /dev/null and b/solutions/images/security-env-var-capture-detail.png differ diff --git a/solutions/images/security-eql-rule-query-example.png b/solutions/images/security-eql-rule-query-example.png new file mode 100644 index 0000000000..91600ff923 Binary files /dev/null and b/solutions/images/security-eql-rule-query-example.png differ diff --git a/solutions/images/security-eql-settings-icon.png b/solutions/images/security-eql-settings-icon.png new file mode 100644 index 0000000000..caa4b8e913 Binary files /dev/null and b/solutions/images/security-eql-settings-icon.png differ diff --git a/solutions/images/security-esql-help-ref-button.png b/solutions/images/security-esql-help-ref-button.png new file mode 100644 index 0000000000..ac62800858 Binary files /dev/null and b/solutions/images/security-esql-help-ref-button.png differ diff --git a/solutions/images/security-esql-tab.png b/solutions/images/security-esql-tab.png new file mode 100644 index 0000000000..deb79f0e16 Binary files /dev/null and b/solutions/images/security-esql-tab.png differ diff --git a/solutions/images/security-event-collection.png b/solutions/images/security-event-collection.png new file mode 100644 index 0000000000..b408295e7b Binary files /dev/null and b/solutions/images/security-event-collection.png differ diff --git a/solutions/images/security-event-details.png b/solutions/images/security-event-details.png new file mode 100644 index 0000000000..f4a8eb16e8 Binary files /dev/null and b/solutions/images/security-event-details.png differ diff --git a/solutions/images/security-event-filter.png b/solutions/images/security-event-filter.png new file mode 100644 index 0000000000..9937fff516 Binary files /dev/null and b/solutions/images/security-event-filter.png differ diff --git a/solutions/images/security-event-filters-list.png b/solutions/images/security-event-filters-list.png new file mode 100644 index 0000000000..9dc0dab50c Binary files /dev/null and b/solutions/images/security-event-filters-list.png differ diff --git a/solutions/images/security-event-rendered-view.png b/solutions/images/security-event-rendered-view.png new file mode 100644 index 0000000000..54471ada23 Binary files /dev/null and b/solutions/images/security-event-rendered-view.png differ diff --git a/solutions/images/security-event-type.png b/solutions/images/security-event-type.png new file mode 100644 index 0000000000..819a8495a7 Binary files /dev/null and b/solutions/images/security-event-type.png differ diff --git a/solutions/images/security-events-count.png b/solutions/images/security-events-count.png new file mode 100644 index 0000000000..ef28a67b63 Binary files /dev/null and b/solutions/images/security-events-count.png differ diff --git a/solutions/images/security-events-table.png b/solutions/images/security-events-table.png new file mode 100644 index 0000000000..b889a1afb7 Binary files /dev/null and b/solutions/images/security-events-table.png differ diff --git a/solutions/images/security-exception-affects-multiple-rules.png b/solutions/images/security-exception-affects-multiple-rules.png new file mode 100644 index 0000000000..2ca300f624 Binary files /dev/null and b/solutions/images/security-exception-affects-multiple-rules.png differ diff --git a/solutions/images/security-exception-item-example.png b/solutions/images/security-exception-item-example.png new file mode 100644 index 0000000000..1da080b593 Binary files /dev/null and b/solutions/images/security-exception-item-example.png differ diff --git a/solutions/images/security-expand-details-button.png b/solutions/images/security-expand-details-button.png new file mode 100644 index 0000000000..3152e9cad2 Binary files /dev/null and b/solutions/images/security-expand-details-button.png differ diff --git a/solutions/images/security-expand-icon-vertical-right.png b/solutions/images/security-expand-icon-vertical-right.png new file mode 100644 index 0000000000..5ce4ddd974 Binary files /dev/null and b/solutions/images/security-expand-icon-vertical-right.png differ diff --git a/solutions/images/security-expanded-correlations-view.png b/solutions/images/security-expanded-correlations-view.png new file mode 100644 index 0000000000..7679fa88c5 Binary files /dev/null and b/solutions/images/security-expanded-correlations-view.png differ diff --git a/solutions/images/security-expanded-entities-view.png b/solutions/images/security-expanded-entities-view.png new file mode 100644 index 0000000000..6a37b0cb0e Binary files /dev/null and b/solutions/images/security-expanded-entities-view.png differ diff --git a/solutions/images/security-expanded-prevalence-view.png b/solutions/images/security-expanded-prevalence-view.png new file mode 100644 index 0000000000..2bfe84fa1a Binary files /dev/null and b/solutions/images/security-expanded-prevalence-view.png differ diff --git a/solutions/images/security-expanded-threat-intelligence-view.png b/solutions/images/security-expanded-threat-intelligence-view.png new file mode 100644 index 0000000000..0fff543aa7 Binary files /dev/null and b/solutions/images/security-expanded-threat-intelligence-view.png differ diff --git a/solutions/images/security-export-value-list.png b/solutions/images/security-export-value-list.png new file mode 100644 index 0000000000..862703fbbe Binary files /dev/null and b/solutions/images/security-export-value-list.png differ diff --git a/solutions/images/security-favorite-icon.png b/solutions/images/security-favorite-icon.png new file mode 100644 index 0000000000..d1276b08af Binary files /dev/null and b/solutions/images/security-favorite-icon.png differ diff --git a/solutions/images/security-fda-7-16.png b/solutions/images/security-fda-7-16.png new file mode 100644 index 0000000000..b6365a81eb Binary files /dev/null and b/solutions/images/security-fda-7-16.png differ diff --git a/solutions/images/security-fda-jamf.png b/solutions/images/security-fda-jamf.png new file mode 100644 index 0000000000..60462fff9c Binary files /dev/null and b/solutions/images/security-fda-jamf.png differ diff --git a/solutions/images/security-field-warning-icon.png b/solutions/images/security-field-warning-icon.png new file mode 100644 index 0000000000..b77960d73e Binary files /dev/null and b/solutions/images/security-field-warning-icon.png differ diff --git a/solutions/images/security-fields-browser.png b/solutions/images/security-fields-browser.png new file mode 100644 index 0000000000..b46d4f5487 Binary files /dev/null and b/solutions/images/security-fields-browser.png differ diff --git a/solutions/images/security-filter-add-item.png b/solutions/images/security-filter-add-item.png new file mode 100644 index 0000000000..004380ad3a Binary files /dev/null and b/solutions/images/security-filter-add-item.png differ diff --git a/solutions/images/security-filter-by-asset-criticality.png b/solutions/images/security-filter-by-asset-criticality.png new file mode 100644 index 0000000000..d5f426ca27 Binary files /dev/null and b/solutions/images/security-filter-by-asset-criticality.png differ diff --git a/solutions/images/security-filter-by-host-risk-level.png b/solutions/images/security-filter-by-host-risk-level.png new file mode 100644 index 0000000000..84a56291d6 Binary files /dev/null and b/solutions/images/security-filter-by-host-risk-level.png differ diff --git a/solutions/images/security-filter-endpoints.png b/solutions/images/security-filter-endpoints.png new file mode 100644 index 0000000000..8989c5175d Binary files /dev/null and b/solutions/images/security-filter-endpoints.png differ diff --git a/solutions/images/security-filter-icon.png b/solutions/images/security-filter-icon.png new file mode 100644 index 0000000000..fb75463d13 Binary files /dev/null and b/solutions/images/security-filter-icon.png differ diff --git a/solutions/images/security-filter-network-content.png b/solutions/images/security-filter-network-content.png new file mode 100644 index 0000000000..d55eb7e04d Binary files /dev/null and b/solutions/images/security-filter-network-content.png differ diff --git a/solutions/images/security-findings-page.png b/solutions/images/security-findings-page.png new file mode 100644 index 0000000000..54b1e514eb Binary files /dev/null and b/solutions/images/security-findings-page.png differ diff --git a/solutions/images/security-flyout-settings.png b/solutions/images/security-flyout-settings.png new file mode 100644 index 0000000000..a7f23f0df1 Binary files /dev/null and b/solutions/images/security-flyout-settings.png differ diff --git a/solutions/images/security-full-screen-analyzer.png b/solutions/images/security-full-screen-analyzer.png new file mode 100644 index 0000000000..bb0e2ec4ff Binary files /dev/null and b/solutions/images/security-full-screen-analyzer.png differ diff --git a/solutions/images/security-graphical-view.png b/solutions/images/security-graphical-view.png new file mode 100644 index 0000000000..d7a56795ea Binary files /dev/null and b/solutions/images/security-graphical-view.png differ diff --git a/solutions/images/security-group-alerts-expand.png b/solutions/images/security-group-alerts-expand.png new file mode 100644 index 0000000000..0304592bd8 Binary files /dev/null and b/solutions/images/security-group-alerts-expand.png differ diff --git a/solutions/images/security-group-alerts.png b/solutions/images/security-group-alerts.png new file mode 100644 index 0000000000..6f794f1de7 Binary files /dev/null and b/solutions/images/security-group-alerts.png differ diff --git a/solutions/images/security-group-by-asset-criticality.png b/solutions/images/security-group-by-asset-criticality.png new file mode 100644 index 0000000000..5d5fa6e283 Binary files /dev/null and b/solutions/images/security-group-by-asset-criticality.png differ diff --git a/solutions/images/security-group-by-host-risk-level.png b/solutions/images/security-group-by-host-risk-level.png new file mode 100644 index 0000000000..3c40e9dbf5 Binary files /dev/null and b/solutions/images/security-group-by-host-risk-level.png differ diff --git a/solutions/images/security-group-icon.png b/solutions/images/security-group-icon.png new file mode 100644 index 0000000000..3fa9ad91a6 Binary files /dev/null and b/solutions/images/security-group-icon.png differ diff --git a/solutions/images/security-handle-icon.png b/solutions/images/security-handle-icon.png new file mode 100644 index 0000000000..25c5593f6f Binary files /dev/null and b/solutions/images/security-handle-icon.png differ diff --git a/solutions/images/security-help-icon.png b/solutions/images/security-help-icon.png new file mode 100644 index 0000000000..0d22c2ce09 Binary files /dev/null and b/solutions/images/security-help-icon.png differ diff --git a/solutions/images/security-host-asset-criticality.png b/solutions/images/security-host-asset-criticality.png new file mode 100644 index 0000000000..c3157649f1 Binary files /dev/null and b/solutions/images/security-host-asset-criticality.png differ diff --git a/solutions/images/security-host-details-flyout.png b/solutions/images/security-host-details-flyout.png new file mode 100644 index 0000000000..a5a960a596 Binary files /dev/null and b/solutions/images/security-host-details-flyout.png differ diff --git a/solutions/images/security-host-details-hr-tab.png b/solutions/images/security-host-details-hr-tab.png new file mode 100644 index 0000000000..64bf96324a Binary files /dev/null and b/solutions/images/security-host-details-hr-tab.png differ diff --git a/solutions/images/security-host-details-overview.png b/solutions/images/security-host-details-overview.png new file mode 100644 index 0000000000..8c19f8b90c Binary files /dev/null and b/solutions/images/security-host-details-overview.png differ diff --git a/solutions/images/security-host-flyout.png b/solutions/images/security-host-flyout.png new file mode 100644 index 0000000000..0a3b36ac9c Binary files /dev/null and b/solutions/images/security-host-flyout.png differ diff --git a/solutions/images/security-host-isolated-notif.png b/solutions/images/security-host-isolated-notif.png new file mode 100644 index 0000000000..8676d9fc28 Binary files /dev/null and b/solutions/images/security-host-isolated-notif.png differ diff --git a/solutions/images/security-host-isolation-exceptions-ui.png b/solutions/images/security-host-isolation-exceptions-ui.png new file mode 100644 index 0000000000..250bd4eff2 Binary files /dev/null and b/solutions/images/security-host-isolation-exceptions-ui.png differ diff --git a/solutions/images/security-host-observed-data.png b/solutions/images/security-host-observed-data.png new file mode 100644 index 0000000000..6b4b04ccb9 Binary files /dev/null and b/solutions/images/security-host-observed-data.png differ diff --git a/solutions/images/security-host-released-notif.png b/solutions/images/security-host-released-notif.png new file mode 100644 index 0000000000..f152cc0e1e Binary files /dev/null and b/solutions/images/security-host-released-notif.png differ diff --git a/solutions/images/security-host-risk-inputs.png b/solutions/images/security-host-risk-inputs.png new file mode 100644 index 0000000000..483980f378 Binary files /dev/null and b/solutions/images/security-host-risk-inputs.png differ diff --git a/solutions/images/security-host-score-data.png b/solutions/images/security-host-score-data.png new file mode 100644 index 0000000000..1fb6446c5d Binary files /dev/null and b/solutions/images/security-host-score-data.png differ diff --git a/solutions/images/security-hosts-detail-pg.png b/solutions/images/security-hosts-detail-pg.png new file mode 100644 index 0000000000..b883fdf85b Binary files /dev/null and b/solutions/images/security-hosts-detail-pg.png differ diff --git a/solutions/images/security-hosts-hr-data.png b/solutions/images/security-hosts-hr-data.png new file mode 100644 index 0000000000..a578265942 Binary files /dev/null and b/solutions/images/security-hosts-hr-data.png differ diff --git a/solutions/images/security-hosts-hr-level.png b/solutions/images/security-hosts-hr-level.png new file mode 100644 index 0000000000..b73d347653 Binary files /dev/null and b/solutions/images/security-hosts-hr-level.png differ diff --git a/solutions/images/security-hosts-ov-pg.png b/solutions/images/security-hosts-ov-pg.png new file mode 100644 index 0000000000..c234836f1c Binary files /dev/null and b/solutions/images/security-hosts-ov-pg.png differ diff --git a/solutions/images/security-hrl-sort-by-host-risk-score.png b/solutions/images/security-hrl-sort-by-host-risk-score.png new file mode 100644 index 0000000000..57ee2bbee1 Binary files /dev/null and b/solutions/images/security-hrl-sort-by-host-risk-score.png differ diff --git a/solutions/images/security-icon-add-note.png b/solutions/images/security-icon-add-note.png new file mode 100644 index 0000000000..b49eac2fe7 Binary files /dev/null and b/solutions/images/security-icon-add-note.png differ diff --git a/solutions/images/security-icon-add-to-case.png b/solutions/images/security-icon-add-to-case.png new file mode 100644 index 0000000000..cff67ff239 Binary files /dev/null and b/solutions/images/security-icon-add-to-case.png differ diff --git a/solutions/images/security-icon-add-to-timeline.png b/solutions/images/security-icon-add-to-timeline.png new file mode 100644 index 0000000000..c01802253c Binary files /dev/null and b/solutions/images/security-icon-add-to-timeline.png differ diff --git a/solutions/images/security-icon-copy.png b/solutions/images/security-icon-copy.png new file mode 100644 index 0000000000..e0a53121d9 Binary files /dev/null and b/solutions/images/security-icon-copy.png differ diff --git a/solutions/images/security-icon-settings.png b/solutions/images/security-icon-settings.png new file mode 100644 index 0000000000..ead584f046 Binary files /dev/null and b/solutions/images/security-icon-settings.png differ diff --git a/solutions/images/security-ig-alert-flyout-invest-tab.png b/solutions/images/security-ig-alert-flyout-invest-tab.png new file mode 100644 index 0000000000..b778699fb1 Binary files /dev/null and b/solutions/images/security-ig-alert-flyout-invest-tab.png differ diff --git a/solutions/images/security-ig-alert-flyout.png b/solutions/images/security-ig-alert-flyout.png new file mode 100644 index 0000000000..a7a8bbe744 Binary files /dev/null and b/solutions/images/security-ig-alert-flyout.png differ diff --git a/solutions/images/security-ig-error-icon.png b/solutions/images/security-ig-error-icon.png new file mode 100644 index 0000000000..5f1b93cec8 Binary files /dev/null and b/solutions/images/security-ig-error-icon.png differ diff --git a/solutions/images/security-ig-filters-field-custom-value.png b/solutions/images/security-ig-filters-field-custom-value.png new file mode 100644 index 0000000000..0c625298b0 Binary files /dev/null and b/solutions/images/security-ig-filters-field-custom-value.png differ diff --git a/solutions/images/security-ig-investigate-icon.png b/solutions/images/security-ig-investigate-icon.png new file mode 100644 index 0000000000..4d36b96fc6 Binary files /dev/null and b/solutions/images/security-ig-investigate-icon.png differ diff --git a/solutions/images/security-ig-investigation-guide-editor.png b/solutions/images/security-ig-investigation-guide-editor.png new file mode 100644 index 0000000000..0f299b3b03 Binary files /dev/null and b/solutions/images/security-ig-investigation-guide-editor.png differ diff --git a/solutions/images/security-ig-investigation-query-builder.png b/solutions/images/security-ig-investigation-query-builder.png new file mode 100644 index 0000000000..2e96df67d7 Binary files /dev/null and b/solutions/images/security-ig-investigation-query-builder.png differ diff --git a/solutions/images/security-ig-timeline-query.png b/solutions/images/security-ig-timeline-query.png new file mode 100644 index 0000000000..3999031407 Binary files /dev/null and b/solutions/images/security-ig-timeline-query.png differ diff --git a/solutions/images/security-ig-timeline-template-fields.png b/solutions/images/security-ig-timeline-template-fields.png new file mode 100644 index 0000000000..d0c7ee0f79 Binary files /dev/null and b/solutions/images/security-ig-timeline-template-fields.png differ diff --git a/solutions/images/security-ig-timeline.png b/solutions/images/security-ig-timeline.png new file mode 100644 index 0000000000..d5ad773504 Binary files /dev/null and b/solutions/images/security-ig-timeline.png differ diff --git a/solutions/images/security-indicator-added-to-case.png b/solutions/images/security-indicator-added-to-case.png new file mode 100644 index 0000000000..6b1f498c9b Binary files /dev/null and b/solutions/images/security-indicator-added-to-case.png differ diff --git a/solutions/images/security-indicator-details-flyout.png b/solutions/images/security-indicator-details-flyout.png new file mode 100644 index 0000000000..073a7f71ea Binary files /dev/null and b/solutions/images/security-indicator-details-flyout.png differ diff --git a/solutions/images/security-indicator-in-timeline.png b/solutions/images/security-indicator-in-timeline.png new file mode 100644 index 0000000000..f0e4e7043b Binary files /dev/null and b/solutions/images/security-indicator-in-timeline.png differ diff --git a/solutions/images/security-indicator-query-timeline.png b/solutions/images/security-indicator-query-timeline.png new file mode 100644 index 0000000000..cdb6128991 Binary files /dev/null and b/solutions/images/security-indicator-query-timeline.png differ diff --git a/solutions/images/security-indicator-rule-example.png b/solutions/images/security-indicator-rule-example.png new file mode 100644 index 0000000000..d30a7073e8 Binary files /dev/null and b/solutions/images/security-indicator-rule-example.png differ diff --git a/solutions/images/security-indicator_value_list.png b/solutions/images/security-indicator_value_list.png new file mode 100644 index 0000000000..bbc8f064eb Binary files /dev/null and b/solutions/images/security-indicator_value_list.png differ diff --git a/solutions/images/security-indicators-table.png b/solutions/images/security-indicators-table.png new file mode 100644 index 0000000000..3219eae6db Binary files /dev/null and b/solutions/images/security-indicators-table.png differ diff --git a/solutions/images/security-inline-actions-legend.png b/solutions/images/security-inline-actions-legend.png new file mode 100644 index 0000000000..b200691606 Binary files /dev/null and b/solutions/images/security-inline-actions-legend.png differ diff --git a/solutions/images/security-inline-actions-menu.png b/solutions/images/security-inline-actions-menu.png new file mode 100644 index 0000000000..5c4dff3d77 Binary files /dev/null and b/solutions/images/security-inline-actions-menu.png differ diff --git a/solutions/images/security-insights-section-rp.png b/solutions/images/security-insights-section-rp.png new file mode 100644 index 0000000000..f10cc70a72 Binary files /dev/null and b/solutions/images/security-insights-section-rp.png differ diff --git a/solutions/images/security-inspect-icon-context.png b/solutions/images/security-inspect-icon-context.png new file mode 100644 index 0000000000..d3eab264ce Binary files /dev/null and b/solutions/images/security-inspect-icon-context.png differ diff --git a/solutions/images/security-inspect-icon.png b/solutions/images/security-inspect-icon.png new file mode 100644 index 0000000000..90da4c23f1 Binary files /dev/null and b/solutions/images/security-inspect-icon.png differ diff --git a/solutions/images/security-integration-advanced-settings.png b/solutions/images/security-integration-advanced-settings.png new file mode 100644 index 0000000000..8d1fd38512 Binary files /dev/null and b/solutions/images/security-integration-advanced-settings.png differ diff --git a/solutions/images/security-integration-pg.png b/solutions/images/security-integration-pg.png new file mode 100644 index 0000000000..0388413b19 Binary files /dev/null and b/solutions/images/security-integration-pg.png differ diff --git a/solutions/images/security-interact-with-indicators-table.gif b/solutions/images/security-interact-with-indicators-table.gif new file mode 100644 index 0000000000..e98f0f8e10 Binary files /dev/null and b/solutions/images/security-interact-with-indicators-table.gif differ diff --git a/solutions/images/security-invalid-filter.png b/solutions/images/security-invalid-filter.png new file mode 100644 index 0000000000..ff0e5fba26 Binary files /dev/null and b/solutions/images/security-invalid-filter.png differ diff --git a/solutions/images/security-investigation-section-rp.png b/solutions/images/security-investigation-section-rp.png new file mode 100644 index 0000000000..c496593144 Binary files /dev/null and b/solutions/images/security-investigation-section-rp.png differ diff --git a/solutions/images/security-isolated-host.png b/solutions/images/security-isolated-host.png new file mode 100644 index 0000000000..de557e6562 Binary files /dev/null and b/solutions/images/security-isolated-host.png differ diff --git a/solutions/images/security-knowledge-base-add-index-config.png b/solutions/images/security-knowledge-base-add-index-config.png new file mode 100644 index 0000000000..3fcb91977b Binary files /dev/null and b/solutions/images/security-knowledge-base-add-index-config.png differ diff --git a/solutions/images/security-knowledge-base-assistant-menu-dropdown.png b/solutions/images/security-knowledge-base-assistant-menu-dropdown.png new file mode 100644 index 0000000000..785c79e75c Binary files /dev/null and b/solutions/images/security-knowledge-base-assistant-menu-dropdown.png differ diff --git a/solutions/images/security-knowledge-base-assistant-settings-kb-tab.png b/solutions/images/security-knowledge-base-assistant-settings-kb-tab.png new file mode 100644 index 0000000000..74c799dd39 Binary files /dev/null and b/solutions/images/security-knowledge-base-assistant-settings-kb-tab.png differ diff --git a/solutions/images/security-knowledge-base-assistant-setup-button.png b/solutions/images/security-knowledge-base-assistant-setup-button.png new file mode 100644 index 0000000000..d861ba361a Binary files /dev/null and b/solutions/images/security-knowledge-base-assistant-setup-button.png differ diff --git a/solutions/images/security-knowledge-base-rbac.png b/solutions/images/security-knowledge-base-rbac.png new file mode 100644 index 0000000000..84b950504b Binary files /dev/null and b/solutions/images/security-knowledge-base-rbac.png differ diff --git a/solutions/images/security-kspm-add-agent-wizard.png b/solutions/images/security-kspm-add-agent-wizard.png new file mode 100644 index 0000000000..d61fec7589 Binary files /dev/null and b/solutions/images/security-kspm-add-agent-wizard.png differ diff --git a/solutions/images/security-lens-button-osquery.png b/solutions/images/security-lens-button-osquery.png new file mode 100644 index 0000000000..92c79f0f20 Binary files /dev/null and b/solutions/images/security-lens-button-osquery.png differ diff --git a/solutions/images/security-live-feed-ov-page.png b/solutions/images/security-live-feed-ov-page.png new file mode 100644 index 0000000000..afc53301c1 Binary files /dev/null and b/solutions/images/security-live-feed-ov-page.png differ diff --git a/solutions/images/security-lms-cli-welcome.png b/solutions/images/security-lms-cli-welcome.png new file mode 100644 index 0000000000..af885b7588 Binary files /dev/null and b/solutions/images/security-lms-cli-welcome.png differ diff --git a/solutions/images/security-lms-custom-logs-config.png b/solutions/images/security-lms-custom-logs-config.png new file mode 100644 index 0000000000..35e82e89cd Binary files /dev/null and b/solutions/images/security-lms-custom-logs-config.png differ diff --git a/solutions/images/security-lms-edit-connector.png b/solutions/images/security-lms-edit-connector.png new file mode 100644 index 0000000000..6f23209e5d Binary files /dev/null and b/solutions/images/security-lms-edit-connector.png differ diff --git a/solutions/images/security-lms-model-select.png b/solutions/images/security-lms-model-select.png new file mode 100644 index 0000000000..38f6168d91 Binary files /dev/null and b/solutions/images/security-lms-model-select.png differ diff --git a/solutions/images/security-lms-ps-command.png b/solutions/images/security-lms-ps-command.png new file mode 100644 index 0000000000..570acd78f2 Binary files /dev/null and b/solutions/images/security-lms-ps-command.png differ diff --git a/solutions/images/security-lms-studio-arch-diagram.png b/solutions/images/security-lms-studio-arch-diagram.png new file mode 100644 index 0000000000..4b737bbb7c Binary files /dev/null and b/solutions/images/security-lms-studio-arch-diagram.png differ diff --git a/solutions/images/security-lms-studio-model-loaded-msg.png b/solutions/images/security-lms-studio-model-loaded-msg.png new file mode 100644 index 0000000000..0ec162e082 Binary files /dev/null and b/solutions/images/security-lms-studio-model-loaded-msg.png differ diff --git a/solutions/images/security-lock-button.png b/solutions/images/security-lock-button.png new file mode 100644 index 0000000000..316ea81909 Binary files /dev/null and b/solutions/images/security-lock-button.png differ diff --git a/solutions/images/security-malware-protection.png b/solutions/images/security-malware-protection.png new file mode 100644 index 0000000000..21f824edec Binary files /dev/null and b/solutions/images/security-malware-protection.png differ diff --git a/solutions/images/security-manage-default-rule-list.png b/solutions/images/security-manage-default-rule-list.png new file mode 100644 index 0000000000..1dc17856c4 Binary files /dev/null and b/solutions/images/security-manage-default-rule-list.png differ diff --git a/solutions/images/security-manage-value-list.png b/solutions/images/security-manage-value-list.png new file mode 100644 index 0000000000..7b65290ccf Binary files /dev/null and b/solutions/images/security-manage-value-list.png differ diff --git a/solutions/images/security-manual-rule-run-table.png b/solutions/images/security-manual-rule-run-table.png new file mode 100644 index 0000000000..ddacb233e2 Binary files /dev/null and b/solutions/images/security-manual-rule-run-table.png differ diff --git a/solutions/images/security-markdown-icon.png b/solutions/images/security-markdown-icon.png new file mode 100644 index 0000000000..b0f8c99433 Binary files /dev/null and b/solutions/images/security-markdown-icon.png differ diff --git a/solutions/images/security-memory-protection.png b/solutions/images/security-memory-protection.png new file mode 100644 index 0000000000..b5fae9f154 Binary files /dev/null and b/solutions/images/security-memory-protection.png differ diff --git a/solutions/images/security-ml-rule-threshold.png b/solutions/images/security-ml-rule-threshold.png new file mode 100644 index 0000000000..98b1beeeeb Binary files /dev/null and b/solutions/images/security-ml-rule-threshold.png differ diff --git a/solutions/images/security-ml-ui.png b/solutions/images/security-ml-ui.png new file mode 100644 index 0000000000..8c1df87db1 Binary files /dev/null and b/solutions/images/security-ml-ui.png differ diff --git a/solutions/images/security-monitor-table.png b/solutions/images/security-monitor-table.png new file mode 100644 index 0000000000..05cb4c3aa2 Binary files /dev/null and b/solutions/images/security-monitor-table.png differ diff --git a/solutions/images/security-nested-exp.png b/solutions/images/security-nested-exp.png new file mode 100644 index 0000000000..b403c0b464 Binary files /dev/null and b/solutions/images/security-nested-exp.png differ diff --git a/solutions/images/security-network-ui.png b/solutions/images/security-network-ui.png new file mode 100644 index 0000000000..558bb31b80 Binary files /dev/null and b/solutions/images/security-network-ui.png differ diff --git a/solutions/images/security-new-note-alert-event.png b/solutions/images/security-new-note-alert-event.png new file mode 100644 index 0000000000..33e47fd17e Binary files /dev/null and b/solutions/images/security-new-note-alert-event.png differ diff --git a/solutions/images/security-new-note-timeline-tab.png b/solutions/images/security-new-note-timeline-tab.png new file mode 100644 index 0000000000..72e9c36826 Binary files /dev/null and b/solutions/images/security-new-note-timeline-tab.png differ diff --git a/solutions/images/security-node-legend.png b/solutions/images/security-node-legend.png new file mode 100644 index 0000000000..0ba9bf6649 Binary files /dev/null and b/solutions/images/security-node-legend.png differ diff --git a/solutions/images/security-notes-management-page.png b/solutions/images/security-notes-management-page.png new file mode 100644 index 0000000000..78ee8f55bb Binary files /dev/null and b/solutions/images/security-notes-management-page.png differ diff --git a/solutions/images/security-notes-page-document-details.png b/solutions/images/security-notes-page-document-details.png new file mode 100644 index 0000000000..4070d1e3d0 Binary files /dev/null and b/solutions/images/security-notes-page-document-details.png differ diff --git a/solutions/images/security-notes-page-timeline-details.png b/solutions/images/security-notes-page-timeline-details.png new file mode 100644 index 0000000000..1c83c81df4 Binary files /dev/null and b/solutions/images/security-notes-page-timeline-details.png differ diff --git a/solutions/images/security-notes-tab-lp.png b/solutions/images/security-notes-tab-lp.png new file mode 100644 index 0000000000..e277a109f7 Binary files /dev/null and b/solutions/images/security-notes-tab-lp.png differ diff --git a/solutions/images/security-notifications-jamf.png b/solutions/images/security-notifications-jamf.png new file mode 100644 index 0000000000..a4b329396d Binary files /dev/null and b/solutions/images/security-notifications-jamf.png differ diff --git a/solutions/images/security-offline-adv-settings.png b/solutions/images/security-offline-adv-settings.png new file mode 100644 index 0000000000..61223b7047 Binary files /dev/null and b/solutions/images/security-offline-adv-settings.png differ diff --git a/solutions/images/security-offline-endpoint-version-discover.png b/solutions/images/security-offline-endpoint-version-discover.png new file mode 100644 index 0000000000..482e48b32f Binary files /dev/null and b/solutions/images/security-offline-endpoint-version-discover.png differ diff --git a/solutions/images/security-open-alert-details-flyout.gif b/solutions/images/security-open-alert-details-flyout.gif new file mode 100644 index 0000000000..29a156e35c Binary files /dev/null and b/solutions/images/security-open-alert-details-flyout.gif differ diff --git a/solutions/images/security-osquery-button.png b/solutions/images/security-osquery-button.png new file mode 100644 index 0000000000..bee81e5cd2 Binary files /dev/null and b/solutions/images/security-osquery-button.png differ diff --git a/solutions/images/security-osquery-investigation-guide.png b/solutions/images/security-osquery-investigation-guide.png new file mode 100644 index 0000000000..c4353856c6 Binary files /dev/null and b/solutions/images/security-osquery-investigation-guide.png differ diff --git a/solutions/images/security-osquery-results-tab.png b/solutions/images/security-osquery-results-tab.png new file mode 100644 index 0000000000..92d4b8edcd Binary files /dev/null and b/solutions/images/security-osquery-results-tab.png differ diff --git a/solutions/images/security-overview-pg.png b/solutions/images/security-overview-pg.png new file mode 100644 index 0000000000..f841dfe457 Binary files /dev/null and b/solutions/images/security-overview-pg.png differ diff --git a/solutions/images/security-pack-expand-button-osquery.png b/solutions/images/security-pack-expand-button-osquery.png new file mode 100644 index 0000000000..11e2015640 Binary files /dev/null and b/solutions/images/security-pack-expand-button-osquery.png differ diff --git a/solutions/images/security-pack-query-results.png b/solutions/images/security-pack-query-results.png new file mode 100644 index 0000000000..0baa9162d4 Binary files /dev/null and b/solutions/images/security-pack-query-results.png differ diff --git a/solutions/images/security-pencil-icon.png b/solutions/images/security-pencil-icon.png new file mode 100644 index 0000000000..b6d659fbff Binary files /dev/null and b/solutions/images/security-pencil-icon.png differ diff --git a/solutions/images/security-policy-list.png b/solutions/images/security-policy-list.png new file mode 100644 index 0000000000..698cc59ca3 Binary files /dev/null and b/solutions/images/security-policy-list.png differ diff --git a/solutions/images/security-prebuilt-rules-add-badge.png b/solutions/images/security-prebuilt-rules-add-badge.png new file mode 100644 index 0000000000..d82a3f2d39 Binary files /dev/null and b/solutions/images/security-prebuilt-rules-add-badge.png differ diff --git a/solutions/images/security-prebuilt-rules-add.png b/solutions/images/security-prebuilt-rules-add.png new file mode 100644 index 0000000000..ec7993aa03 Binary files /dev/null and b/solutions/images/security-prebuilt-rules-add.png differ diff --git a/solutions/images/security-prebuilt-rules-update-diff.png b/solutions/images/security-prebuilt-rules-update-diff.png new file mode 100644 index 0000000000..07bd15ab9d Binary files /dev/null and b/solutions/images/security-prebuilt-rules-update-diff.png differ diff --git a/solutions/images/security-prebuilt-rules-update.png b/solutions/images/security-prebuilt-rules-update.png new file mode 100644 index 0000000000..ade5071b55 Binary files /dev/null and b/solutions/images/security-prebuilt-rules-update.png differ diff --git a/solutions/images/security-preview-risky-entities.png b/solutions/images/security-preview-risky-entities.png new file mode 100644 index 0000000000..ce345d40e4 Binary files /dev/null and b/solutions/images/security-preview-risky-entities.png differ diff --git a/solutions/images/security-preview-rule.png b/solutions/images/security-preview-rule.png new file mode 100644 index 0000000000..97c0a1aadc Binary files /dev/null and b/solutions/images/security-preview-rule.png differ diff --git a/solutions/images/security-privacy_security_ven.png b/solutions/images/security-privacy_security_ven.png new file mode 100644 index 0000000000..f73012cfa6 Binary files /dev/null and b/solutions/images/security-privacy_security_ven.png differ diff --git a/solutions/images/security-process-details.png b/solutions/images/security-process-details.png new file mode 100644 index 0000000000..c8b92c81be Binary files /dev/null and b/solutions/images/security-process-details.png differ diff --git a/solutions/images/security-process-exception.png b/solutions/images/security-process-exception.png new file mode 100644 index 0000000000..a3a14fe25a Binary files /dev/null and b/solutions/images/security-process-exception.png differ diff --git a/solutions/images/security-process-list.png b/solutions/images/security-process-list.png new file mode 100644 index 0000000000..105d723d5f Binary files /dev/null and b/solutions/images/security-process-list.png differ diff --git a/solutions/images/security-process-schema.png b/solutions/images/security-process-schema.png new file mode 100644 index 0000000000..85d393d0c9 Binary files /dev/null and b/solutions/images/security-process-schema.png differ diff --git a/solutions/images/security-process-specific-exception.png b/solutions/images/security-process-specific-exception.png new file mode 100644 index 0000000000..b161543958 Binary files /dev/null and b/solutions/images/security-process-specific-exception.png differ diff --git a/solutions/images/security-query-builder-button.png b/solutions/images/security-query-builder-button.png new file mode 100644 index 0000000000..28b020f4a8 Binary files /dev/null and b/solutions/images/security-query-builder-button.png differ diff --git a/solutions/images/security-quick-prompts.png b/solutions/images/security-quick-prompts.png new file mode 100644 index 0000000000..55d6ad2f24 Binary files /dev/null and b/solutions/images/security-quick-prompts.png differ diff --git a/solutions/images/security-ransomware-protection.png b/solutions/images/security-ransomware-protection.png new file mode 100644 index 0000000000..824194f19b Binary files /dev/null and b/solutions/images/security-ransomware-protection.png differ diff --git a/solutions/images/security-red-x-icon.png b/solutions/images/security-red-x-icon.png new file mode 100644 index 0000000000..85b1fdb479 Binary files /dev/null and b/solutions/images/security-red-x-icon.png differ diff --git a/solutions/images/security-register-as-antivirus.png b/solutions/images/security-register-as-antivirus.png new file mode 100644 index 0000000000..61fb3d2fa6 Binary files /dev/null and b/solutions/images/security-register-as-antivirus.png differ diff --git a/solutions/images/security-remove-field-button.png b/solutions/images/security-remove-field-button.png new file mode 100644 index 0000000000..f5e272fe8a Binary files /dev/null and b/solutions/images/security-remove-field-button.png differ diff --git a/solutions/images/security-remove-indicator.png b/solutions/images/security-remove-indicator.png new file mode 100644 index 0000000000..f13242992c Binary files /dev/null and b/solutions/images/security-remove-indicator.png differ diff --git a/solutions/images/security-remove-value-list-item.png b/solutions/images/security-remove-value-list-item.png new file mode 100644 index 0000000000..7f998809a7 Binary files /dev/null and b/solutions/images/security-remove-value-list-item.png differ diff --git a/solutions/images/security-remove-value-list.png b/solutions/images/security-remove-value-list.png new file mode 100644 index 0000000000..b8fbd49bdf Binary files /dev/null and b/solutions/images/security-remove-value-list.png differ diff --git a/solutions/images/security-response-action-rp.png b/solutions/images/security-response-action-rp.png new file mode 100644 index 0000000000..03bac21042 Binary files /dev/null and b/solutions/images/security-response-action-rp.png differ diff --git a/solutions/images/security-response-actions-history-console.png b/solutions/images/security-response-actions-history-console.png new file mode 100644 index 0000000000..9191f62836 Binary files /dev/null and b/solutions/images/security-response-actions-history-console.png differ diff --git a/solutions/images/security-response-actions-history-endpoint-details.png b/solutions/images/security-response-actions-history-endpoint-details.png new file mode 100644 index 0000000000..531796532a Binary files /dev/null and b/solutions/images/security-response-actions-history-endpoint-details.png differ diff --git a/solutions/images/security-response-actions-history-page.png b/solutions/images/security-response-actions-history-page.png new file mode 100644 index 0000000000..2203ea9209 Binary files /dev/null and b/solutions/images/security-response-actions-history-page.png differ diff --git a/solutions/images/security-response-console-help-panel.png b/solutions/images/security-response-console-help-panel.png new file mode 100644 index 0000000000..bc62d8c1ce Binary files /dev/null and b/solutions/images/security-response-console-help-panel.png differ diff --git a/solutions/images/security-response-console-unsupported-command.png b/solutions/images/security-response-console-unsupported-command.png new file mode 100644 index 0000000000..14105cb21d Binary files /dev/null and b/solutions/images/security-response-console-unsupported-command.png differ diff --git a/solutions/images/security-response-console.png b/solutions/images/security-response-console.png new file mode 100644 index 0000000000..4ed2ce27a0 Binary files /dev/null and b/solutions/images/security-response-console.png differ diff --git a/solutions/images/security-risk-engine-upgrade-prompt.png b/solutions/images/security-risk-engine-upgrade-prompt.png new file mode 100644 index 0000000000..ef5282c3ca Binary files /dev/null and b/solutions/images/security-risk-engine-upgrade-prompt.png differ diff --git a/solutions/images/security-risk-score-start-update.png b/solutions/images/security-risk-score-start-update.png new file mode 100644 index 0000000000..71783c6eaf Binary files /dev/null and b/solutions/images/security-risk-score-start-update.png differ diff --git a/solutions/images/security-risk-source-field-ui.png b/solutions/images/security-risk-source-field-ui.png new file mode 100644 index 0000000000..3d83e00956 Binary files /dev/null and b/solutions/images/security-risk-source-field-ui.png differ diff --git a/solutions/images/security-risk-summary.png b/solutions/images/security-risk-summary.png new file mode 100644 index 0000000000..0389dade2e Binary files /dev/null and b/solutions/images/security-risk-summary.png differ diff --git a/solutions/images/security-rule-details-page.png b/solutions/images/security-rule-details-page.png new file mode 100644 index 0000000000..ad6deeb6fe Binary files /dev/null and b/solutions/images/security-rule-details-page.png differ diff --git a/solutions/images/security-rule-details-prerequisites.png b/solutions/images/security-rule-details-prerequisites.png new file mode 100644 index 0000000000..3579ac86c2 Binary files /dev/null and b/solutions/images/security-rule-details-prerequisites.png differ diff --git a/solutions/images/security-rule-exception-tab.png b/solutions/images/security-rule-exception-tab.png new file mode 100644 index 0000000000..e3eb5dc8d3 Binary files /dev/null and b/solutions/images/security-rule-exception-tab.png differ diff --git a/solutions/images/security-rule-exceptions-page.png b/solutions/images/security-rule-exceptions-page.png new file mode 100644 index 0000000000..912feec301 Binary files /dev/null and b/solutions/images/security-rule-exceptions-page.png differ diff --git a/solutions/images/security-rule-execution-logs.png b/solutions/images/security-rule-execution-logs.png new file mode 100644 index 0000000000..b3d73f048e Binary files /dev/null and b/solutions/images/security-rule-execution-logs.png differ diff --git a/solutions/images/security-rule-monitoring-overview.png b/solutions/images/security-rule-monitoring-overview.png new file mode 100644 index 0000000000..abd18e1458 Binary files /dev/null and b/solutions/images/security-rule-monitoring-overview.png differ diff --git a/solutions/images/security-rule-preview-refresh-arrow.png b/solutions/images/security-rule-preview-refresh-arrow.png new file mode 100644 index 0000000000..4fc2d09a89 Binary files /dev/null and b/solutions/images/security-rule-preview-refresh-arrow.png differ diff --git a/solutions/images/security-rule-preview-refresh-circle.png b/solutions/images/security-rule-preview-refresh-circle.png new file mode 100644 index 0000000000..08d4fb38ca Binary files /dev/null and b/solutions/images/security-rule-preview-refresh-circle.png differ diff --git a/solutions/images/security-rule-query-example.png b/solutions/images/security-rule-query-example.png new file mode 100644 index 0000000000..e712564873 Binary files /dev/null and b/solutions/images/security-rule-query-example.png differ diff --git a/solutions/images/security-rule-scope.png b/solutions/images/security-rule-scope.png new file mode 100644 index 0000000000..5179ea992d Binary files /dev/null and b/solutions/images/security-rule-scope.png differ diff --git a/solutions/images/security-rule-snoozing.png b/solutions/images/security-rule-snoozing.png new file mode 100644 index 0000000000..8edd67978f Binary files /dev/null and b/solutions/images/security-rule-snoozing.png differ diff --git a/solutions/images/security-rules-coverage.png b/solutions/images/security-rules-coverage.png new file mode 100644 index 0000000000..b446481ae6 Binary files /dev/null and b/solutions/images/security-rules-coverage.png differ diff --git a/solutions/images/security-rules-table-error-icon.png b/solutions/images/security-rules-table-error-icon.png new file mode 100644 index 0000000000..9214b4d58b Binary files /dev/null and b/solutions/images/security-rules-table-error-icon.png differ diff --git a/solutions/images/security-rules-table-ml-job-error.png b/solutions/images/security-rules-table-ml-job-error.png new file mode 100644 index 0000000000..7244e784e3 Binary files /dev/null and b/solutions/images/security-rules-table-ml-job-error.png differ diff --git a/solutions/images/security-rules-table-related-integrations.png b/solutions/images/security-rules-table-related-integrations.png new file mode 100644 index 0000000000..d79e6ddd3f Binary files /dev/null and b/solutions/images/security-rules-table-related-integrations.png differ diff --git a/solutions/images/security-rules-ts-ml-job-stopped.png b/solutions/images/security-rules-ts-ml-job-stopped.png new file mode 100644 index 0000000000..7fba6ed8f9 Binary files /dev/null and b/solutions/images/security-rules-ts-ml-job-stopped.png differ diff --git a/solutions/images/security-run-query-investigation-guide.png b/solutions/images/security-run-query-investigation-guide.png new file mode 100644 index 0000000000..8dcd0547d3 Binary files /dev/null and b/solutions/images/security-run-query-investigation-guide.png differ diff --git a/solutions/images/security-save-icon-blue.png b/solutions/images/security-save-icon-blue.png new file mode 100644 index 0000000000..7b7d113091 Binary files /dev/null and b/solutions/images/security-save-icon-blue.png differ diff --git a/solutions/images/security-save-value-list-item-changes.png b/solutions/images/security-save-value-list-item-changes.png new file mode 100644 index 0000000000..6316485e97 Binary files /dev/null and b/solutions/images/security-save-value-list-item-changes.png differ diff --git a/solutions/images/security-saved-query-menu-icon.png b/solutions/images/security-saved-query-menu-icon.png new file mode 100644 index 0000000000..7fba782e1c Binary files /dev/null and b/solutions/images/security-saved-query-menu-icon.png differ diff --git a/solutions/images/security-saved-query-menu.png b/solutions/images/security-saved-query-menu.png new file mode 100644 index 0000000000..7fba782e1c Binary files /dev/null and b/solutions/images/security-saved-query-menu.png differ diff --git a/solutions/images/security-schedule-rule.png b/solutions/images/security-schedule-rule.png new file mode 100644 index 0000000000..1a856cac48 Binary files /dev/null and b/solutions/images/security-schedule-rule.png differ diff --git a/solutions/images/security-search-bar.png b/solutions/images/security-search-bar.png new file mode 100644 index 0000000000..81c8d0900c Binary files /dev/null and b/solutions/images/security-search-bar.png differ diff --git a/solutions/images/security-sec-privacy-pane.png b/solutions/images/security-sec-privacy-pane.png new file mode 100644 index 0000000000..5da2e7dc5d Binary files /dev/null and b/solutions/images/security-sec-privacy-pane.png differ diff --git a/solutions/images/security-select-endpoint-ext.png b/solutions/images/security-select-endpoint-ext.png new file mode 100644 index 0000000000..d674734f50 Binary files /dev/null and b/solutions/images/security-select-endpoint-ext.png differ diff --git a/solutions/images/security-select-fda.png b/solutions/images/security-select-fda.png new file mode 100644 index 0000000000..329bc9e11c Binary files /dev/null and b/solutions/images/security-select-fda.png differ diff --git a/solutions/images/security-select_fda_ven.png b/solutions/images/security-select_fda_ven.png new file mode 100644 index 0000000000..05057237c5 Binary files /dev/null and b/solutions/images/security-select_fda_ven.png differ diff --git a/solutions/images/security-selected-action-type.png b/solutions/images/security-selected-action-type.png new file mode 100644 index 0000000000..1f4065cbf3 Binary files /dev/null and b/solutions/images/security-selected-action-type.png differ diff --git a/solutions/images/security-sess-view-file-alert-icon.png b/solutions/images/security-sess-view-file-alert-icon.png new file mode 100644 index 0000000000..6310b939eb Binary files /dev/null and b/solutions/images/security-sess-view-file-alert-icon.png differ diff --git a/solutions/images/security-sess-view-network-alert-icon.png b/solutions/images/security-sess-view-network-alert-icon.png new file mode 100644 index 0000000000..78a480ebd1 Binary files /dev/null and b/solutions/images/security-sess-view-network-alert-icon.png differ diff --git a/solutions/images/security-sess-view-process-alert-icon.png b/solutions/images/security-sess-view-process-alert-icon.png new file mode 100644 index 0000000000..3530e8dd1a Binary files /dev/null and b/solutions/images/security-sess-view-process-alert-icon.png differ diff --git a/solutions/images/security-session-view-action-icon-detail.png b/solutions/images/security-session-view-action-icon-detail.png new file mode 100644 index 0000000000..4646f7e454 Binary files /dev/null and b/solutions/images/security-session-view-action-icon-detail.png differ diff --git a/solutions/images/security-session-view-alert-types-badge.png b/solutions/images/security-session-view-alert-types-badge.png new file mode 100644 index 0000000000..569d038dc4 Binary files /dev/null and b/solutions/images/security-session-view-alert-types-badge.png differ diff --git a/solutions/images/security-session-view-exec-user-change-badge.png b/solutions/images/security-session-view-exec-user-change-badge.png new file mode 100644 index 0000000000..2247f6a16c Binary files /dev/null and b/solutions/images/security-session-view-exec-user-change-badge.png differ diff --git a/solutions/images/security-session-view-output-badge.png b/solutions/images/security-session-view-output-badge.png new file mode 100644 index 0000000000..8d2c3cd6d2 Binary files /dev/null and b/solutions/images/security-session-view-output-badge.png differ diff --git a/solutions/images/security-session-view-output-viewer.png b/solutions/images/security-session-view-output-viewer.png new file mode 100644 index 0000000000..fce6b0630d Binary files /dev/null and b/solutions/images/security-session-view-output-viewer.png differ diff --git a/solutions/images/security-session-view-terminal-labeled.png b/solutions/images/security-session-view-terminal-labeled.png new file mode 100644 index 0000000000..43c3554d9b Binary files /dev/null and b/solutions/images/security-session-view-terminal-labeled.png differ diff --git a/solutions/images/security-setup-osquery-investigation-guide.png b/solutions/images/security-setup-osquery-investigation-guide.png new file mode 100644 index 0000000000..d244d8e9a0 Binary files /dev/null and b/solutions/images/security-setup-osquery-investigation-guide.png differ diff --git a/solutions/images/security-setup-query.png b/solutions/images/security-setup-query.png new file mode 100644 index 0000000000..245a9f95ae Binary files /dev/null and b/solutions/images/security-setup-query.png differ diff --git a/solutions/images/security-setup-single-query.png b/solutions/images/security-setup-single-query.png new file mode 100644 index 0000000000..c8e2badcbe Binary files /dev/null and b/solutions/images/security-setup-single-query.png differ diff --git a/solutions/images/security-severity-mapping-ui.png b/solutions/images/security-severity-mapping-ui.png new file mode 100644 index 0000000000..9d65e46de2 Binary files /dev/null and b/solutions/images/security-severity-mapping-ui.png differ diff --git a/solutions/images/security-share-alert.png b/solutions/images/security-share-alert.png new file mode 100644 index 0000000000..c4f69cfaf9 Binary files /dev/null and b/solutions/images/security-share-alert.png differ diff --git a/solutions/images/security-side-button.png b/solutions/images/security-side-button.png new file mode 100644 index 0000000000..08cf2a39f3 Binary files /dev/null and b/solutions/images/security-side-button.png differ diff --git a/solutions/images/security-single-query-results.png b/solutions/images/security-single-query-results.png new file mode 100644 index 0000000000..e0bc6f3768 Binary files /dev/null and b/solutions/images/security-single-query-results.png differ diff --git a/solutions/images/security-solution-advanced-settings.png b/solutions/images/security-solution-advanced-settings.png new file mode 100644 index 0000000000..3a2a3c6559 Binary files /dev/null and b/solutions/images/security-solution-advanced-settings.png differ diff --git a/solutions/images/security-start-job-window.png b/solutions/images/security-start-job-window.png new file mode 100644 index 0000000000..12c63d0be6 Binary files /dev/null and b/solutions/images/security-start-job-window.png differ diff --git a/solutions/images/security-suppressed-alerts-details.png b/solutions/images/security-suppressed-alerts-details.png new file mode 100644 index 0000000000..e13ccf34c3 Binary files /dev/null and b/solutions/images/security-suppressed-alerts-details.png differ diff --git a/solutions/images/security-suppressed-alerts-table-column.png b/solutions/images/security-suppressed-alerts-table-column.png new file mode 100644 index 0000000000..e78222217d Binary files /dev/null and b/solutions/images/security-suppressed-alerts-table-column.png differ diff --git a/solutions/images/security-suppressed-alerts-table.png b/solutions/images/security-suppressed-alerts-table.png new file mode 100644 index 0000000000..845f9f2e3a Binary files /dev/null and b/solutions/images/security-suppressed-alerts-table.png differ diff --git a/solutions/images/security-system-ext-blocked.png b/solutions/images/security-system-ext-blocked.png new file mode 100644 index 0000000000..eede5dc20c Binary files /dev/null and b/solutions/images/security-system-ext-blocked.png differ diff --git a/solutions/images/security-system-extension-jamf.png b/solutions/images/security-system-extension-jamf.png new file mode 100644 index 0000000000..25175582a1 Binary files /dev/null and b/solutions/images/security-system-extension-jamf.png differ diff --git a/solutions/images/security-system_extension_blocked_warning_ven.png b/solutions/images/security-system_extension_blocked_warning_ven.png new file mode 100644 index 0000000000..05c472aeb4 Binary files /dev/null and b/solutions/images/security-system_extension_blocked_warning_ven.png differ diff --git a/solutions/images/security-template-filter-value.png b/solutions/images/security-template-filter-value.png new file mode 100644 index 0000000000..1a9c7c1241 Binary files /dev/null and b/solutions/images/security-template-filter-value.png differ diff --git a/solutions/images/security-template-query-example.png b/solutions/images/security-template-query-example.png new file mode 100644 index 0000000000..80b305487a Binary files /dev/null and b/solutions/images/security-template-query-example.png differ diff --git a/solutions/images/security-threat-intelligence-overview.png b/solutions/images/security-threat-intelligence-overview.png new file mode 100644 index 0000000000..af44623035 Binary files /dev/null and b/solutions/images/security-threat-intelligence-overview.png differ diff --git a/solutions/images/security-threat-intelligence-view.png b/solutions/images/security-threat-intelligence-view.png new file mode 100644 index 0000000000..32bc70d5df Binary files /dev/null and b/solutions/images/security-threat-intelligence-view.png differ diff --git a/solutions/images/security-three-dot-icon-blue.png b/solutions/images/security-three-dot-icon-blue.png new file mode 100644 index 0000000000..ffd665bb61 Binary files /dev/null and b/solutions/images/security-three-dot-icon-blue.png differ diff --git a/solutions/images/security-three-dot-icon-vertical.png b/solutions/images/security-three-dot-icon-vertical.png new file mode 100644 index 0000000000..52558cfba5 Binary files /dev/null and b/solutions/images/security-three-dot-icon-vertical.png differ diff --git a/solutions/images/security-three-dot-icon.png b/solutions/images/security-three-dot-icon.png new file mode 100644 index 0000000000..2f106edb7c Binary files /dev/null and b/solutions/images/security-three-dot-icon.png differ diff --git a/solutions/images/security-timeline-accessiblity-directional-arrows.gif b/solutions/images/security-timeline-accessiblity-directional-arrows.gif new file mode 100644 index 0000000000..aaafe8ced0 Binary files /dev/null and b/solutions/images/security-timeline-accessiblity-directional-arrows.gif differ diff --git a/solutions/images/security-timeline-accessiblity-event-renderers.gif b/solutions/images/security-timeline-accessiblity-event-renderers.gif new file mode 100644 index 0000000000..b5ca37ad50 Binary files /dev/null and b/solutions/images/security-timeline-accessiblity-event-renderers.gif differ diff --git a/solutions/images/security-timeline-accessiblity-keyboard-focus-hotkeys.gif b/solutions/images/security-timeline-accessiblity-keyboard-focus-hotkeys.gif new file mode 100644 index 0000000000..61262111d9 Binary files /dev/null and b/solutions/images/security-timeline-accessiblity-keyboard-focus-hotkeys.gif differ diff --git a/solutions/images/security-timeline-accessiblity-keyboard-focus.gif b/solutions/images/security-timeline-accessiblity-keyboard-focus.gif new file mode 100644 index 0000000000..81b5a39d3c Binary files /dev/null and b/solutions/images/security-timeline-accessiblity-keyboard-focus.gif differ diff --git a/solutions/images/security-timeline-accessiblity-page-up-n-down.gif b/solutions/images/security-timeline-accessiblity-page-up-n-down.gif new file mode 100644 index 0000000000..95499374bc Binary files /dev/null and b/solutions/images/security-timeline-accessiblity-page-up-n-down.gif differ diff --git a/solutions/images/security-timeline-accessiblity-shifting-keyboard-focus.gif b/solutions/images/security-timeline-accessiblity-shifting-keyboard-focus.gif new file mode 100644 index 0000000000..e9728f4c34 Binary files /dev/null and b/solutions/images/security-timeline-accessiblity-shifting-keyboard-focus.gif differ diff --git a/solutions/images/security-timeline-accessiblity-tab-keys.gif b/solutions/images/security-timeline-accessiblity-tab-keys.gif new file mode 100644 index 0000000000..f68699f489 Binary files /dev/null and b/solutions/images/security-timeline-accessiblity-tab-keys.gif differ diff --git a/solutions/images/security-timeline-button-osquery.png b/solutions/images/security-timeline-button-osquery.png new file mode 100644 index 0000000000..61186c09eb Binary files /dev/null and b/solutions/images/security-timeline-button-osquery.png differ diff --git a/solutions/images/security-timeline-button.png b/solutions/images/security-timeline-button.png new file mode 100644 index 0000000000..3fc4ef7d22 Binary files /dev/null and b/solutions/images/security-timeline-button.png differ diff --git a/solutions/images/security-timeline-disable-filter.png b/solutions/images/security-timeline-disable-filter.png new file mode 100644 index 0000000000..9a73b5b87c Binary files /dev/null and b/solutions/images/security-timeline-disable-filter.png differ diff --git a/solutions/images/security-timeline-field-exists.png b/solutions/images/security-timeline-field-exists.png new file mode 100644 index 0000000000..c78c054156 Binary files /dev/null and b/solutions/images/security-timeline-field-exists.png differ diff --git a/solutions/images/security-timeline-filter-exclude.png b/solutions/images/security-timeline-filter-exclude.png new file mode 100644 index 0000000000..8df9ee8512 Binary files /dev/null and b/solutions/images/security-timeline-filter-exclude.png differ diff --git a/solutions/images/security-timeline-filter-value.png b/solutions/images/security-timeline-filter-value.png new file mode 100644 index 0000000000..7e51f9041a Binary files /dev/null and b/solutions/images/security-timeline-filter-value.png differ diff --git a/solutions/images/security-timeline-sidebar.png b/solutions/images/security-timeline-sidebar.png new file mode 100644 index 0000000000..76d45ff77a Binary files /dev/null and b/solutions/images/security-timeline-sidebar.png differ diff --git a/solutions/images/security-timeline-template-filter.png b/solutions/images/security-timeline-template-filter.png new file mode 100644 index 0000000000..0bf39ffa8a Binary files /dev/null and b/solutions/images/security-timeline-template-filter.png differ diff --git a/solutions/images/security-timeline-ui-accessiblity-drag-n-drop.gif b/solutions/images/security-timeline-ui-accessiblity-drag-n-drop.gif new file mode 100644 index 0000000000..ad71c29f6e Binary files /dev/null and b/solutions/images/security-timeline-ui-accessiblity-drag-n-drop.gif differ diff --git a/solutions/images/security-timeline-ui-filter-options.png b/solutions/images/security-timeline-ui-filter-options.png new file mode 100644 index 0000000000..e3aeddcec9 Binary files /dev/null and b/solutions/images/security-timeline-ui-filter-options.png differ diff --git a/solutions/images/security-timeline-ui-renderer.png b/solutions/images/security-timeline-ui-renderer.png new file mode 100644 index 0000000000..207d5e5ccb Binary files /dev/null and b/solutions/images/security-timeline-ui-renderer.png differ diff --git a/solutions/images/security-timeline-ui-updated.png b/solutions/images/security-timeline-ui-updated.png new file mode 100644 index 0000000000..63450436cd Binary files /dev/null and b/solutions/images/security-timeline-ui-updated.png differ diff --git a/solutions/images/security-treemap-click.gif b/solutions/images/security-treemap-click.gif new file mode 100644 index 0000000000..bb5b96dac4 Binary files /dev/null and b/solutions/images/security-treemap-click.gif differ diff --git a/solutions/images/security-trusted-apps-list.png b/solutions/images/security-trusted-apps-list.png new file mode 100644 index 0000000000..828f6e85ea Binary files /dev/null and b/solutions/images/security-trusted-apps-list.png differ diff --git a/solutions/images/security-turn-on-risk-engine.png b/solutions/images/security-turn-on-risk-engine.png new file mode 100644 index 0000000000..4bc05a67e0 Binary files /dev/null and b/solutions/images/security-turn-on-risk-engine.png differ diff --git a/solutions/images/security-upload-lists-ui.png b/solutions/images/security-upload-lists-ui.png new file mode 100644 index 0000000000..37554f0e40 Binary files /dev/null and b/solutions/images/security-upload-lists-ui.png differ diff --git a/solutions/images/security-user-asset-criticality.png b/solutions/images/security-user-asset-criticality.png new file mode 100644 index 0000000000..72e4e34ca1 Binary files /dev/null and b/solutions/images/security-user-asset-criticality.png differ diff --git a/solutions/images/security-user-details-flyout.png b/solutions/images/security-user-details-flyout.png new file mode 100644 index 0000000000..e87d8a9614 Binary files /dev/null and b/solutions/images/security-user-details-flyout.png differ diff --git a/solutions/images/security-user-details-pg.png b/solutions/images/security-user-details-pg.png new file mode 100644 index 0000000000..f26432f08d Binary files /dev/null and b/solutions/images/security-user-details-pg.png differ diff --git a/solutions/images/security-user-observed-data.png b/solutions/images/security-user-observed-data.png new file mode 100644 index 0000000000..0f2ec3f9f4 Binary files /dev/null and b/solutions/images/security-user-observed-data.png differ diff --git a/solutions/images/security-user-risk-inputs.png b/solutions/images/security-user-risk-inputs.png new file mode 100644 index 0000000000..f6ec9c0ce6 Binary files /dev/null and b/solutions/images/security-user-risk-inputs.png differ diff --git a/solutions/images/security-user-score-data.png b/solutions/images/security-user-score-data.png new file mode 100644 index 0000000000..ec5edf06a0 Binary files /dev/null and b/solutions/images/security-user-score-data.png differ diff --git a/solutions/images/security-users-page.png b/solutions/images/security-users-page.png new file mode 100644 index 0000000000..c7028ebbd7 Binary files /dev/null and b/solutions/images/security-users-page.png differ diff --git a/solutions/images/security-verify_fed_granted_ven.png b/solutions/images/security-verify_fed_granted_ven.png new file mode 100644 index 0000000000..56abac61a2 Binary files /dev/null and b/solutions/images/security-verify_fed_granted_ven.png differ diff --git a/solutions/images/security-view-alert-details.png b/solutions/images/security-view-alert-details.png new file mode 100644 index 0000000000..b777b0d25b Binary files /dev/null and b/solutions/images/security-view-alert-details.png differ diff --git a/solutions/images/security-view-details-icon.png b/solutions/images/security-view-details-icon.png new file mode 100644 index 0000000000..9a0d5faadd Binary files /dev/null and b/solutions/images/security-view-details-icon.png differ diff --git a/solutions/images/security-view-filter-shared-exception.png b/solutions/images/security-view-filter-shared-exception.png new file mode 100644 index 0000000000..199026d8d2 Binary files /dev/null and b/solutions/images/security-view-filter-shared-exception.png differ diff --git a/solutions/images/security-view-osquery-details.png b/solutions/images/security-view-osquery-details.png new file mode 100644 index 0000000000..3dc0daca5a Binary files /dev/null and b/solutions/images/security-view-osquery-details.png differ diff --git a/solutions/images/security-visualizations-section-rp.png b/solutions/images/security-visualizations-section-rp.png new file mode 100644 index 0000000000..783bd302d0 Binary files /dev/null and b/solutions/images/security-visualizations-section-rp.png differ diff --git a/solutions/images/security-visualize-tab-lp-alert-details.gif b/solutions/images/security-visualize-tab-lp-alert-details.gif new file mode 100644 index 0000000000..487f87c74a Binary files /dev/null and b/solutions/images/security-visualize-tab-lp-alert-details.gif differ diff --git a/solutions/images/security-visualize-tab-lp.png b/solutions/images/security-visualize-tab-lp.png new file mode 100644 index 0000000000..a65151a658 Binary files /dev/null and b/solutions/images/security-visualize-tab-lp.png differ diff --git a/solutions/images/security-viz-options-menu-open.png b/solutions/images/security-viz-options-menu-open.png new file mode 100644 index 0000000000..9fa319d1d9 Binary files /dev/null and b/solutions/images/security-viz-options-menu-open.png differ diff --git a/solutions/images/security-vuln-management-dashboard.png b/solutions/images/security-vuln-management-dashboard.png new file mode 100644 index 0000000000..063312fc0f Binary files /dev/null and b/solutions/images/security-vuln-management-dashboard.png differ diff --git a/solutions/images/security-wiz-config-finding-logs.png b/solutions/images/security-wiz-config-finding-logs.png new file mode 100644 index 0000000000..26043a862d Binary files /dev/null and b/solutions/images/security-wiz-config-finding-logs.png differ diff --git a/solutions/images/security-wiz-config-vuln-logs.png b/solutions/images/security-wiz-config-vuln-logs.png new file mode 100644 index 0000000000..714f40a377 Binary files /dev/null and b/solutions/images/security-wiz-config-vuln-logs.png differ diff --git a/solutions/images/security-wiz-findings.png b/solutions/images/security-wiz-findings.png new file mode 100644 index 0000000000..4a5c2ea60b Binary files /dev/null and b/solutions/images/security-wiz-findings.png differ diff --git a/solutions/images/serverless--cloud-native-security-cnvm-findings-grouped.png b/solutions/images/serverless--cloud-native-security-cnvm-findings-grouped.png new file mode 100644 index 0000000000..b62bd0564b Binary files /dev/null and b/solutions/images/serverless--cloud-native-security-cnvm-findings-grouped.png differ diff --git a/solutions/images/serverless--cloud-native-security-cnvm-findings-page.png b/solutions/images/serverless--cloud-native-security-cnvm-findings-page.png new file mode 100644 index 0000000000..a2c36a19a7 Binary files /dev/null and b/solutions/images/serverless--cloud-native-security-cnvm-findings-page.png differ diff --git a/solutions/images/serverless-action-alert-summary.png b/solutions/images/serverless-action-alert-summary.png new file mode 100644 index 0000000000..89157d6629 Binary files /dev/null and b/solutions/images/serverless-action-alert-summary.png differ diff --git a/solutions/images/serverless-action-variables-popup.png b/solutions/images/serverless-action-variables-popup.png new file mode 100644 index 0000000000..ffd3723cb3 Binary files /dev/null and b/solutions/images/serverless-action-variables-popup.png differ diff --git a/solutions/images/serverless-add-custom-metric.png b/solutions/images/serverless-add-custom-metric.png new file mode 100644 index 0000000000..c807ab2f7b Binary files /dev/null and b/solutions/images/serverless-add-custom-metric.png differ diff --git a/solutions/images/serverless-add-field-processor.png b/solutions/images/serverless-add-field-processor.png new file mode 100644 index 0000000000..fc580c22d3 Binary files /dev/null and b/solutions/images/serverless-add-field-processor.png differ diff --git a/solutions/images/serverless-alert-action-frequency.png b/solutions/images/serverless-alert-action-frequency.png new file mode 100644 index 0000000000..2936ed2247 Binary files /dev/null and b/solutions/images/serverless-alert-action-frequency.png differ diff --git a/solutions/images/serverless-alert-anomaly-action-frequency-recovered.png b/solutions/images/serverless-alert-anomaly-action-frequency-recovered.png new file mode 100644 index 0000000000..82aa544123 Binary files /dev/null and b/solutions/images/serverless-alert-anomaly-action-frequency-recovered.png differ diff --git a/solutions/images/serverless-alert-apm-action-frequency-recovered.png b/solutions/images/serverless-alert-apm-action-frequency-recovered.png new file mode 100644 index 0000000000..ae25379628 Binary files /dev/null and b/solutions/images/serverless-alert-apm-action-frequency-recovered.png differ diff --git a/solutions/images/serverless-alert-details-flyout.png b/solutions/images/serverless-alert-details-flyout.png new file mode 100644 index 0000000000..362ed053bc Binary files /dev/null and b/solutions/images/serverless-alert-details-flyout.png differ diff --git a/solutions/images/serverless-alerting-es-query-rule-action-query-matched.png b/solutions/images/serverless-alerting-es-query-rule-action-query-matched.png new file mode 100644 index 0000000000..cafa6e82e2 Binary files /dev/null and b/solutions/images/serverless-alerting-es-query-rule-action-query-matched.png differ diff --git a/solutions/images/serverless-alerting-es-query-rule-action-summary.png b/solutions/images/serverless-alerting-es-query-rule-action-summary.png new file mode 100644 index 0000000000..1e098d77fc Binary files /dev/null and b/solutions/images/serverless-alerting-es-query-rule-action-summary.png differ diff --git a/solutions/images/serverless-alerting-rule-types-es-query-conditions.png b/solutions/images/serverless-alerting-rule-types-es-query-conditions.png new file mode 100644 index 0000000000..2151709ada Binary files /dev/null and b/solutions/images/serverless-alerting-rule-types-es-query-conditions.png differ diff --git a/solutions/images/serverless-alerting-rule-types-es-query-valid.png b/solutions/images/serverless-alerting-rule-types-es-query-valid.png new file mode 100644 index 0000000000..6c63f777df Binary files /dev/null and b/solutions/images/serverless-alerting-rule-types-es-query-valid.png differ diff --git a/solutions/images/serverless-alerting-rule-types-esql-query-valid.png b/solutions/images/serverless-alerting-rule-types-esql-query-valid.png new file mode 100644 index 0000000000..59f3fdfc22 Binary files /dev/null and b/solutions/images/serverless-alerting-rule-types-esql-query-valid.png differ diff --git a/solutions/images/serverless-alerts-create-apm-anomaly.png b/solutions/images/serverless-alerts-create-apm-anomaly.png new file mode 100644 index 0000000000..10c9661093 Binary files /dev/null and b/solutions/images/serverless-alerts-create-apm-anomaly.png differ diff --git a/solutions/images/serverless-alerts-create-rule-apm-latency-threshold.png b/solutions/images/serverless-alerts-create-rule-apm-latency-threshold.png new file mode 100644 index 0000000000..3841f736e1 Binary files /dev/null and b/solutions/images/serverless-alerts-create-rule-apm-latency-threshold.png differ diff --git a/solutions/images/serverless-alerts-create-rule-error-count.png b/solutions/images/serverless-alerts-create-rule-error-count.png new file mode 100644 index 0000000000..94d3621c97 Binary files /dev/null and b/solutions/images/serverless-alerts-create-rule-error-count.png differ diff --git a/solutions/images/serverless-alerts-create-rule-failed-transaction-rate.png b/solutions/images/serverless-alerts-create-rule-failed-transaction-rate.png new file mode 100644 index 0000000000..14f12518be Binary files /dev/null and b/solutions/images/serverless-alerts-create-rule-failed-transaction-rate.png differ diff --git a/solutions/images/serverless-alerts-detail-apm-anomaly.png b/solutions/images/serverless-alerts-detail-apm-anomaly.png new file mode 100644 index 0000000000..17b5345efc Binary files /dev/null and b/solutions/images/serverless-alerts-detail-apm-anomaly.png differ diff --git a/solutions/images/serverless-alerts-edit-rule.png b/solutions/images/serverless-alerts-edit-rule.png new file mode 100644 index 0000000000..062e6771e1 Binary files /dev/null and b/solutions/images/serverless-alerts-edit-rule.png differ diff --git a/solutions/images/serverless-anomalies-overlay.png b/solutions/images/serverless-anomalies-overlay.png new file mode 100644 index 0000000000..5f4c28720a Binary files /dev/null and b/solutions/images/serverless-anomalies-overlay.png differ diff --git a/solutions/images/serverless-anomaly-detection-alert.png b/solutions/images/serverless-anomaly-detection-alert.png new file mode 100644 index 0000000000..acf67aa4e0 Binary files /dev/null and b/solutions/images/serverless-anomaly-detection-alert.png differ diff --git a/solutions/images/serverless-apm-agents-aws-lambda-functions-architecture.png b/solutions/images/serverless-apm-agents-aws-lambda-functions-architecture.png new file mode 100644 index 0000000000..22de0b5c6a Binary files /dev/null and b/solutions/images/serverless-apm-agents-aws-lambda-functions-architecture.png differ diff --git a/solutions/images/serverless-apps.svg b/solutions/images/serverless-apps.svg new file mode 100644 index 0000000000..ad6f7baf1f --- /dev/null +++ b/solutions/images/serverless-apps.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/serverless-bell.svg b/solutions/images/serverless-bell.svg new file mode 100644 index 0000000000..61f2d5493a --- /dev/null +++ b/solutions/images/serverless-bell.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/serverless-boxesHorizontal.svg b/solutions/images/serverless-boxesHorizontal.svg new file mode 100644 index 0000000000..d845a6b9db --- /dev/null +++ b/solutions/images/serverless-boxesHorizontal.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/serverless-boxesVertical.svg b/solutions/images/serverless-boxesVertical.svg new file mode 100644 index 0000000000..aed10b0d8e --- /dev/null +++ b/solutions/images/serverless-boxesVertical.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/serverless-cases-files-tab.png b/solutions/images/serverless-cases-files-tab.png new file mode 100644 index 0000000000..a11287b060 Binary files /dev/null and b/solutions/images/serverless-cases-files-tab.png differ diff --git a/solutions/images/serverless-cases.png b/solutions/images/serverless-cases.png new file mode 100644 index 0000000000..25fb85f017 Binary files /dev/null and b/solutions/images/serverless-cases.png differ diff --git a/solutions/images/serverless-conditional-alerts.png b/solutions/images/serverless-conditional-alerts.png new file mode 100644 index 0000000000..7e9d32fd20 Binary files /dev/null and b/solutions/images/serverless-conditional-alerts.png differ diff --git a/solutions/images/serverless-custom-threshold-rule.png b/solutions/images/serverless-custom-threshold-rule.png new file mode 100644 index 0000000000..4290d3a426 Binary files /dev/null and b/solutions/images/serverless-custom-threshold-rule.png differ diff --git a/solutions/images/serverless-custom-threshold-run-when.png b/solutions/images/serverless-custom-threshold-run-when.png new file mode 100644 index 0000000000..6fee51ccfd Binary files /dev/null and b/solutions/images/serverless-custom-threshold-run-when.png differ diff --git a/solutions/images/serverless-dashboards.png b/solutions/images/serverless-dashboards.png new file mode 100644 index 0000000000..b709f2a291 Binary files /dev/null and b/solutions/images/serverless-dashboards.png differ diff --git a/solutions/images/serverless-documentation.svg b/solutions/images/serverless-documentation.svg new file mode 100644 index 0000000000..b519c72f03 --- /dev/null +++ b/solutions/images/serverless-documentation.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/serverless-endpoint-insights-results.png b/solutions/images/serverless-endpoint-insights-results.png new file mode 100644 index 0000000000..739b9313d0 Binary files /dev/null and b/solutions/images/serverless-endpoint-insights-results.png differ diff --git a/solutions/images/serverless-expand-icon.png b/solutions/images/serverless-expand-icon.png new file mode 100644 index 0000000000..c69ffcc559 Binary files /dev/null and b/solutions/images/serverless-expand-icon.png differ diff --git a/solutions/images/serverless-expand.svg b/solutions/images/serverless-expand.svg new file mode 100644 index 0000000000..66b1327a34 --- /dev/null +++ b/solutions/images/serverless-expand.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/serverless-eye.svg b/solutions/images/serverless-eye.svg new file mode 100644 index 0000000000..0e576f21d5 --- /dev/null +++ b/solutions/images/serverless-eye.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/serverless-get-started-create-an-index.png b/solutions/images/serverless-get-started-create-an-index.png new file mode 100644 index 0000000000..fa46a1dde1 Binary files /dev/null and b/solutions/images/serverless-get-started-create-an-index.png differ diff --git a/solutions/images/serverless-getting-started-page.png b/solutions/images/serverless-getting-started-page.png new file mode 100644 index 0000000000..7589d7276b Binary files /dev/null and b/solutions/images/serverless-getting-started-page.png differ diff --git a/solutions/images/serverless-green-dot-icon.png b/solutions/images/serverless-green-dot-icon.png new file mode 100644 index 0000000000..c886bda449 Binary files /dev/null and b/solutions/images/serverless-green-dot-icon.png differ diff --git a/solutions/images/serverless-hosts-dashed-and-missing.png b/solutions/images/serverless-hosts-dashed-and-missing.png new file mode 100644 index 0000000000..856e50e4b4 Binary files /dev/null and b/solutions/images/serverless-hosts-dashed-and-missing.png differ diff --git a/solutions/images/serverless-hosts-dashed.png b/solutions/images/serverless-hosts-dashed.png new file mode 100644 index 0000000000..5034d23d01 Binary files /dev/null and b/solutions/images/serverless-hosts-dashed.png differ diff --git a/solutions/images/serverless-hosts-logs.png b/solutions/images/serverless-hosts-logs.png new file mode 100644 index 0000000000..3d846415bb Binary files /dev/null and b/solutions/images/serverless-hosts-logs.png differ diff --git a/solutions/images/serverless-hosts-missing-data.png b/solutions/images/serverless-hosts-missing-data.png new file mode 100644 index 0000000000..a57be2d66a Binary files /dev/null and b/solutions/images/serverless-hosts-missing-data.png differ diff --git a/solutions/images/serverless-hosts-open-in-lens.png b/solutions/images/serverless-hosts-open-in-lens.png new file mode 100644 index 0000000000..dbadc02bb3 Binary files /dev/null and b/solutions/images/serverless-hosts-open-in-lens.png differ diff --git a/solutions/images/serverless-hosts-view-alerts.png b/solutions/images/serverless-hosts-view-alerts.png new file mode 100644 index 0000000000..3b3e18eab6 Binary files /dev/null and b/solutions/images/serverless-hosts-view-alerts.png differ diff --git a/solutions/images/serverless-hosts.png b/solutions/images/serverless-hosts.png new file mode 100644 index 0000000000..479ba32124 Binary files /dev/null and b/solutions/images/serverless-hosts.png differ diff --git a/solutions/images/serverless-importAction.svg b/solutions/images/serverless-importAction.svg new file mode 100644 index 0000000000..341653e6b1 --- /dev/null +++ b/solutions/images/serverless-importAction.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/serverless-indexClose.svg b/solutions/images/serverless-indexClose.svg new file mode 100644 index 0000000000..cb4d8f2cd2 --- /dev/null +++ b/solutions/images/serverless-indexClose.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/serverless-indexOpen.svg b/solutions/images/serverless-indexOpen.svg new file mode 100644 index 0000000000..09e9d7284b --- /dev/null +++ b/solutions/images/serverless-indexOpen.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/serverless-infra.png b/solutions/images/serverless-infra.png new file mode 100644 index 0000000000..e139012270 Binary files /dev/null and b/solutions/images/serverless-infra.png differ diff --git a/solutions/images/serverless-inventory-alert.png b/solutions/images/serverless-inventory-alert.png new file mode 100644 index 0000000000..07dd30edd1 Binary files /dev/null and b/solutions/images/serverless-inventory-alert.png differ diff --git a/solutions/images/serverless-inventory-threshold-run-when-selection.png b/solutions/images/serverless-inventory-threshold-run-when-selection.png new file mode 100644 index 0000000000..f9cfa2c854 Binary files /dev/null and b/solutions/images/serverless-inventory-threshold-run-when-selection.png differ diff --git a/solutions/images/serverless-list.svg b/solutions/images/serverless-list.svg new file mode 100644 index 0000000000..52e8e7acd1 --- /dev/null +++ b/solutions/images/serverless-list.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/serverless-log-explorer-overview.png b/solutions/images/serverless-log-explorer-overview.png new file mode 100644 index 0000000000..41448ef2ca Binary files /dev/null and b/solutions/images/serverless-log-explorer-overview.png differ diff --git a/solutions/images/serverless-log-explorer-select-syslogs.png b/solutions/images/serverless-log-explorer-select-syslogs.png new file mode 100644 index 0000000000..b49e1665d5 Binary files /dev/null and b/solutions/images/serverless-log-explorer-select-syslogs.png differ diff --git a/solutions/images/serverless-log-pattern-analysis.png b/solutions/images/serverless-log-pattern-analysis.png new file mode 100644 index 0000000000..fa6eecc8e7 Binary files /dev/null and b/solutions/images/serverless-log-pattern-analysis.png differ diff --git a/solutions/images/serverless-log-rate-analysis.png b/solutions/images/serverless-log-rate-analysis.png new file mode 100644 index 0000000000..15855c8b9a Binary files /dev/null and b/solutions/images/serverless-log-rate-analysis.png differ diff --git a/solutions/images/serverless-logs-end-date.png b/solutions/images/serverless-logs-end-date.png new file mode 100644 index 0000000000..1d2932cd09 Binary files /dev/null and b/solutions/images/serverless-logs-end-date.png differ diff --git a/solutions/images/serverless-logs-kql-filter.png b/solutions/images/serverless-logs-kql-filter.png new file mode 100644 index 0000000000..6eab1d1710 Binary files /dev/null and b/solutions/images/serverless-logs-kql-filter.png differ diff --git a/solutions/images/serverless-logs-overlay.png b/solutions/images/serverless-logs-overlay.png new file mode 100644 index 0000000000..002656477d Binary files /dev/null and b/solutions/images/serverless-logs-overlay.png differ diff --git a/solutions/images/serverless-logs-start-date.png b/solutions/images/serverless-logs-start-date.png new file mode 100644 index 0000000000..6d8f8c6dd7 Binary files /dev/null and b/solutions/images/serverless-logs-start-date.png differ diff --git a/solutions/images/serverless-logs-threshold-conditional-alert.png b/solutions/images/serverless-logs-threshold-conditional-alert.png new file mode 100644 index 0000000000..73f6bfc5bc Binary files /dev/null and b/solutions/images/serverless-logs-threshold-conditional-alert.png differ diff --git a/solutions/images/serverless-metadata-overlay.png b/solutions/images/serverless-metadata-overlay.png new file mode 100644 index 0000000000..0ab8c94952 Binary files /dev/null and b/solutions/images/serverless-metadata-overlay.png differ diff --git a/solutions/images/serverless-metrics-history-chart.png b/solutions/images/serverless-metrics-history-chart.png new file mode 100644 index 0000000000..cc62326f9f Binary files /dev/null and b/solutions/images/serverless-metrics-history-chart.png differ diff --git a/solutions/images/serverless-metrics-ml-jobs.png b/solutions/images/serverless-metrics-ml-jobs.png new file mode 100644 index 0000000000..052984f98d Binary files /dev/null and b/solutions/images/serverless-metrics-ml-jobs.png differ diff --git a/solutions/images/serverless-metrics-overlay.png b/solutions/images/serverless-metrics-overlay.png new file mode 100644 index 0000000000..5bfcb52309 Binary files /dev/null and b/solutions/images/serverless-metrics-overlay.png differ diff --git a/solutions/images/serverless-observability-alerts-overview.png b/solutions/images/serverless-observability-alerts-overview.png new file mode 100644 index 0000000000..b7dd3aba62 Binary files /dev/null and b/solutions/images/serverless-observability-alerts-overview.png differ diff --git a/solutions/images/serverless-observability-alerts-view.png b/solutions/images/serverless-observability-alerts-view.png new file mode 100644 index 0000000000..eeaa164cbc Binary files /dev/null and b/solutions/images/serverless-observability-alerts-view.png differ diff --git a/solutions/images/serverless-observability-cases-add-connector.png b/solutions/images/serverless-observability-cases-add-connector.png new file mode 100644 index 0000000000..d92ff68e6f Binary files /dev/null and b/solutions/images/serverless-observability-cases-add-connector.png differ diff --git a/solutions/images/serverless-observability-cases-templates.png b/solutions/images/serverless-observability-cases-templates.png new file mode 100644 index 0000000000..beaae82205 Binary files /dev/null and b/solutions/images/serverless-observability-cases-templates.png differ diff --git a/solutions/images/serverless-osquery-overlay.png b/solutions/images/serverless-osquery-overlay.png new file mode 100644 index 0000000000..98f7fa6077 Binary files /dev/null and b/solutions/images/serverless-osquery-overlay.png differ diff --git a/solutions/images/serverless-overview-overlay.png b/solutions/images/serverless-overview-overlay.png new file mode 100644 index 0000000000..ae501da1e6 Binary files /dev/null and b/solutions/images/serverless-overview-overlay.png differ diff --git a/solutions/images/serverless-plusInCircleFilled.svg b/solutions/images/serverless-plusInCircleFilled.svg new file mode 100644 index 0000000000..c2052e4c5f --- /dev/null +++ b/solutions/images/serverless-plusInCircleFilled.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/serverless-private-locations-monitor-locations.png b/solutions/images/serverless-private-locations-monitor-locations.png new file mode 100644 index 0000000000..fc4dad9414 Binary files /dev/null and b/solutions/images/serverless-private-locations-monitor-locations.png differ diff --git a/solutions/images/serverless-processes-overlay.png b/solutions/images/serverless-processes-overlay.png new file mode 100644 index 0000000000..eefb054392 Binary files /dev/null and b/solutions/images/serverless-processes-overlay.png differ diff --git a/solutions/images/serverless-questionInCircle.svg b/solutions/images/serverless-questionInCircle.svg new file mode 100644 index 0000000000..b715f289ad --- /dev/null +++ b/solutions/images/serverless-questionInCircle.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/serverless-quickstart-aws-firehose-entry-point.png b/solutions/images/serverless-quickstart-aws-firehose-entry-point.png new file mode 100644 index 0000000000..6a0bbe3399 Binary files /dev/null and b/solutions/images/serverless-quickstart-aws-firehose-entry-point.png differ diff --git a/solutions/images/serverless-quickstart-k8s-entry-point.png b/solutions/images/serverless-quickstart-k8s-entry-point.png new file mode 100644 index 0000000000..e558f81054 Binary files /dev/null and b/solutions/images/serverless-quickstart-k8s-entry-point.png differ diff --git a/solutions/images/serverless-quickstart-k8s-otel-entry-point.png b/solutions/images/serverless-quickstart-k8s-otel-entry-point.png new file mode 100644 index 0000000000..e47fac646b Binary files /dev/null and b/solutions/images/serverless-quickstart-k8s-otel-entry-point.png differ diff --git a/solutions/images/serverless-quickstart-monitor-hosts-entry-point.png b/solutions/images/serverless-quickstart-monitor-hosts-entry-point.png new file mode 100644 index 0000000000..d59756fa2d Binary files /dev/null and b/solutions/images/serverless-quickstart-monitor-hosts-entry-point.png differ diff --git a/solutions/images/serverless-quickstart-monitor-hosts-otel-entry-point.png b/solutions/images/serverless-quickstart-monitor-hosts-otel-entry-point.png new file mode 100644 index 0000000000..fc5a000c9e Binary files /dev/null and b/solutions/images/serverless-quickstart-monitor-hosts-otel-entry-point.png differ diff --git a/solutions/images/serverless-red-dot-icon.png b/solutions/images/serverless-red-dot-icon.png new file mode 100644 index 0000000000..95cbb1e77b Binary files /dev/null and b/solutions/images/serverless-red-dot-icon.png differ diff --git a/solutions/images/serverless-run-log-pattern-analysis.png b/solutions/images/serverless-run-log-pattern-analysis.png new file mode 100644 index 0000000000..eb4e9ae908 Binary files /dev/null and b/solutions/images/serverless-run-log-pattern-analysis.png differ diff --git a/solutions/images/serverless-services-inventory.png b/solutions/images/serverless-services-inventory.png new file mode 100644 index 0000000000..d32dd4e71d Binary files /dev/null and b/solutions/images/serverless-services-inventory.png differ diff --git a/solutions/images/serverless-slo-action-frequency.png b/solutions/images/serverless-slo-action-frequency.png new file mode 100644 index 0000000000..cef8d4307e Binary files /dev/null and b/solutions/images/serverless-slo-action-frequency.png differ diff --git a/solutions/images/serverless-slo-alerts-create-rule.png b/solutions/images/serverless-slo-alerts-create-rule.png new file mode 100644 index 0000000000..e3c6a8ce1f Binary files /dev/null and b/solutions/images/serverless-slo-alerts-create-rule.png differ diff --git a/solutions/images/serverless-slo-dashboard-panel.png b/solutions/images/serverless-slo-dashboard-panel.png new file mode 100644 index 0000000000..87c330d10f Binary files /dev/null and b/solutions/images/serverless-slo-dashboard-panel.png differ diff --git a/solutions/images/serverless-slo-dashboard.png b/solutions/images/serverless-slo-dashboard.png new file mode 100644 index 0000000000..6c08697da5 Binary files /dev/null and b/solutions/images/serverless-slo-dashboard.png differ diff --git a/solutions/images/serverless-slo-detailed-view.png b/solutions/images/serverless-slo-detailed-view.png new file mode 100644 index 0000000000..3cfb080a3d Binary files /dev/null and b/solutions/images/serverless-slo-detailed-view.png differ diff --git a/solutions/images/serverless-slo-filtering-options.png b/solutions/images/serverless-slo-filtering-options.png new file mode 100644 index 0000000000..a4580a933e Binary files /dev/null and b/solutions/images/serverless-slo-filtering-options.png differ diff --git a/solutions/images/serverless-slo-group-by.png b/solutions/images/serverless-slo-group-by.png new file mode 100644 index 0000000000..d13fdb9a4d Binary files /dev/null and b/solutions/images/serverless-slo-group-by.png differ diff --git a/solutions/images/serverless-synthetic-monitor-action-types-each-alert.png b/solutions/images/serverless-synthetic-monitor-action-types-each-alert.png new file mode 100644 index 0000000000..460df7f65b Binary files /dev/null and b/solutions/images/serverless-synthetic-monitor-action-types-each-alert.png differ diff --git a/solutions/images/serverless-synthetic-monitor-action-types-more-options.png b/solutions/images/serverless-synthetic-monitor-action-types-more-options.png new file mode 100644 index 0000000000..c457d2f766 Binary files /dev/null and b/solutions/images/serverless-synthetic-monitor-action-types-more-options.png differ diff --git a/solutions/images/serverless-synthetic-monitor-action-types-summary.png b/solutions/images/serverless-synthetic-monitor-action-types-summary.png new file mode 100644 index 0000000000..f51d3c5c81 Binary files /dev/null and b/solutions/images/serverless-synthetic-monitor-action-types-summary.png differ diff --git a/solutions/images/serverless-synthetic-monitor-action-variables.png b/solutions/images/serverless-synthetic-monitor-action-variables.png new file mode 100644 index 0000000000..78a1ce095c Binary files /dev/null and b/solutions/images/serverless-synthetic-monitor-action-variables.png differ diff --git a/solutions/images/serverless-synthetic-monitor-conditions.png b/solutions/images/serverless-synthetic-monitor-conditions.png new file mode 100644 index 0000000000..01fb434486 Binary files /dev/null and b/solutions/images/serverless-synthetic-monitor-conditions.png differ diff --git a/solutions/images/serverless-synthetic-monitor-filters.png b/solutions/images/serverless-synthetic-monitor-filters.png new file mode 100644 index 0000000000..ddaad8cbb6 Binary files /dev/null and b/solutions/images/serverless-synthetic-monitor-filters.png differ diff --git a/solutions/images/serverless-synthetics-monitor-management-api-key.png b/solutions/images/serverless-synthetics-monitor-management-api-key.png new file mode 100644 index 0000000000..84956e8e4b Binary files /dev/null and b/solutions/images/serverless-synthetics-monitor-management-api-key.png differ diff --git a/solutions/images/serverless-synthetics-params-secrets-kibana-use-lightweight.png b/solutions/images/serverless-synthetics-params-secrets-kibana-use-lightweight.png new file mode 100644 index 0000000000..52fb703128 Binary files /dev/null and b/solutions/images/serverless-synthetics-params-secrets-kibana-use-lightweight.png differ diff --git a/solutions/images/serverless-table-view-icon.png b/solutions/images/serverless-table-view-icon.png new file mode 100644 index 0000000000..c761abfb38 Binary files /dev/null and b/solutions/images/serverless-table-view-icon.png differ diff --git a/solutions/images/serverless-tableDensityCompact.svg b/solutions/images/serverless-tableDensityCompact.svg new file mode 100644 index 0000000000..9eabb5fe83 --- /dev/null +++ b/solutions/images/serverless-tableDensityCompact.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/solutions/images/serverless-turn-on-system-metrics.png b/solutions/images/serverless-turn-on-system-metrics.png new file mode 100644 index 0000000000..8393970b36 Binary files /dev/null and b/solutions/images/serverless-turn-on-system-metrics.png differ diff --git a/solutions/images/serverless-yellow-dot-icon.png b/solutions/images/serverless-yellow-dot-icon.png new file mode 100644 index 0000000000..be8e61f66c Binary files /dev/null and b/solutions/images/serverless-yellow-dot-icon.png differ diff --git a/solutions/observability/apps/analyze-data-from-synthetic-monitors.md b/solutions/observability/apps/analyze-data-from-synthetic-monitors.md index bd84be8f8b..0992398ac1 100644 --- a/solutions/observability/apps/analyze-data-from-synthetic-monitors.md +++ b/solutions/observability/apps/analyze-data-from-synthetic-monitors.md @@ -24,7 +24,7 @@ When you use a single monitor configuration to create monitors in multiple locat :::: -:::{image} ../../../images/observability-synthetics-monitor-page.png +:::{image} /solutions/images/observability-synthetics-monitor-page.png :alt: Synthetics UI :screenshot: ::: @@ -41,16 +41,16 @@ When you go to an individual monitor’s page, you’ll see much more detail abo * The monitor’s **name** with a down arrow icon that you can use to quickly move between monitors. * The **location** of the monitor. If the same monitor configuration was used to create monitors in multiple locations, you’ll also see a down arrow icon that you can use to quickly move between locations that use the same configuration. * The latest **status** and when the monitor was **last run**. -* The **![Beaker icon](../../../images/observability-beaker.svg "") Run test manually** button that allows you to run the test on demand before the next scheduled run. +* The **![Beaker icon](/solutions/images/observability-beaker.svg "") Run test manually** button that allows you to run the test on demand before the next scheduled run. ::::{note} This is only available for monitors running on Elastic’s global managed testing infrastructure. It is not available for monitors running on {{private-location}}s. :::: -* The **![Pencil icon](../../../images/observability-pencil.svg "") Edit monitor** button that allows you to edit the monitor’s configuration. +* The **![Pencil icon](/solutions/images/observability-pencil.svg "") Edit monitor** button that allows you to edit the monitor’s configuration. -:::{image} ../../../images/observability-synthetics-analyze-individual-monitor-header.png +:::{image} /solutions/images/observability-synthetics-analyze-individual-monitor-header.png :alt: Header at the top of the individual monitor page for all monitor types in the {synthetics-app} :screenshot: ::: @@ -62,7 +62,7 @@ Each individual monitor’s page has three tabs: Overview, History, and Errors. The **Overview** tab has information about the monitor availability, duration, and any errors that have occurred since the monitor was created. The *Duration trends* chart displays the timing for each check that was performed in the last 30 days. This visualization helps you to gain insights into how quickly requests resolve by the targeted endpoint and gives you a sense of how frequently a host or endpoint was down. -:::{image} ../../../images/observability-synthetics-analyze-individual-monitor-details.png +:::{image} /solutions/images/observability-synthetics-analyze-individual-monitor-details.png :alt: Details in the Overview tab on the individual monitor page for all monitor types in the {synthetics-app} :screenshot: ::: @@ -70,18 +70,18 @@ The **Overview** tab has information about the monitor availability, duration, a ### History [synthetics-analyze-individual-monitors-history] -The **History** tab has information on every time the monitor has run. It includes some high-level stats and a complete list of all test runs. Use the calendar icon (![Calendar icon](../../../images/observability-calendar.svg "")) and search bar to filter for runs that occurred in a specific time period. +The **History** tab has information on every time the monitor has run. It includes some high-level stats and a complete list of all test runs. Use the calendar icon (![Calendar icon](/solutions/images/observability-calendar.svg "")) and search bar to filter for runs that occurred in a specific time period. For browser monitors, you can click on any run in the **Test runs** list to see the details for that run. Read more about what information is included the in [Details for one run](../../../solutions/observability/apps/analyze-data-from-synthetic-monitors.md#synthetics-analyze-one-run) section below. -:::{image} ../../../images/observability-synthetics-analyze-individual-monitor-history.png +:::{image} /solutions/images/observability-synthetics-analyze-individual-monitor-history.png :alt: The History tab on the individual monitor page for all monitor types in the {synthetics-app} :screenshot: ::: -If the monitor is configured to [retest on failure](../../../solutions/observability/apps/configure-synthetics-projects.md#synthetics-configuration-monitor), you’ll see retests listed in the **Test runs** table. Runs that are retests include a rerun icon (![Refresh icon](../../../images/observability-refresh.svg "")) next to the result badge. +If the monitor is configured to [retest on failure](../../../solutions/observability/apps/configure-synthetics-projects.md#synthetics-configuration-monitor), you’ll see retests listed in the **Test runs** table. Runs that are retests include a rerun icon (![Refresh icon](/solutions/images/observability-refresh.svg "")) next to the result badge. -:::{image} ../../../images/observability-synthetics-retest.png +:::{image} /solutions/images/observability-synthetics-retest.png :alt: A failed run and a retest in the table of test runs in the {synthetics-app} :screenshot: ::: @@ -91,11 +91,11 @@ If the monitor is configured to [retest on failure](../../../solutions/observabi The **Errors** tab has information on failed runs. If the monitor is configured to [retest on failure](../../../solutions/observability/apps/configure-synthetics-projects.md#synthetics-configuration-monitor), failed runs will only result in an error if both the initial run and the rerun fail. This can reduce noise related to transient problems. -The Errors tab includes a high-level overview of all alerts and a complete list of all failures. Use the calendar icon (![Calendar icon](../../../images/observability-calendar.svg "")) and search bar to filter for runs that occurred in a specific time period. +The Errors tab includes a high-level overview of all alerts and a complete list of all failures. Use the calendar icon (![Calendar icon](/solutions/images/observability-calendar.svg "")) and search bar to filter for runs that occurred in a specific time period. For browser monitors, you can click on any run in the **Error** list to open an **Error details** page that includes most of the same information that is included the in [Details for one run](../../../solutions/observability/apps/analyze-data-from-synthetic-monitors.md#synthetics-analyze-one-run) section below. -:::{image} ../../../images/observability-synthetics-analyze-individual-monitor-errors.png +:::{image} /solutions/images/observability-synthetics-analyze-individual-monitor-errors.png :alt: The Errors tab on the individual monitor page for all monitor types in the {synthetics-app} :screenshot: ::: @@ -119,15 +119,15 @@ The journey page on the Overview tab includes: * **Duration by step** over the last 24 hours. * A list of the **last 10 test runs** that link to the [details for each run](../../../solutions/observability/apps/analyze-data-from-synthetic-monitors.md#synthetics-analyze-one-run). -:::{image} ../../../images/observability-synthetics-analyze-journeys-over-time.png +:::{image} /solutions/images/observability-synthetics-analyze-journeys-over-time.png :alt: Individual journey page for browser monitors in the {synthetics-app} :screenshot: ::: From here, you can either drill down into: -* The latest run of the full journey by clicking **![Inspect icon](../../../images/observability-inspect.svg "") View test run** or a past run in the list of **Last 10 test runs**. This will take you to the view described below in [Details for one run](../../../solutions/observability/apps/analyze-data-from-synthetic-monitors.md#synthetics-analyze-one-run). -* An individual step in this run by clicking the performance breakdown icon (![Performance breakdown icon](../../../images/observability-apmTrace.svg "")) next to one of the steps. This will take you to the view described below in [Details for one step](../../../solutions/observability/apps/analyze-data-from-synthetic-monitors.md#synthetics-analyze-one-step). +* The latest run of the full journey by clicking **![Inspect icon](/solutions/images/observability-inspect.svg "") View test run** or a past run in the list of **Last 10 test runs**. This will take you to the view described below in [Details for one run](../../../solutions/observability/apps/analyze-data-from-synthetic-monitors.md#synthetics-analyze-one-run). +* An individual step in this run by clicking the performance breakdown icon (![Performance breakdown icon](/solutions/images/observability-apmTrace.svg "")) next to one of the steps. This will take you to the view described below in [Details for one step](../../../solutions/observability/apps/analyze-data-from-synthetic-monitors.md#synthetics-analyze-one-step). ### Details for one run [synthetics-analyze-one-run] @@ -136,25 +136,25 @@ The page detailing one run for a journey includes more information on each step At the top of the page, see the *Code executed* and any *Console* output for each step. If the step failed, this will also include a *Stacktrace* tab that you can use to diagnose the cause of errors. -Navigate through each step using **![Previous icon](../../../images/observability-arrowLeft.svg "") Previous** and **Next ![Next icon](../../../images/observability-arrowRight.svg "")**. +Navigate through each step using **![Previous icon](/solutions/images/observability-arrowLeft.svg "") Previous** and **Next ![Next icon](/solutions/images/observability-arrowRight.svg "")**. -:::{image} ../../../images/observability-synthetics-analyze-one-run-code-executed.png +:::{image} /solutions/images/observability-synthetics-analyze-one-run-code-executed.png :alt: Step carousel on a page detailing one run of a browser monitor in the {synthetics-app} :screenshot: ::: -Scroll down to dig into the steps in this journey run. Click the ![Arrow right icon](../../../images/observability-arrowRight.svg "") icon next to the step number to show details. The details include metrics for the step in the current run and the step in the last successful run. Read more about step-level metrics below in [Timing](../../../solutions/observability/apps/analyze-data-from-synthetic-monitors.md#synthetics-analyze-one-step-timing) and [Metrics](../../../solutions/observability/apps/analyze-data-from-synthetic-monitors.md#synthetics-analyze-one-step-metrics). +Scroll down to dig into the steps in this journey run. Click the ![Arrow right icon](/solutions/images/observability-arrowRight.svg "") icon next to the step number to show details. The details include metrics for the step in the current run and the step in the last successful run. Read more about step-level metrics below in [Timing](../../../solutions/observability/apps/analyze-data-from-synthetic-monitors.md#synthetics-analyze-one-step-timing) and [Metrics](../../../solutions/observability/apps/analyze-data-from-synthetic-monitors.md#synthetics-analyze-one-step-metrics). This is particularly useful to compare the metrics for a failed step to the last time it completed successfully when trying to diagnose the reason it failed. -![Step list on a page detailing one run of a browser monitor in the Synthetics UI](../../../images/observability-synthetics-analyze-one-run-compare-steps.png "") +![Step list on a page detailing one run of a browser monitor in the Synthetics UI](/solutions/images/observability-synthetics-analyze-one-run-compare-steps.png "") -Drill down to see even more details for an individual step by clicking the performance breakdown icon (![Performance breakdown icon](../../../images/observability-apmTrace.svg "")) next to one of the steps. This will take you to the view described below in [Details for one step](../../../solutions/observability/apps/analyze-data-from-synthetic-monitors.md#synthetics-analyze-one-step). +Drill down to see even more details for an individual step by clicking the performance breakdown icon (![Performance breakdown icon](/solutions/images/observability-apmTrace.svg "")) next to one of the steps. This will take you to the view described below in [Details for one step](../../../solutions/observability/apps/analyze-data-from-synthetic-monitors.md#synthetics-analyze-one-step). ### Details for one step [synthetics-analyze-one-step] -After clicking the performance breakdown icon (![Performance breakdown icon](../../../images/observability-apmTrace.svg "")) you’ll see more detail for an individual step. +After clicking the performance breakdown icon (![Performance breakdown icon](/solutions/images/observability-apmTrace.svg "")) you’ll see more detail for an individual step. #### Screenshot [synthetics-analyze-one-step-screenshot] @@ -169,7 +169,7 @@ Customize screenshot behavior for all monitors in the [configuration file](../.. Screenshots can be particularly helpful to identify what went wrong when a step fails because of a change to the UI. You can compare the failed step to the last time the step successfully completed. -:::{image} ../../../images/observability-synthetics-analyze-one-step-screenshot.png +:::{image} /solutions/images/observability-synthetics-analyze-one-step-screenshot.png :alt: Screenshot for one step in a browser monitor in the {synthetics-app} :screenshot: ::: @@ -187,11 +187,11 @@ The **Timing** visualization shows a breakdown of the time spent in each part of * **Receive**: The time it took to receive the response from the server, which can be impacted by the size of the response. * **Send**: The time spent sending the request data to the server. -Next to each network timing metric, there’s an icon that indicates whether the value is higher (![Value is higher icon](../../../images/observability-sortUp.svg "")), lower (![Value is lower icon](../../../images/observability-sortDown.svg "")), or the same (![Value is the same](../../../images/observability-minus.svg "")) compared to the median of all runs in the last 24 hours. Hover over the icon to see more details in a tooltip. +Next to each network timing metric, there’s an icon that indicates whether the value is higher (![Value is higher icon](/solutions/images/observability-sortUp.svg "")), lower (![Value is lower icon](/solutions/images/observability-sortDown.svg "")), or the same (![Value is the same](/solutions/images/observability-minus.svg "")) compared to the median of all runs in the last 24 hours. Hover over the icon to see more details in a tooltip. This gives you an overview of how much time is spent (and how that time is spent) loading resources. This high-level information may not help you diagnose a problem on its own, but it could act as a signal to look at more granular information in the [Network requests](../../../solutions/observability/apps/analyze-data-from-synthetic-monitors.md#synthetics-analyze-one-step-network) section. -:::{image} ../../../images/observability-synthetics-analyze-one-step-timing.png +:::{image} /solutions/images/observability-synthetics-analyze-one-step-timing.png :alt: Network timing visualization for one step in a browser monitor in the {synthetics-app} :screenshot: ::: @@ -213,9 +213,9 @@ Largest contentful paint and Cumulative layout shift are part of Google’s [Cor :::: -Next to each metric, there’s an icon that indicates whether the value is higher (![Value is higher icon](../../../images/observability-sortUp.svg "")), lower (![Value is lower icon](../../../images/observability-sortDown.svg "")), or the same (![Value is the same](../../../images/observability-minus.svg "")) compared to all runs over the last 24 hours. Hover over the icon to see more details in a tooltip. +Next to each metric, there’s an icon that indicates whether the value is higher (![Value is higher icon](/solutions/images/observability-sortUp.svg "")), lower (![Value is lower icon](/solutions/images/observability-sortDown.svg "")), or the same (![Value is the same](/solutions/images/observability-minus.svg "")) compared to all runs over the last 24 hours. Hover over the icon to see more details in a tooltip. -:::{image} ../../../images/observability-synthetics-analyze-one-step-metrics.png +:::{image} /solutions/images/observability-synthetics-analyze-one-step-metrics.png :alt: Metrics visualization for one step in a browser monitor in the {synthetics-app} :screenshot: ::: @@ -227,7 +227,7 @@ The **Object weight** visualization shows the cumulative size of downloaded reso This provides a different kind of analysis. For example, you might have a large number of JavaScript files, each of which will need a separate download, but they may be collectively small. This could help you identify an opportunity to improve efficiency by combining multiple files into one. -:::{image} ../../../images/observability-synthetics-analyze-one-step-object.png +:::{image} /solutions/images/observability-synthetics-analyze-one-step-object.png :alt: Object visualization for one step in a browser monitor in the {synthetics-app} :screenshot: ::: @@ -241,13 +241,13 @@ The colored bars within each line indicate the time spent per resource. Each col Understanding each phase of a request can help you improve your site’s speed by reducing the time spent in each phase. -:::{image} ../../../images/observability-synthetics-analyze-one-step-network.png +:::{image} /solutions/images/observability-synthetics-analyze-one-step-network.png :alt: Network requests waterfall visualization for one step in a browser monitor in the {synthetics-app} :screenshot: ::: Without leaving the waterfall chart, you can view data points relating to each resource: resource details, request headers, response headers, and certificate headers. On the waterfall chart, select a resource name, or any part of each row, to display the resource details overlay. -For additional analysis, whether to check the content of a CSS file or to view a specific image, click the ![External link icon](../../../images/observability-popout.svg "") icon located beside each resource, to view its content in a new tab. +For additional analysis, whether to check the content of a CSS file or to view a specific image, click the ![External link icon](/solutions/images/observability-popout.svg "") icon located beside each resource, to view its content in a new tab. You can also navigate between steps and checks at the top of the page to view the corresponding waterfall charts. \ No newline at end of file diff --git a/solutions/observability/apps/analyze-monitors.md b/solutions/observability/apps/analyze-monitors.md index b63044d847..7b2fa6cf51 100644 --- a/solutions/observability/apps/analyze-monitors.md +++ b/solutions/observability/apps/analyze-monitors.md @@ -16,7 +16,7 @@ The monitor detail screen displays several panels of information. The **Status** panel displays a summary of the latest information regarding your monitor. You can view its availability, monitor ID, type, and any assigned tags. You can click a link to visit the targeted URL, view when the TLS certificate expires, and determine the amount of time elapsed since the last check. -:::{image} ../../../images/observability-uptime-status-panel.png +:::{image} /solutions/images/observability-uptime-status-panel.png :alt: Uptime status panel :screenshot: ::: @@ -32,7 +32,7 @@ The **Monitor duration** chart displays the timing for each check that was perfo Included on this chart is the {{anomaly-detect}} ({{ml}}) integration. For more information, see [Inspect Uptime duration anomalies](inspect-uptime-duration-anomalies.md). -:::{image} ../../../images/observability-monitor-duration-chart.png +:::{image} /solutions/images/observability-monitor-duration-chart.png :alt: Monitor duration chart :screenshot: ::: @@ -42,7 +42,7 @@ Included on this chart is the {{anomaly-detect}} ({{ml}}) integration. For more The **Pings over time** chart is a graphical representation of the check statuses over time. Hover over the charts to display crosshairs with specific numeric data. -:::{image} ../../../images/observability-pings-over-time.png +:::{image} /solutions/images/observability-pings-over-time.png :alt: Pings over time chart :screenshot: ::: @@ -54,7 +54,7 @@ The **History** table lists the total count of this monitor’s checks for the s This table can help you gain insights into more granular details about recent individual data points that {{heartbeat}} is logging about your host or endpoint. -:::{image} ../../../images/observability-uptime-history.png +:::{image} /solutions/images/observability-uptime-history.png :alt: Monitor history list :screenshot: ::: diff --git a/solutions/observability/apps/api-keys.md b/solutions/observability/apps/api-keys.md index 0def80560a..d9675daf39 100644 --- a/solutions/observability/apps/api-keys.md +++ b/solutions/observability/apps/api-keys.md @@ -96,7 +96,7 @@ For example, to create an API key that can be used to ingest APM events and read Click **Create APM Agent key** and copy the Base64 encoded API key. You will need this for the next step, and you will not be able to view it again. -:::{image} ../../../images/observability-apm-ui-api-key.png +:::{image} /solutions/images/observability-apm-ui-api-key.png :alt: Applications UI API key :screenshot: ::: diff --git a/solutions/observability/apps/apm-agent-authorization.md b/solutions/observability/apps/apm-agent-authorization.md index ccfc74c828..bac2bcbb17 100644 --- a/solutions/observability/apps/apm-agent-authorization.md +++ b/solutions/observability/apps/apm-agent-authorization.md @@ -8,7 +8,7 @@ applies_to: # APM agent authorization [apm-agent-auth] ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-yes.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-yes.svg "") Most options in this section are supported by all APM Server deployment methods. @@ -95,7 +95,7 @@ Authorization token for sending APM data. The same token must also be set in eac ## `auth.api_key.elasticsearch.*` configuration options [_auth_api_key_elasticsearch_configuration_options] ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-no.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-no.svg "") The below options are only supported by the APM Server binary. diff --git a/solutions/observability/apps/apm-agent-central-configuration.md b/solutions/observability/apps/apm-agent-central-configuration.md index dd77b564cc..f7cd842acf 100644 --- a/solutions/observability/apps/apm-agent-central-configuration.md +++ b/solutions/observability/apps/apm-agent-central-configuration.md @@ -14,7 +14,7 @@ APM Agent configuration allows you to fine-tune your APM agent configuration fro To get started, choose the services and environments you wish to configure. The Applications UI will let you know when your APM agents have applied your configurations. -:::{image} ../../../images/observability-apm-agent-configuration.png +:::{image} /solutions/images/observability-apm-agent-configuration.png :alt: APM Agent configuration in Kibana :screenshot: ::: @@ -29,7 +29,7 @@ Configurations set from the Applications UI take precedence over configurations Each APM agent has a list of supported configurations. After selecting a Service name and environment in the Applications UI, a list of all supported configuration options, including descriptions and default values, will be displayed. -Supported configurations are also tagged with the ![dynamic config](../../../images/observability-dynamic-config.svg "") badge in each APM agent’s configuration reference: +Supported configurations are also tagged with the ![dynamic config](/solutions/images/observability-dynamic-config.svg "") badge in each APM agent’s configuration reference: Android agent : [Configuration reference](apm-agent-android://reference/configuration.md) diff --git a/solutions/observability/apps/apm-agent-explorer.md b/solutions/observability/apps/apm-agent-explorer.md index 6c2aabfb86..f3ee9ae098 100644 --- a/solutions/observability/apps/apm-agent-explorer.md +++ b/solutions/observability/apps/apm-agent-explorer.md @@ -15,14 +15,14 @@ This functionality is in beta and is subject to change. The design and code is l APM agent explorer provides a centralized panel to identify APM agent deployment details, like service name, environment, instances, and agent name, version, and documentation. -:::{image} ../../../images/observability-apm-agent-explorer.png +:::{image} /solutions/images/observability-apm-agent-explorer.png :alt: APM agent explorer :screenshot: ::: Select an APM agent to expand it and view the details of each agent instance. -:::{image} ../../../images/observability-apm-agent-explorer-flyout.png +:::{image} /solutions/images/observability-apm-agent-explorer-flyout.png :alt: APM agent explorer flyout :screenshot: ::: diff --git a/solutions/observability/apps/apm-server-binary.md b/solutions/observability/apps/apm-server-binary.md index 431f64008d..511176a8f1 100644 --- a/solutions/observability/apps/apm-server-binary.md +++ b/solutions/observability/apps/apm-server-binary.md @@ -21,7 +21,7 @@ You’ll need: We recommend you use the same version of {{es}}, {{kib}}, and APM Server. See [Installing the {{stack}}](../../../get-started/the-stack.md) for more information about installing these products. -:::{image} ../../../images/observability-apm-architecture-diy.png +:::{image} /solutions/images/observability-apm-architecture-diy.png :alt: Install Elastic APM yourself ::: @@ -765,7 +765,7 @@ For more information on how to combine Elastic and OpenTelemetry, see [OpenTelem Once you have at least one {{apm-agent}} sending data to APM Server, you can start visualizing your data in the [{{kib}} Applications UI](overviews.md). -:::{image} ../../../images/observability-kibana-apm-sample-data.png +:::{image} /solutions/images/observability-kibana-apm-sample-data.png :alt: Applications UI with data :screenshot: ::: diff --git a/solutions/observability/apps/application-performance-monitoring-apm.md b/solutions/observability/apps/application-performance-monitoring-apm.md index 627afdcb16..c1cbea8fd3 100644 --- a/solutions/observability/apps/application-performance-monitoring-apm.md +++ b/solutions/observability/apps/application-performance-monitoring-apm.md @@ -8,7 +8,7 @@ mapped_urls: Elastic APM is an application performance monitoring system built on the {{stack}}. It allows you to monitor software services and applications in real time, by collecting detailed performance information on response time for incoming requests, database queries, calls to caches, external HTTP requests, and more. This makes it easy to pinpoint and fix performance problems quickly. -:::{image} ../../../images/observability-apm-app-landing.png +:::{image} /solutions/images/observability-apm-app-landing.png :alt: Applications UI in {kib} :screenshot: ::: diff --git a/solutions/observability/apps/collect-application-data.md b/solutions/observability/apps/collect-application-data.md index fba4bee01e..3eb0ff1751 100644 --- a/solutions/observability/apps/collect-application-data.md +++ b/solutions/observability/apps/collect-application-data.md @@ -17,7 +17,7 @@ mapped_urls: ::::{note} -![documentation icon](../../../images/serverless-documentation.svg "") Want to get started quickly? See [Get started with traces and APM](../../../solutions/observability/apps/get-started-with-apm.md). +![documentation icon](/solutions/images/serverless-documentation.svg "") Want to get started quickly? See [Get started with traces and APM](../../../solutions/observability/apps/get-started-with-apm.md). :::: @@ -48,15 +48,15 @@ Use Elastic APM agents or an OpenTelemetry language SDK to instrument a service | Language | Elastic APM agent | Elastic Distributions of OpenTelemetry (EDOT) | | --- | --- | --- | -| **Android** | Android agent | ![Not available](../../../images/observability-cross.svg "") | -| **Go** | Go agent | ![Not available](../../../images/observability-cross.svg "") | -| **iOS** | iOS agent | ![Not available](../../../images/observability-cross.svg "") | +| **Android** | Android agent | ![Not available](/solutions/images/observability-cross.svg "") | +| **Go** | Go agent | ![Not available](/solutions/images/observability-cross.svg "") | +| **iOS** | iOS agent | ![Not available](/solutions/images/observability-cross.svg "") | | **Java** | Java agent | EDOT Java | | **.NET** | .NET agent | [preview] EDOT .NET | | **Node.js** | Node.js agent | [preview] EDOT Node.js | | **PHP** | PHP agent | [preview] EDOT PHP | | **Python** | Python agent | [preview] EDOT Python | -| **Ruby** | Ruby agent | ![Not available](../../../images/observability-cross.svg "") | +| **Ruby** | Ruby agent | ![Not available](/solutions/images/observability-cross.svg "") | ## Service-specific options [_service_specific_options] diff --git a/solutions/observability/apps/configure-anonymous-authentication.md b/solutions/observability/apps/configure-anonymous-authentication.md index 428b64c82a..3a710559d4 100644 --- a/solutions/observability/apps/configure-anonymous-authentication.md +++ b/solutions/observability/apps/configure-anonymous-authentication.md @@ -12,7 +12,7 @@ applies_to: ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-yes.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-yes.svg "") Most options on this page are supported by all APM Server deployment methods. diff --git a/solutions/observability/apps/configure-apm-agent-central-configuration.md b/solutions/observability/apps/configure-apm-agent-central-configuration.md index 33228a2408..cfadec0206 100644 --- a/solutions/observability/apps/configure-apm-agent-central-configuration.md +++ b/solutions/observability/apps/configure-apm-agent-central-configuration.md @@ -12,7 +12,7 @@ applies_to: ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-yes.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-yes.svg "") APM agent central configuration is supported by all APM Server deployment methods, but some options are only supported for APM Server binary users. diff --git a/solutions/observability/apps/configure-apm-instrumentation.md b/solutions/observability/apps/configure-apm-instrumentation.md index 59f35bbbf6..a8941ae5fd 100644 --- a/solutions/observability/apps/configure-apm-instrumentation.md +++ b/solutions/observability/apps/configure-apm-instrumentation.md @@ -12,7 +12,7 @@ applies_to: ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-no.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-no.svg "") Instrumentation of APM Server is not yet supported for Fleet-managed APM. diff --git a/solutions/observability/apps/configure-console-output.md b/solutions/observability/apps/configure-console-output.md index e748b056ee..262e42a48f 100644 --- a/solutions/observability/apps/configure-console-output.md +++ b/solutions/observability/apps/configure-console-output.md @@ -12,7 +12,7 @@ applies_to: ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-no.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-no.svg "") The Console output is not yet supported by {{fleet}}-managed APM Server. diff --git a/solutions/observability/apps/configure-elasticsearch-output.md b/solutions/observability/apps/configure-elasticsearch-output.md index 302218d489..24332b9080 100644 --- a/solutions/observability/apps/configure-elasticsearch-output.md +++ b/solutions/observability/apps/configure-elasticsearch-output.md @@ -12,7 +12,7 @@ applies_to: ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-no.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-no.svg "") This documentation only applies to APM Server binary users. Fleet-managed users should see [Configure the {{es}} output](/reference/ingestion-tools/fleet/elasticsearch-output.md). @@ -127,7 +127,7 @@ Instead of using a username and password, you can use API keys to secure communi You *must* set the API key to be configured to **Beats**. Base64 encoded API keys are not currently supported in this configuration. For details on how to create and configure a compatible API key, refer to [Create an API key for writing events](grant-access-using-api-keys.md#apm-beats-api-key-publish). -:::{image} ../../../images/observability-apm-api-key-beats.png +:::{image} /solutions/images/observability-apm-api-key-beats.png :alt: API key dropdown highlighting the Beats option ::: diff --git a/solutions/observability/apps/configure-kafka-output.md b/solutions/observability/apps/configure-kafka-output.md index 5c0bf30cb2..a9cbd52ab9 100644 --- a/solutions/observability/apps/configure-kafka-output.md +++ b/solutions/observability/apps/configure-kafka-output.md @@ -11,7 +11,7 @@ applies_to: ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-no.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-no.svg "") The Kafka output is not yet supported by {{fleet}}-managed APM Server. diff --git a/solutions/observability/apps/configure-kibana-endpoint.md b/solutions/observability/apps/configure-kibana-endpoint.md index a16555ca20..b4746142a1 100644 --- a/solutions/observability/apps/configure-kibana-endpoint.md +++ b/solutions/observability/apps/configure-kibana-endpoint.md @@ -12,7 +12,7 @@ applies_to: ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-no.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-no.svg "") You must configure the {{kib}} endpoint when running the APM Server binary with a non-{{es}} output. Configuring the {{kib}} endpoint allows the APM Server to communicate with {{kib}} and ensure that the APM integration was properly set up. It is also required for APM agent configuration when using an output other than {{es}}. diff --git a/solutions/observability/apps/configure-lightweight-monitors.md b/solutions/observability/apps/configure-lightweight-monitors.md index 17c69f06f3..814d8fc470 100644 --- a/solutions/observability/apps/configure-lightweight-monitors.md +++ b/solutions/observability/apps/configure-lightweight-monitors.md @@ -19,7 +19,7 @@ Lightweight monitors can be configured using either the [Synthetics UI](../../.. To use the UI, go to the Synthetics UI in {{kib}} or in your Observability Serverless project to create and configure monitors. For step-by-step instructions, refer to [Use the Synthetics UI](../../../solutions/observability/apps/create-monitors-in-synthetics-app.md). -:::{image} ../../../images/observability-synthetics-get-started-ui-lightweight.png +:::{image} /solutions/images/observability-synthetics-get-started-ui-lightweight.png :alt: Synthetics Create monitor UI :screenshot: ::: diff --git a/solutions/observability/apps/configure-logging.md b/solutions/observability/apps/configure-logging.md index f625f27546..4928595862 100644 --- a/solutions/observability/apps/configure-logging.md +++ b/solutions/observability/apps/configure-logging.md @@ -12,7 +12,7 @@ applies_to: ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-no.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-no.svg "") These configuration options are only relevant to APM Server binary users. Fleet-managed users should see [View {{agent}} logs](/reference/ingestion-tools/fleet/monitor-elastic-agent.md) to learn how to view logs and change the logging level of {{agent}}. diff --git a/solutions/observability/apps/configure-logstash-output.md b/solutions/observability/apps/configure-logstash-output.md index d028cacd18..678928008e 100644 --- a/solutions/observability/apps/configure-logstash-output.md +++ b/solutions/observability/apps/configure-logstash-output.md @@ -12,7 +12,7 @@ applies_to: ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-no.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-no.svg "") The {{ls}} output is not yet supported by {{fleet}}-managed APM Server. diff --git a/solutions/observability/apps/configure-output-for-elasticsearch-service-on-elastic-cloud.md b/solutions/observability/apps/configure-output-for-elasticsearch-service-on-elastic-cloud.md index 1b8c3a6a9d..38da3a8c23 100644 --- a/solutions/observability/apps/configure-output-for-elasticsearch-service-on-elastic-cloud.md +++ b/solutions/observability/apps/configure-output-for-elasticsearch-service-on-elastic-cloud.md @@ -12,7 +12,7 @@ applies_to: ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-no.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-no.svg "") This documentation only applies to APM Server binary users. diff --git a/solutions/observability/apps/configure-project-paths.md b/solutions/observability/apps/configure-project-paths.md index bc6a411314..795c7eccff 100644 --- a/solutions/observability/apps/configure-project-paths.md +++ b/solutions/observability/apps/configure-project-paths.md @@ -12,7 +12,7 @@ applies_to: ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-no.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-no.svg "") This documentation is only relevant for APM Server binary users. Fleet-managed paths are defined in [Installation layout](installation-layout.md). diff --git a/solutions/observability/apps/configure-real-user-monitoring-rum.md b/solutions/observability/apps/configure-real-user-monitoring-rum.md index 7932500ab8..e1764facbd 100644 --- a/solutions/observability/apps/configure-real-user-monitoring-rum.md +++ b/solutions/observability/apps/configure-real-user-monitoring-rum.md @@ -12,7 +12,7 @@ applies_to: ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-yes.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-yes.svg "") Most options in this section are supported by all APM Server deployment methods. @@ -142,7 +142,7 @@ Default: `"^/webpack"` (excludes stack trace frames that have a filename startin ## Source map configuration options [apm-rum-source-map] ::::{admonition} -![supported deployment methods](../../../images/observability-binary-yes-fm-no.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-no.svg "") Source maps are supported by all APM Server deployment methods, however, the options in this section are only supported by the APM Server binary. diff --git a/solutions/observability/apps/configure-redis-output.md b/solutions/observability/apps/configure-redis-output.md index e41d6c3957..e97ed2c765 100644 --- a/solutions/observability/apps/configure-redis-output.md +++ b/solutions/observability/apps/configure-redis-output.md @@ -12,7 +12,7 @@ applies_to: ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-no.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-no.svg "") The Redis output is not yet supported by {{fleet}}-managed APM Server. diff --git a/solutions/observability/apps/configure-settings.md b/solutions/observability/apps/configure-settings.md index 30638004e2..0bf8badcea 100644 --- a/solutions/observability/apps/configure-settings.md +++ b/solutions/observability/apps/configure-settings.md @@ -31,7 +31,7 @@ The pattern set here only restricts what the {{uptime-app}} displays. You can st :::: -:::{image} ../../../images/observability-heartbeat-indices.png +:::{image} /solutions/images/observability-heartbeat-indices.png :alt: {{heartbeat}} indices :screenshot: ::: @@ -45,7 +45,7 @@ Click **Create connector** and follow the prompts to select a connector type and For more information about each connector, see [action types and connectors](../../../deploy-manage/manage-connectors.md). -:::{image} ../../../images/observability-alert-connector.png +:::{image} /solutions/images/observability-alert-connector.png :alt: Rule connector :screenshot: ::: @@ -62,7 +62,7 @@ You can modify certificate thresholds to control how Uptime displays your TLS va A standard security requirement is to make sure that your TLS certificates have not been valid for longer than a year. To help you keep track of which certificates you may want to refresh, modify the **Age limit** value to `365` days. -:::{image} ../../../images/observability-cert-expiry-settings.png +:::{image} /solutions/images/observability-cert-expiry-settings.png :alt: Certificate expiry settings :screenshot: ::: diff --git a/solutions/observability/apps/configure-synthetics-settings.md b/solutions/observability/apps/configure-synthetics-settings.md index 251dc9f337..6f2c646f0f 100644 --- a/solutions/observability/apps/configure-synthetics-settings.md +++ b/solutions/observability/apps/configure-synthetics-settings.md @@ -31,7 +31,7 @@ If you need specific alerting behavior, set up a different rule. To view all exi On the *Rules* page, you can manage the default synthetics rules including snoozing rules, disabling rules, deleting rules, and more. -:::{image} ../../../images/observability-synthetics-settings-disable-default-rules.png +:::{image} /solutions/images/observability-synthetics-settings-disable-default-rules.png :alt: Rules page with default Synthetics rules :screenshot: ::: @@ -48,7 +48,7 @@ You can enable and disable default alerts for individual monitors in a few ways: In the **Alerting** tab on the Synthetics Settings page, you can add and configure connectors. If you are running in Elastic Cloud, then an SMTP connector will automatically be configured, allowing you to easily set up email alerts. Read more about all available connectors in [Action types](../../../solutions/observability/incident-management/create-an-apm-anomaly-rule.md). -:::{image} ../../../images/observability-synthetics-settings-alerting.png +:::{image} /solutions/images/observability-synthetics-settings-alerting.png :alt: Alerting tab on the Synthetics Settings page in {kib} :screenshot: ::: @@ -60,7 +60,7 @@ In the **Alerting** tab on the Synthetics Settings page, you can add and configu In the **{{private-location}}s** tab, you can add and manage {{private-location}}s. After you [Set up {{fleet-server}} and {{agent}}](../../../solutions/observability/apps/monitor-resources-on-private-networks.md#synthetics-private-location-fleet-agent) and [Connect to the {{stack}} or your serverless Observability project](../../../solutions/observability/apps/monitor-resources-on-private-networks.md#synthetics-private-location-connect), this is where you will add the {{private-location}} so you can specify it as the location for a monitor created using the Synthetics UI or a Synthetics project. -:::{image} ../../../images/observability-synthetics-settings-private-locations.png +:::{image} /solutions/images/observability-synthetics-settings-private-locations.png :alt: {{private-location}}s tab on the Synthetics Settings page in {kib} :screenshot: ::: @@ -72,7 +72,7 @@ Global parameters can be defined once and used across the configuration of light In the **Global parameters** tab, you can define variables and parameters. This is one of several methods you can use to define variables and parameters. To learn more about the other methods and which methods take precedence over others, see [Work with params and secrets](../../../solutions/observability/apps/work-with-params-secrets.md). -:::{image} ../../../images/observability-synthetics-settings-global-parameters.png +:::{image} /solutions/images/observability-synthetics-settings-global-parameters.png :alt: Global parameters tab on the Synthetics Settings page in {kib} :screenshot: ::: @@ -84,7 +84,7 @@ When you set up a synthetic monitor, data from the monitor is saved in [Elastics In the **Data retention** tab, use the links to jump to the relevant policy for each data stream. Learn more about the data included in each data stream in [Manage data retention](../../../solutions/observability/apps/manage-data-retention.md). -:::{image} ../../../images/observability-synthetics-settings-data-retention.png +:::{image} /solutions/images/observability-synthetics-settings-data-retention.png :alt: Data retention tab on the Synthetics Settings page in {kib} :screenshot: ::: @@ -104,7 +104,7 @@ In a serverless project, to create a Project API key you must be logged in as a :::: -:::{image} ../../../images/observability-synthetics-settings-api-keys.png +:::{image} /solutions/images/observability-synthetics-settings-api-keys.png :alt: Project API keys tab on the Synthetics Settings page in {kib} :screenshot: ::: \ No newline at end of file diff --git a/solutions/observability/apps/control-access-to-apm-data.md b/solutions/observability/apps/control-access-to-apm-data.md index bed511767b..2be42b0443 100644 --- a/solutions/observability/apps/control-access-to-apm-data.md +++ b/solutions/observability/apps/control-access-to-apm-data.md @@ -266,7 +266,7 @@ Using the table below, assign each role the following privileges: | Index privileges | index: `production-*-apm`, privilege: `read` | index: `staging-*-apm`, privilege: `read` | | Kibana privileges | space: `production`, feature privileges: `APM and User Experience: read` | space: `staging`, feature privileges: `APM and User Experience: read` | -:::{image} ../../../images/observability-apm-roles-config.png +:::{image} /solutions/images/observability-apm-roles-config.png :alt: APM role config example :screenshot: ::: diff --git a/solutions/observability/apps/create-apm-rules-alerts.md b/solutions/observability/apps/create-apm-rules-alerts.md index 817daab36e..d44216aec6 100644 --- a/solutions/observability/apps/create-apm-rules-alerts.md +++ b/solutions/observability/apps/create-apm-rules-alerts.md @@ -45,7 +45,7 @@ Active alerts are displayed and grouped in multiple ways in the Applications UI. If you’re using the [service groups](../../../solutions/observability/apps/services.md#service-groups) feature, you can view alerts by service group. From the service group overview page, click the red alert indicator to open the **Alerts** tab with a predefined filter that matches the filter used when creating the service group. -:::{image} ../../../images/observability-apm-service-group.png +:::{image} /solutions/images/observability-apm-service-group.png :alt: Example view of service group in the Applications UI in Kibana :screenshot: ::: @@ -55,7 +55,7 @@ If you’re using the [service groups](../../../solutions/observability/apps/ser Alerts can be viewed within the context of any service. After selecting a service, go to the **Alerts** tab to view any alerts that are active for the selected service. -:::{image} ../../../images/observability-active-alert-service.png +:::{image} /solutions/images/observability-active-alert-service.png :alt: View active alerts by service :screenshot: ::: diff --git a/solutions/observability/apps/create-custom-links.md b/solutions/observability/apps/create-custom-links.md index ff6530bad6..42d04a456c 100644 --- a/solutions/observability/apps/create-custom-links.md +++ b/solutions/observability/apps/create-custom-links.md @@ -43,7 +43,7 @@ The URL your link points to. URLs support dynamic field name variables, encapsul Because everyone’s data is different, you’ll need to examine your traces to see what metadata is available for use. To do this, select a trace in the Applications UI, and click **Metadata** in the **Trace Sample** table. -:::{image} ../../../images/observability-example-metadata.png +:::{image} /solutions/images/observability-example-metadata.png :alt: Example metadata :screenshot: ::: @@ -101,7 +101,7 @@ Open a GitHub issue with pre-populated metadata from the selected trace sample. This link opens a new GitHub issue in the apm-agent-rum repository. It populates the issue body with relevant metadata from the currently active trace. Clicking this link results in the following issue being created: -:::{image} ../../../images/observability-create-github-issue.png +:::{image} /solutions/images/observability-create-github-issue.png :alt: Example github issue :screenshot: ::: @@ -128,7 +128,7 @@ Create a Jira task with pre-populated metadata from the selected trace sample. This link creates a new task on the Engineering board in Jira. It populates the issue body with relevant metadata from the currently active trace. Clicking this link results in the following task being created in Jira: -:::{image} ../../../images/observability-create-jira-issue.png +:::{image} /solutions/images/observability-create-jira-issue.png :alt: Example jira issue :screenshot: ::: diff --git a/solutions/observability/apps/create-monitors-in-synthetics-app.md b/solutions/observability/apps/create-monitors-in-synthetics-app.md index 86be3cdaa1..32806eb5b2 100644 --- a/solutions/observability/apps/create-monitors-in-synthetics-app.md +++ b/solutions/observability/apps/create-monitors-in-synthetics-app.md @@ -10,7 +10,7 @@ navigation_title: "Use the Synthetics UI" You can create synthetic monitors directly in the UI by opening an Observability project and navigating to **Synthetics**. -:::{image} ../../../images/observability-synthetics-get-started-ui.png +:::{image} /solutions/images/observability-synthetics-get-started-ui.png :alt: Diagram showing which pieces of software are used to configure monitors ::: @@ -49,7 +49,7 @@ To use the UI to add a lightweight monitor: :::::{note} If you’ve [added a {{private-location}}](../../../solutions/observability/apps/monitor-resources-on-private-networks.md), you’ll see your the {{private-location}} in the list of *Locations*. - :::{image} ../../../images/serverless-private-locations-monitor-locations.png + :::{image} /solutions/images/serverless-private-locations-monitor-locations.png :alt: Screenshot of Monitor locations options including a {private-location} :screenshot: ::: @@ -61,7 +61,7 @@ To use the UI to add a lightweight monitor: 7. (Optional) Click **Run test** to verify that the test is valid. 8. Click **Create monitor**. - :::{image} ../../../images/observability-synthetics-get-started-ui-lightweight.png + :::{image} /solutions/images/observability-synthetics-get-started-ui-lightweight.png :alt: Synthetics Create monitor UI :screenshot: ::: @@ -90,7 +90,7 @@ To use the UI to add a browser monitor: 4. Set the *Frequency*. 5. Add steps to the **Script editor** code block directly. The `journey` keyword isn’t required, and variables like `page` and `params` will be part of your script’s scope. You cannot `import` any dependencies when using inline browser monitors. - :::{image} ../../../images/observability-synthetics-ui-inline-script.png + :::{image} /solutions/images/observability-synthetics-ui-inline-script.png :alt: Configure a synthetic monitor using an inline script in Elastic {{fleet}} :screenshot: ::: diff --git a/solutions/observability/apps/create-monitors-with-project-monitors.md b/solutions/observability/apps/create-monitors-with-project-monitors.md index a362dd3791..24869effa7 100644 --- a/solutions/observability/apps/create-monitors-with-project-monitors.md +++ b/solutions/observability/apps/create-monitors-with-project-monitors.md @@ -11,7 +11,7 @@ navigation_title: "Use a Synthetics project" A Synthetics project is the most powerful and sophisticated way to configure synthetic monitors. A Synthetics project lets you define your infrastructure as code, more commonly known as IaaC or Git-ops. With monitors created and managed in Synthetics projects, you organize your YAML configuration and JavaScript- or TypeScript-defined monitors on the filesystem, use Git for version control, and deploy via a CLI tool, usually executed on a CI/CD platform. -:::{image} ../../../images/observability-synthetics-get-started-projects.png +:::{image} /solutions/images/observability-synthetics-get-started-projects.png :alt: Diagram showing which pieces of software are used to configure monitors ::: @@ -82,7 +82,7 @@ Then, follow the prompts on screen to set up the correct default variables for y :::: - :::{image} ../../../images/serverless-synthetics-monitor-management-api-key.png + :::{image} /solutions/images/serverless-synthetics-monitor-management-api-key.png :alt: Project API Keys tab in Synthetics settings :screenshot: ::: @@ -125,7 +125,7 @@ Then, take a look at key files and directories inside your Synthetics project: :::: - :::{image} ../../../images/serverless-synthetics-monitor-management-api-key.png + :::{image} /solutions/images/serverless-synthetics-monitor-management-api-key.png :alt: Project API Keys tab in Synthetics settings :screenshot: ::: diff --git a/solutions/observability/apps/create-upload-source-maps-rum.md b/solutions/observability/apps/create-upload-source-maps-rum.md index 50c5128873..f41f8775b0 100644 --- a/solutions/observability/apps/create-upload-source-maps-rum.md +++ b/solutions/observability/apps/create-upload-source-maps-rum.md @@ -13,14 +13,14 @@ For best results, uploading source maps should become a part of your deployment Here’s an example of an exception stack trace in the Applications UI when using minified code. As you can see, it’s not very helpful. -:::{image} ../../../images/observability-source-map-before.png +:::{image} /solutions/images/observability-source-map-before.png :alt: Applications UI without source mapping :screenshot: ::: With a source map, minified files are mapped back to the original source code, allowing you to maintain the speed advantage of minified code, without losing the ability to quickly and easily debug your application. Here’s the same example as before, but with a source map uploaded and applied: -:::{image} ../../../images/observability-source-map-after.png +:::{image} /solutions/images/observability-source-map-after.png :alt: Applications UI with source mapping :screenshot: ::: diff --git a/solutions/observability/apps/dependencies.md b/solutions/observability/apps/dependencies.md index c640fa0c35..fe88c48e51 100644 --- a/solutions/observability/apps/dependencies.md +++ b/solutions/observability/apps/dependencies.md @@ -8,7 +8,7 @@ mapped_urls: APM agents collect details about external calls made from instrumented services. Sometimes, these external calls resolve into a downstream service that’s instrumented — in these cases, you can utilize [distributed tracing](../../../solutions/observability/apps/trace-sample-timeline.md#distributed-tracing) to drill down into problematic downstream services. Other times, though, it’s not possible to instrument a downstream dependency — like with a database or third-party service. **Dependencies** gives you a window into these uninstrumented, downstream dependencies. -:::{image} ../../../images/observability-dependencies.png +:::{image} /solutions/images/observability-dependencies.png :alt: Dependencies view in the Applications UI :screenshot: ::: @@ -17,7 +17,7 @@ Many application issues are caused by slow or unresponsive downstream dependenci Select a dependency to see detailed latency, throughput, and failed transaction rate metrics. -:::{image} ../../../images/observability-dependencies-drilldown.png +:::{image} /solutions/images/observability-dependencies-drilldown.png :alt: Dependencies drilldown view in the Applications UI :screenshot: ::: @@ -37,14 +37,14 @@ The Dependency operations functionality is in beta and is subject to change. The **Dependency operations** provides a granular breakdown of the operations/queries a dependency is executing. -:::{image} ../../../images/observability-operations.png +:::{image} /solutions/images/observability-operations.png :alt: operations view in the Applications UI :screenshot: ::: Selecting an operation displays the operation’s impact and performance trends over time, via key metrics like latency, throughput, and failed transaction rate. In addition, the [**Trace sample timeline**](../../../solutions/observability/apps/trace-sample-timeline.md) provides a visual drill-down into an end-to-end trace sample. -:::{image} ../../../images/observability-operations-detail.png +:::{image} /solutions/images/observability-operations-detail.png :alt: operations detail view in the Applications UI :screenshot: ::: diff --git a/solutions/observability/apps/errors-2.md b/solutions/observability/apps/errors-2.md index 1f0d0243b4..e6edc79631 100644 --- a/solutions/observability/apps/errors-2.md +++ b/solutions/observability/apps/errors-2.md @@ -10,14 +10,14 @@ mapped_urls: A service returning a 5xx code from a request handler, controller, etc., will not create an exception that an APM agent can catch, and will therefore not show up in this view. -:::{image} ../../../images/observability-apm-errors-overview.png +:::{image} /solutions/images/observability-apm-errors-overview.png :alt: APM Errors overview :screenshot: ::: Selecting an error group ID or error message brings you to the **Error group**. -:::{image} ../../../images/observability-apm-error-group.png +:::{image} /solutions/images/observability-apm-error-group.png :alt: APM Error group :screenshot: ::: diff --git a/solutions/observability/apps/explore-mobile-sessions-with-discover.md b/solutions/observability/apps/explore-mobile-sessions-with-discover.md index fe0b48dde7..dacfe8b3ad 100644 --- a/solutions/observability/apps/explore-mobile-sessions-with-discover.md +++ b/solutions/observability/apps/explore-mobile-sessions-with-discover.md @@ -23,28 +23,28 @@ The steps to follow are: Here we can see the `session.id` guid in the metadata viewer in the error detail view: -:::{image} ../../../images/observability-mobile-session-error-details.png +:::{image} /solutions/images/observability-mobile-session-error-details.png :alt: Example of session.id in error details :screenshot: ::: Copy this value and open the Discover page: -:::{image} ../../../images/observability-mobile-session-explorer-nav.png +:::{image} /solutions/images/observability-mobile-session-explorer-nav.png :alt: Example view of navigation to Discover :screenshot: ::: Set the data view. `APM` selected in the example: -:::{image} ../../../images/observability-mobile-session-explorer-apm.png +:::{image} /solutions/images/observability-mobile-session-explorer-apm.png :alt: Example view of Explorer selecting APM data view :screenshot: ::: Filter using the `session.id`: `session.id: ""`: -:::{image} ../../../images/observability-mobile-session-filter-discover.png +:::{image} /solutions/images/observability-mobile-session-filter-discover.png :alt: Filter Explor using session.id :screenshot: ::: diff --git a/solutions/observability/apps/filter-application-data.md b/solutions/observability/apps/filter-application-data.md index e77be8f296..3511638ad2 100644 --- a/solutions/observability/apps/filter-application-data.md +++ b/solutions/observability/apps/filter-application-data.md @@ -11,7 +11,7 @@ navigation_title: "Filters" Global filters are ways you can filter your APM data based on a specific time range or environment. When viewing a specific service, the filter persists as you move between tabs. -:::{image} ../../../images/observability-global-filters.png +:::{image} /solutions/images/observability-global-filters.png :alt: Global filters view :screenshot: ::: diff --git a/solutions/observability/apps/find-transaction-latency-failure-correlations.md b/solutions/observability/apps/find-transaction-latency-failure-correlations.md index f0674d5129..7b29698ff1 100644 --- a/solutions/observability/apps/find-transaction-latency-failure-correlations.md +++ b/solutions/observability/apps/find-transaction-latency-failure-correlations.md @@ -43,7 +43,7 @@ Active queries *are* applied to correlations. The correlations on the **Latency correlations** tab help you discover which attributes are contributing to increased transaction latency. -:::{image} ../../../images/observability-correlations-hover.png +:::{image} /solutions/images/observability-correlations-hover.png :alt: APM latency correlations :screenshot: ::: @@ -70,7 +70,7 @@ The chart highlights the failed transactions in the overall latency distribution For example, in the screenshot below, there are attributes such as a specific node and pod name that have medium impact on the failed transactions. -:::{image} ../../../images/observability-correlations-failed-transactions.png +:::{image} /solutions/images/observability-correlations-failed-transactions.png :alt: Failed transaction correlations :screenshot: ::: diff --git a/solutions/observability/apps/fleet-managed-apm-server.md b/solutions/observability/apps/fleet-managed-apm-server.md index c6f91253ec..835bb772f6 100644 --- a/solutions/observability/apps/fleet-managed-apm-server.md +++ b/solutions/observability/apps/fleet-managed-apm-server.md @@ -71,7 +71,7 @@ You can install only a single {{agent}} per host, which means you cannot run {{f 4. Save and apply the settings. 5. Click the **Agents** tab and follow the in-product instructions to add a {{fleet}} server: - :::{image} ../../../images/observability-add-fleet-server.png + :::{image} /solutions/images/observability-add-fleet-server.png :alt: In-product instructions for adding a {{fleet-server}} :screenshot: ::: @@ -114,14 +114,14 @@ If you don’t have a {{fleet}} setup already in place, the easiest way to get s 1. In {{kib}}, find **Integrations** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). 2. Select **Elastic APM**. - :::{image} ../../../images/observability-kibana-fleet-integrations-apm.png + :::{image} /solutions/images/observability-kibana-fleet-integrations-apm.png :alt: {{fleet}} showing APM integration :screenshot: ::: 3. Click **Add Elastic APM**. - :::{image} ../../../images/observability-kibana-fleet-integrations-apm-overview.png + :::{image} /solutions/images/observability-kibana-fleet-integrations-apm-overview.png :alt: {{fleet}} showing APM integration overview :screenshot: ::: @@ -136,7 +136,7 @@ If you don’t have a {{fleet}} setup already in place, the easiest way to get s 6. Click **Save and continue**. This step takes a minute or two to complete. When it’s done, you’ll have an agent policy that contains an APM integration policy for the configuration you just specified. 7. To view the new policy, click **Agent policy 1**. - :::{image} ../../../images/observability-apm-agent-policy-1.png + :::{image} /solutions/images/observability-apm-agent-policy-1.png :alt: {{fleet}} showing apm policy :screenshot: ::: @@ -810,7 +810,7 @@ For more information on how to combine Elastic and OpenTelemetry, see [OpenTelem Back in {{kib}}, under {{observability}}, select APM. You should see application performance monitoring data flowing into the {{stack}}! -:::{image} ../../../images/observability-kibana-apm-sample-data.png +:::{image} /solutions/images/observability-kibana-apm-sample-data.png :alt: Applications UI with data :screenshot: ::: diff --git a/solutions/observability/apps/general-configuration-options.md b/solutions/observability/apps/general-configuration-options.md index 2e6fa95b54..8aabdeb066 100644 --- a/solutions/observability/apps/general-configuration-options.md +++ b/solutions/observability/apps/general-configuration-options.md @@ -8,7 +8,7 @@ applies_to: # General configuration options [apm-configuration-process] ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-yes.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-yes.svg "") Most options on this page are supported by all APM Server deployment methods. diff --git a/solutions/observability/apps/get-started-with-apm.md b/solutions/observability/apps/get-started-with-apm.md index bc28d7dba6..3d9de804a1 100644 --- a/solutions/observability/apps/get-started-with-apm.md +++ b/solutions/observability/apps/get-started-with-apm.md @@ -24,7 +24,7 @@ The APM Server receives performance data from your APM agents, validates and pro Fleet is a web-based UI in {{kib}} that is used to centrally manage {{agent}}s. In this deployment model, use {{agent}} to spin up APM Server instances that can be centrally-managed in a custom-curated user interface. -:::{image} ../../../images/observability-fm-ov.png +:::{image} /solutions/images/observability-fm-ov.png :alt: APM Server fleet overview ::: @@ -55,7 +55,7 @@ Fleet-managed APM Server does *not* support all the outputs that are supported b Install, configure, and run the APM Server binary wherever you need it. -:::{image} ../../../images/observability-bin-ov.png +:::{image} /solutions/images/observability-bin-ov.png :alt: APM Server binary overview ::: @@ -88,7 +88,7 @@ Install, configure, and run the APM Server binary wherever you need it. This decision tree highlights key factors to help you make an informed decision about implementing Elastic APM. It provides practical guidance and is not intended to serve as a comprehensive reference of all possible implementations and capabilities. -:::{image} ../../../images/observability-apm-help-me-decide.svg +:::{image} /solutions/images/observability-apm-help-me-decide.svg :alt: APM decision tree :screenshot: ::: diff --git a/solutions/observability/apps/get-started-with-uptime.md b/solutions/observability/apps/get-started-with-uptime.md index 3801ec4432..d624e31ee4 100644 --- a/solutions/observability/apps/get-started-with-uptime.md +++ b/solutions/observability/apps/get-started-with-uptime.md @@ -18,7 +18,7 @@ applies_to: {{heartbeat}} is a lightweight daemon that you install on a remote server to periodically check the status of your services and determine if they are available. It gathers performance data, formats it, and sends the data to the {{stack}}. -:::{image} ../../../images/observability-synthetics-get-started-heartbeat.png +:::{image} /solutions/images/observability-synthetics-get-started-heartbeat.png :alt: Diagram showing which pieces of software are used to configure monitors ::: diff --git a/solutions/observability/apps/get-started.md b/solutions/observability/apps/get-started.md index 3461fa1196..ef9bd9328d 100644 --- a/solutions/observability/apps/get-started.md +++ b/solutions/observability/apps/get-started.md @@ -24,7 +24,7 @@ This approach works well if you want to create both browser monitors and lightwe Get started in [Create monitors in a Synthetics project](../../../solutions/observability/apps/create-monitors-with-project-monitors.md). -:::{image} ../../../images/observability-synthetics-get-started-projects.png +:::{image} /solutions/images/observability-synthetics-get-started-projects.png :alt: Diagram showing which pieces of software are used to configure monitors ::: @@ -35,7 +35,7 @@ You can create monitors directly in the user interface. This approach works well Get started in [Create monitors in the Synthetics UI](../../../solutions/observability/apps/create-monitors-in-synthetics-app.md). -:::{image} ../../../images/observability-synthetics-get-started-ui.png +:::{image} /solutions/images/observability-synthetics-get-started-ui.png :alt: Diagram showing which pieces of software are used to configure monitors ::: diff --git a/solutions/observability/apps/grant-access-using-api-keys.md b/solutions/observability/apps/grant-access-using-api-keys.md index 91f3a94200..4bcfa0e9eb 100644 --- a/solutions/observability/apps/grant-access-using-api-keys.md +++ b/solutions/observability/apps/grant-access-using-api-keys.md @@ -22,7 +22,7 @@ To create an API key: 1. Go to **Stack Management** in the main menu and find **API Keys** or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). 2. Click **Create API key**. - :::{image} ../../../images/observability-server-api-key-create.png + :::{image} /solutions/images/observability-server-api-key-create.png :alt: API key creation :screenshot: ::: @@ -68,7 +68,7 @@ To create an API key: 5. Click **Create API key**. 6. You *must* set the API key to be configured to {{beats}}. Immediately after the API key is generated and while it is still being displayed, click the **Encoded** button next to the API key and select **Beats** from the list in the tooltip. Base64 encoded API keys are not currently supported in this configuration. - :::{image} ../../../images/observability-apm-api-key-beats.png + :::{image} /solutions/images/observability-apm-api-key-beats.png :alt: API key dropdown highlighting the Beats option ::: @@ -88,7 +88,7 @@ output.elasticsearch: To open **API keys**, find **Stack Management** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Click **Create API key**. -:::{image} ../../../images/observability-server-api-key-create.png +:::{image} /solutions/images/observability-server-api-key-create.png :alt: API key creation :screenshot: ::: diff --git a/solutions/observability/apps/index-lifecycle-management.md b/solutions/observability/apps/index-lifecycle-management.md index d2dccfbf2b..bd660dcdeb 100644 --- a/solutions/observability/apps/index-lifecycle-management.md +++ b/solutions/observability/apps/index-lifecycle-management.md @@ -67,7 +67,7 @@ The **Data Streams** view in {{kib}} shows you data streams, index templates, an 3. Search for `traces-apm` to see all data streams associated with APM trace data. 4. In this example, I only have one data stream because I’m only using the `default` namespace. You may have more if your setup includes multiple namespaces. - :::{image} ../../../images/observability-data-stream-overview.png + :::{image} /solutions/images/observability-data-stream-overview.png :alt: Data streams info :screenshot: ::: @@ -101,7 +101,7 @@ To apply your new index lifecycle policy to the `traces-apm-*` data stream, edit 4. Continue to **Review** and ensure your request looks similar to the image below. If it does, click **Create component template**. - :::{image} ../../../images/observability-create-component-template.png + :::{image} /solutions/images/observability-create-component-template.png :alt: Create component template :screenshot: ::: diff --git a/solutions/observability/apps/infrastructure.md b/solutions/observability/apps/infrastructure.md index 70a5a45117..790e7f7ce9 100644 --- a/solutions/observability/apps/infrastructure.md +++ b/solutions/observability/apps/infrastructure.md @@ -20,7 +20,7 @@ The **Infrastructure** tab provides information about the containers, pods, and * **Hosts**: If the application is containerized—​if the APM metrics documents include `container.id`-- the `host.name` is used from the infrastructure data streams (filtered by `container.id`). If not, `host.hostname` is used from the APM metrics data streams. -:::{image} ../../../images/serverless-infra.png +:::{image} /solutions/images/serverless-infra.png :alt: Example view of the Infrastructure tab in the Applications UI :screenshot: ::: diff --git a/solutions/observability/apps/inspect-uptime-duration-anomalies.md b/solutions/observability/apps/inspect-uptime-duration-anomalies.md index c1a83e417c..8550026110 100644 --- a/solutions/observability/apps/inspect-uptime-duration-anomalies.md +++ b/solutions/observability/apps/inspect-uptime-duration-anomalies.md @@ -26,7 +26,7 @@ Create a {{ml}} job to detect anomalous monitor duration rates automatically. When an anomaly is detected, the duration is displayed on the **Monitor duration** chart, along with the duration times. The colors represent the criticality of the anomaly: red (critical) and yellow (minor). -:::{image} ../../../images/observability-inspect-uptime-duration-anomalies.png +:::{image} /solutions/images/observability-inspect-uptime-duration-anomalies.png :alt: inspect uptime duration anomalies :screenshot: ::: diff --git a/solutions/observability/apps/integrate-with-machine-learning.md b/solutions/observability/apps/integrate-with-machine-learning.md index 0e598329ff..9a36349b36 100644 --- a/solutions/observability/apps/integrate-with-machine-learning.md +++ b/solutions/observability/apps/integrate-with-machine-learning.md @@ -21,7 +21,7 @@ Results from machine learning jobs are shown in multiple places throughout the A * The transaction duration chart will show the expected bounds and add an annotation when the anomaly score is 75 or above. * Service Maps will display a color-coded anomaly indicator based on the detected anomaly score. - :::{image} ../../../images/observability-apm-service-map-anomaly.png + :::{image} /solutions/images/observability-apm-service-map-anomaly.png :alt: Example view of anomaly scores on service maps in the Applications UI :screenshot: ::: diff --git a/solutions/observability/apps/inventory.md b/solutions/observability/apps/inventory.md index f62ea4746e..f0b4b096c7 100644 --- a/solutions/observability/apps/inventory.md +++ b/solutions/observability/apps/inventory.md @@ -16,7 +16,7 @@ The new Inventory requires the Elastic Entity Model (EEM). To learn more, refer :::: -:::{image} ../../../images/observability-inventory-catalog.png +:::{image} /solutions/images/observability-inventory-catalog.png :alt: Inventory catalog :screenshot: ::: @@ -70,7 +70,7 @@ For each entity, you can click the entity name and get a detailed view. For exam * Alerts * Dashboards -:::{image} ../../../images/observability-inventory-entity-detailed-view.png +:::{image} /solutions/images/observability-inventory-entity-detailed-view.png :alt: Inventory detailed view :screenshot: ::: diff --git a/solutions/observability/apps/learn-about-application-data-types.md b/solutions/observability/apps/learn-about-application-data-types.md index ea5a708577..d6a1ef5fdf 100644 --- a/solutions/observability/apps/learn-about-application-data-types.md +++ b/solutions/observability/apps/learn-about-application-data-types.md @@ -14,7 +14,7 @@ Elastic APM helps you see what happens from start to finish when a request is ma * [**Transactions**](../../../solutions/observability/apps/transactions.md): A transaction describes an event captured by an Elastic APM agent instrumenting a service. A transaction is technically a type of span that has additional attributes associated with it and often contains multiple child *spans*. You can think of transactions as the highest level of work you’re measuring within a service. * [**Traces**](../../../solutions/observability/apps/traces.md#apm-distributed-tracing): A trace is a group of *transactions* and *spans* with a common root. Each trace tracks the entirety of a single request. When a trace travels through multiple services, it is known as a *distributed trace*. -:::{image} ../../../images/observability-spans-transactions-and-traces.png +:::{image} /solutions/images/observability-spans-transactions-and-traces.png :alt: Diagram illustrating the relationship between spans ::: diff --git a/solutions/observability/apps/logs.md b/solutions/observability/apps/logs.md index fd422f4ecd..7d6155349b 100644 --- a/solutions/observability/apps/logs.md +++ b/solutions/observability/apps/logs.md @@ -14,7 +14,7 @@ If you’ve correlated your application’s logs and traces, you never have to s To learn how to correlate your logs with your instrumented services, refer to [Stream application logs](../../../solutions/observability/logs/stream-application-logs.md). -:::{image} ../../../images/observability-logs.png +:::{image} /solutions/images/observability-logs.png :alt: Example view of the Logs tab in Applications UI :screenshot: ::: diff --git a/solutions/observability/apps/metrics-2.md b/solutions/observability/apps/metrics-2.md index 18399d5434..bb8ab62236 100644 --- a/solutions/observability/apps/metrics-2.md +++ b/solutions/observability/apps/metrics-2.md @@ -10,21 +10,21 @@ The **Metrics** overview provides APM agent-specific metrics, which lets you per If you’re experiencing a problem with your service, you can use this page to attempt to find the underlying cause. For example, you might be able to correlate a high number of errors with a long transaction duration, high CPU usage, or a memory leak. -:::{image} ../../../images/observability-apm-metrics.png +:::{image} /solutions/images/observability-apm-metrics.png :alt: Example view of the Metrics overview in Applications UI in Kibana :screenshot: ::: If you’re using the Java APM agent, you can view metrics for each JVM. -:::{image} ../../../images/observability-jvm-metrics-overview.png +:::{image} /solutions/images/observability-jvm-metrics-overview.png :alt: Example view of the Metrics overview for the Java Agent :screenshot: ::: Breaking down metrics by JVM makes it much easier to analyze the provided metrics: CPU usage, memory usage, heap or non-heap memory, thread count, garbage collection rate, and garbage collection time spent per minute. -:::{image} ../../../images/observability-jvm-metrics.png +:::{image} /solutions/images/observability-jvm-metrics.png :alt: Example view of the Metrics overview for the Java Agent :screenshot: ::: \ No newline at end of file diff --git a/solutions/observability/apps/mobile-service-overview.md b/solutions/observability/apps/mobile-service-overview.md index e8d337d85c..9160fe7808 100644 --- a/solutions/observability/apps/mobile-service-overview.md +++ b/solutions/observability/apps/mobile-service-overview.md @@ -30,7 +30,7 @@ Understand the impact of slow application load times and variations in applicati Note: due to the way crash rate is calculated (crashes per session) it is possible to have greater than 100% rate, due to fact that a session may contain multiple crashes. -:::{image} ../../../images/observability-mobile-location.png +:::{image} /solutions/images/observability-mobile-location.png :alt: mobile service overview centered on location map :screenshot: ::: @@ -41,7 +41,7 @@ Note: due to the way crash rate is calculated (crashes per session) it is possib Optimize your end-user experience and your application QA strategy based on your most used device models and operating system versions. -:::{image} ../../../images/observability-mobile-most-used.png +:::{image} /solutions/images/observability-mobile-most-used.png :alt: mobile service overview showing most used devices :screenshot: ::: @@ -56,7 +56,7 @@ The **Transactions** table displays a list of *transaction groups* for the selec By default, transaction groups are sorted by *Impact* to show the most used and slowest endpoints in your service. If there is a particular endpoint you are interested in, click **View transactions** to view a list of similar transactions on the [transactions overview](transactions-2.md) page. -:::{image} ../../../images/observability-traffic-transactions.png +:::{image} /solutions/images/observability-traffic-transactions.png :alt: Traffic and transactions :screenshot: ::: @@ -84,13 +84,13 @@ Displaying dependencies for services instrumented with the Real User Monitoring :::: -:::{image} ../../../images/observability-spans-dependencies.png +:::{image} /solutions/images/observability-spans-dependencies.png :alt: Span type duration and dependencies :screenshot: ::: -:::{image} ../../../images/observability-mobile-tp.png +:::{image} /solutions/images/observability-mobile-tp.png :alt: mobile service overview showing latency :screenshot: ::: diff --git a/solutions/observability/apps/monitoring-aws-lambda-functions.md b/solutions/observability/apps/monitoring-aws-lambda-functions.md index 481fe21a07..f3792086b4 100644 --- a/solutions/observability/apps/monitoring-aws-lambda-functions.md +++ b/solutions/observability/apps/monitoring-aws-lambda-functions.md @@ -22,7 +22,7 @@ To accomplish the above, Elastic APM agents instrument AWS Lambda functions and Normally, during the execution of a Lambda function, there’s only a single language process running in the AWS Lambda execution environment. With an AWS Lambda extension, Lambda users run a *second* process alongside their main service/application process. -:::{image} ../../../images/serverless-apm-agents-aws-lambda-functions-architecture.png +:::{image} /solutions/images/serverless-apm-agents-aws-lambda-functions-architecture.png :alt: image showing data flow from lambda function :screenshot: ::: diff --git a/solutions/observability/apps/observe-lambda-functions.md b/solutions/observability/apps/observe-lambda-functions.md index aa00072e01..6660fee6e2 100644 --- a/solutions/observability/apps/observe-lambda-functions.md +++ b/solutions/observability/apps/observe-lambda-functions.md @@ -10,7 +10,7 @@ Elastic APM provides performance and error monitoring for AWS Lambda functions. To set up Lambda monitoring, refer to [AWS Lambda functions](/solutions/observability/apps/monitoring-aws-lambda-functions.md). -:::{image} ../../../images/observability-lambda-overview.png +:::{image} /solutions/images/observability-lambda-overview.png :alt: lambda overview :screenshot: ::: diff --git a/solutions/observability/apps/real-user-monitoring-user-experience.md b/solutions/observability/apps/real-user-monitoring-user-experience.md index 25cfb5abc9..e58c8d1cf0 100644 --- a/solutions/observability/apps/real-user-monitoring-user-experience.md +++ b/solutions/observability/apps/real-user-monitoring-user-experience.md @@ -15,7 +15,7 @@ applies_to: Powered by the APM Real user monitoring (RUM) agent, all it takes is a few lines of code to begin surfacing key user experience metrics. -:::{image} ../../../images/observability-user-experience-tab.png +:::{image} /solutions/images/observability-user-experience-tab.png :alt: {{user-experience}} tab :screenshot: ::: @@ -42,7 +42,7 @@ This high-level overview is your analysis starting point and answers questions l You won’t be able to fix any problems from viewing these metrics alone, but you’ll get a sense of the big picture as you dive deeper into your data. -:::{image} ../../../images/observability-page-load-duration.png +:::{image} /solutions/images/observability-page-load-duration.png :alt: {{user-experience}} page load duration metrics :screenshot: ::: @@ -52,7 +52,7 @@ You won’t be able to fix any problems from viewing these metrics alone, but yo {{user-experience}} metrics help you understand the perceived performance of your website. For example, first contentful paint is the timestamp when the browser begins rendering content. In other words, it’s around this time that a user first gets feedback that the page is loading. -:::{image} ../../../images/observability-user-exp-metrics.png +:::{image} /solutions/images/observability-user-exp-metrics.png :alt: {{user-experience}} metrics :screenshot: ::: @@ -121,7 +121,7 @@ Operating system, browser family, and geographic location can all have a massive Don’t forget, this data also influences search engine page rankings and placement in top stories for content sites — without requiring the use of AMP. -:::{image} ../../../images/observability-visitor-breakdown.png +:::{image} /solutions/images/observability-visitor-breakdown.png :alt: {{user-experience}} visitor breakdown :screenshot: ::: @@ -131,7 +131,7 @@ Don’t forget, this data also influences search engine page rankings and placem JavaScript errors can be detrimental to a users experience on your website. But variation in users' software and hardware makes it nearly impossible to test for every combination. And, as JavaScript continues to get more and more complex, the need for user experience monitoring and error reporting only increases. Error monitoring makes this visible by surfacing JavaScript errors that are occurring on your website in production. -:::{image} ../../../images/observability-js-errors.png +:::{image} /solutions/images/observability-js-errors.png :alt: {{user-experience}} JavaScript errors :screenshot: ::: diff --git a/solutions/observability/apps/scripting-browser-monitors.md b/solutions/observability/apps/scripting-browser-monitors.md index 4eb1e10cd3..abd8faf4d4 100644 --- a/solutions/observability/apps/scripting-browser-monitors.md +++ b/solutions/observability/apps/scripting-browser-monitors.md @@ -18,7 +18,7 @@ Start by learning the basics of synthetic monitoring, including how to: * [Work with params and secrets](../../../solutions/observability/apps/work-with-params-secrets.md) * [Use the Synthetics Recorder](../../../solutions/observability/apps/use-synthetics-recorder.md) -:::{image} ../../../images/observability-synthetic-monitor-lifecycle.png +:::{image} /solutions/images/observability-synthetic-monitor-lifecycle.png :alt: Diagram of the lifecycle of a synthetic monitor: write a test :screenshot: ::: \ No newline at end of file diff --git a/solutions/observability/apps/service-map.md b/solutions/observability/apps/service-map.md index f8c4468dcd..71f69d9c03 100644 --- a/solutions/observability/apps/service-map.md +++ b/solutions/observability/apps/service-map.md @@ -28,7 +28,7 @@ Customize what the service map displays using either the query bar or the enviro If there’s a specific service that interests you, select that service to highlight its connections. Click **Focus map** to refocus the map on the selected service and lock the connection highlighting. Click the **Transactions** tab to jump to the Transaction overview for the selected service. You can also use the tabs at the top of the page to easily jump to the **Errors** or **Metrics** overview. -:::{image} ../../../images/observability-service-maps-java.png +:::{image} /solutions/images/observability-service-maps-java.png :alt: Example view of service maps in the Applications UI in Kibana :screenshot: ::: @@ -40,11 +40,11 @@ You can create machine learning jobs to calculate anomaly scores on APM transact | | | | --- | --- | -| ![APM green service](../../../images/observability-green-service.png "") | Max anomaly score **≤25**. Service is healthy. | -| ![APM yellow service](../../../images/observability-yellow-service.png "") | Max anomaly score **26-74**. Anomalous activity detected. Service may be degraded. | -| ![APM red service](../../../images/observability-red-service.png "") | Max anomaly score **≥75**. Anomalous activity detected. Service is unhealthy. | +| ![APM green service](/solutions/images/observability-green-service.png "") | Max anomaly score **≤25**. Service is healthy. | +| ![APM yellow service](/solutions/images/observability-yellow-service.png "") | Max anomaly score **26-74**. Anomalous activity detected. Service may be degraded. | +| ![APM red service](/solutions/images/observability-red-service.png "") | Max anomaly score **≥75**. Anomalous activity detected. Service is unhealthy. | -:::{image} ../../../images/observability-apm-service-map-anomaly.png +:::{image} /solutions/images/observability-apm-service-map-anomaly.png :alt: Example view of anomaly scores on service maps in the Applications UI :screenshot: ::: diff --git a/solutions/observability/apps/service-overview.md b/solutions/observability/apps/service-overview.md index 7cda8708fc..26760f04a4 100644 --- a/solutions/observability/apps/service-overview.md +++ b/solutions/observability/apps/service-overview.md @@ -19,7 +19,7 @@ Selecting a non-mobile [**service**](../../../solutions/observability/apps/servi For insight into the health of your services, you can compare how a service performs relative to a previous time frame or to the expected bounds from the corresponding {{anomaly-job}}. For example, has latency been slowly increasing over time, did the service experience a sudden spike, is the throughput similar to what the {{ml}} job expects — enabling a comparison can provide the answer. -:::{image} ../../../images/observability-time-series-expected-bounds-comparison.png +:::{image} /solutions/images/observability-time-series-expected-bounds-comparison.png :alt: Time series and expected bounds comparison :screenshot: ::: @@ -39,7 +39,7 @@ The expected bounds comparison is powered by [machine learning](../../../solutio Response times for the service. You can filter the **Latency** chart to display the average, 95th, or 99th percentile latency times for the service. -:::{image} ../../../images/observability-latency.png +:::{image} /solutions/images/observability-latency.png :alt: Service latency :screenshot: ::: @@ -70,7 +70,7 @@ If there is no HTTP status, both transactions and spans are considered successfu The **Errors** table provides a high-level view of each error message when it first and last occurred, along with the total number of occurrences. This makes it very easy to quickly see which errors affect your services and take actions to rectify them. To do so, click **View errors**. -:::{image} ../../../images/observability-error-rate.png +:::{image} /solutions/images/observability-error-rate.png :alt: failed transaction rate and errors :screenshot: ::: @@ -101,7 +101,7 @@ The cold start rate chart is currently supported for [AWS Lambda](../../../solut The **Instances** table displays a list of all the available service instances within the selected time range. Depending on how the service runs, the instance could be a host or a container. The table displays latency, throughput, failed transaction, CPU usage, and memory usage for each instance. By default, instances are sorted by *Throughput*. -:::{image} ../../../images/observability-all-instances.png +:::{image} /solutions/images/observability-all-instances.png :alt: All instances :screenshot: ::: @@ -112,7 +112,7 @@ The **Instances** table displays a list of all the available service instances w To view metadata relating to the service agent, and if relevant, the container and cloud provider, click on each icon located at the top of the page beside the service name. -:::{image} ../../../images/observability-metadata-icons.png +:::{image} /solutions/images/observability-metadata-icons.png :alt: Service metadata :screenshot: ::: diff --git a/solutions/observability/apps/services.md b/solutions/observability/apps/services.md index e6e4a1fd82..6cdf630577 100644 --- a/solutions/observability/apps/services.md +++ b/solutions/observability/apps/services.md @@ -15,7 +15,7 @@ To help surface potential issues, services are sorted by their health status: ** In addition to health status, active alerts for each service are prominently displayed in the service inventory table. Selecting an active alert badge brings you to the [**Alerts**](../../../solutions/observability/apps/create-apm-rules-alerts.md) tab where you can learn more about the active alert and take action. -:::{image} ../../../images/observability-apm-services-overview.png +:::{image} /solutions/images/observability-apm-services-overview.png :alt: Example view of services table the Applications UI in Kibana :screenshot: ::: @@ -45,7 +45,7 @@ The Service grouping functionality is in beta and is subject to change. The desi Group services together to build meaningful views that remove noise, simplify investigations across services, and combine related alerts. -:::{image} ../../../images/observability-apm-service-group.png +:::{image} /solutions/images/observability-apm-service-group.png :alt: Example view of service group in the Applications UI in Kibana :screenshot: ::: diff --git a/solutions/observability/apps/ssltls-input-settings.md b/solutions/observability/apps/ssltls-input-settings.md index d582ec0431..1bf160abdd 100644 --- a/solutions/observability/apps/ssltls-input-settings.md +++ b/solutions/observability/apps/ssltls-input-settings.md @@ -8,7 +8,7 @@ applies_to: # SSL/TLS input settings [apm-agent-server-ssl] ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-yes.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-yes.svg "") Most options on this page are supported by all APM Server deployment methods. diff --git a/solutions/observability/apps/ssltls-output-settings.md b/solutions/observability/apps/ssltls-output-settings.md index 3a81efb913..cd7bae7926 100644 --- a/solutions/observability/apps/ssltls-output-settings.md +++ b/solutions/observability/apps/ssltls-output-settings.md @@ -8,7 +8,7 @@ applies_to: # SSL/TLS output settings [apm-configuration-ssl] ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-no.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-no.svg "") These configuration options are only relevant to APM Server binary users. Fleet-managed users should see the [Fleet output settings](/reference/ingestion-tools/fleet/fleet-settings.md). diff --git a/solutions/observability/apps/storage-explorer.md b/solutions/observability/apps/storage-explorer.md index 5467516623..e699b43f2c 100644 --- a/solutions/observability/apps/storage-explorer.md +++ b/solutions/observability/apps/storage-explorer.md @@ -9,7 +9,7 @@ applies_to: Analyze your APM data and manage costs with **storage explorer**. For example, analyze the storage footprint of each of your services to see which are producing large amounts of data—​then change the sample rate of a service to lower the amount of data ingested. Or, expand the time filter to visualize data trends over time so that you can better forecast and prepare for future storage needs. -:::{image} ../../../images/observability-storage-explorer-overview.png +:::{image} /solutions/images/observability-storage-explorer-overview.png :alt: APM Storage Explorer :screenshot: ::: @@ -42,7 +42,7 @@ The service statistics table provides detailed information on each service: * The estimated **size on disk**. This storage size includes both primary and replica shards and is calculated by prorating the total size of your indices by the service’s document count divided by the total number of documents. * Number of **transactions**, **spans**, **errors**, and **metrics** — doc count and size on disk. -:::{image} ../../../images/observability-storage-explorer-expanded.png +:::{image} /solutions/images/observability-storage-explorer-expanded.png :alt: APM Storage Explorer service breakdown :screenshot: ::: diff --git a/solutions/observability/apps/switch-an-elastic-cloud-cluster-to-apm-integration.md b/solutions/observability/apps/switch-an-elastic-cloud-cluster-to-apm-integration.md index c1caa86b5e..95a306c7a9 100644 --- a/solutions/observability/apps/switch-an-elastic-cloud-cluster-to-apm-integration.md +++ b/solutions/observability/apps/switch-an-elastic-cloud-cluster-to-apm-integration.md @@ -28,13 +28,13 @@ With a Superuser account, complete the following steps: 1. In {{kib}}, go to the **Applications** app and click **Settings** → **Schema**. - :::{image} ../../../images/observability-schema-agent.png + :::{image} /solutions/images/observability-schema-agent.png :alt: switch to {{agent}} ::: 2. Click **Switch to {{agent}}**. Make a note of the `apm-server.yml` user settings that are incompatible with {{agent}}. Check the confirmation box and click **Switch to {{agent}}**. - :::{image} ../../../images/observability-agent-settings-migration.png + :::{image} /solutions/images/observability-agent-settings-migration.png :alt: {{agent}} settings migration ::: @@ -55,7 +55,7 @@ Certain {{es}} output configuration options are not available with the APM integ Go to the [{{ecloud}} Console](https://cloud.elastic.co?page=docs&placement=docs-body), select your deployment and click **Edit**. Here you can edit the number and size of each availability zone. -:::{image} ../../../images/observability-scale-apm.png +:::{image} /solutions/images/observability-scale-apm.png :alt: scale APM ::: diff --git a/solutions/observability/apps/synthetic-monitoring.md b/solutions/observability/apps/synthetic-monitoring.md index 6187d1ff09..ee2373e10e 100644 --- a/solutions/observability/apps/synthetic-monitoring.md +++ b/solutions/observability/apps/synthetic-monitoring.md @@ -17,7 +17,7 @@ Synthetics periodically checks the status of your services and applications. Mon * [Lightweight HTTP/S, TCP, and ICMP monitors](../../../solutions/observability/apps/synthetic-monitoring.md#monitoring-uptime) * [Browser monitors](../../../solutions/observability/apps/synthetic-monitoring.md#monitoring-synthetics) -:::{image} ../../../images/observability-synthetics-monitor-page.png +:::{image} /solutions/images/observability-synthetics-monitor-page.png :alt: {{synthetics-app}} in {{kib}} :screenshot: ::: diff --git a/solutions/observability/apps/tail-based-sampling.md b/solutions/observability/apps/tail-based-sampling.md index 09d0d48915..64953d33a7 100644 --- a/solutions/observability/apps/tail-based-sampling.md +++ b/solutions/observability/apps/tail-based-sampling.md @@ -8,7 +8,7 @@ applies_to: # Tail-based sampling [apm-tail-based-sampling-config] ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-yes.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-yes.svg "") Most options on this page are supported by all APM Server deployment methods when writing to {{es}}. If you are using a different [output](configure-output.md), tail-based sampling is *not* supported. diff --git a/solutions/observability/apps/trace-sample-timeline.md b/solutions/observability/apps/trace-sample-timeline.md index 93973a952b..713d6b6650 100644 --- a/solutions/observability/apps/trace-sample-timeline.md +++ b/solutions/observability/apps/trace-sample-timeline.md @@ -8,7 +8,7 @@ mapped_urls: The trace sample timeline visualization is a high-level view of what your application was doing while it was trying to respond to a request. This makes it useful for visualizing where a selected transaction spent most of its time. -:::{image} ../../../images/observability-apm-transaction-sample.png +:::{image} /solutions/images/observability-apm-transaction-sample.png :alt: Example of distributed trace colors in the Applications UI :screenshot: ::: @@ -20,7 +20,7 @@ A [span](/solutions/observability/apps/spans.md) is the duration of a single eve :::: -:::{image} ../../../images/observability-apm-span-detail.png +:::{image} /solutions/images/observability-apm-span-detail.png :alt: Example view of a span detail in the Applications UI :screenshot: ::: @@ -43,19 +43,19 @@ The trace sample timeline features an **Investigate** button which provides a qu When a trace travels through multiple services it is known as a *distributed trace*. In APM, the colors in a distributed trace represent different services and are listed in the order they occur. -:::{image} ../../../images/observability-apm-services-trace.png +:::{image} /solutions/images/observability-apm-services-trace.png :alt: Example of distributed trace colors in the Applications UI :screenshot: ::: As application architectures are shifting from monolithic to more distributed, service-based architectures, distributed tracing has become a crucial feature of modern application performance monitoring. It allows you to trace requests through your service architecture automatically, and visualize those traces in one single view in the Applications UI. From initial web requests to your front-end service, to queries made to your back-end services, this makes finding possible bottlenecks throughout your application much easier and faster. -:::{image} ../../../images/observability-apm-distributed-tracing.png +:::{image} /solutions/images/observability-apm-distributed-tracing.png :alt: Example view of the distributed tracing in the Applications UI :screenshot: ::: -Don’t forget; by definition, a distributed trace includes more than one transaction. When viewing distributed traces in the timeline waterfall, you’ll see this icon: ![APM icon](../../../images/observability-transaction-icon.png ""), which indicates the next transaction in the trace. For easier problem isolation, transactions can be collapsed in the waterfall by clicking the icon to the left of the transactions. Transactions can also be expanded and viewed in detail by clicking on them. +Don’t forget; by definition, a distributed trace includes more than one transaction. When viewing distributed traces in the timeline waterfall, you’ll see this icon: ![APM icon](/solutions/images/observability-transaction-icon.png ""), which indicates the next transaction in the trace. For easier problem isolation, transactions can be collapsed in the waterfall by clicking the icon to the left of the transactions. Transactions can also be expanded and viewed in detail by clicking on them. After exploring these traces, you can return to the full trace by clicking **View full trace**. diff --git a/solutions/observability/apps/traces-2.md b/solutions/observability/apps/traces-2.md index dd59eb9fe9..069a201a56 100644 --- a/solutions/observability/apps/traces-2.md +++ b/solutions/observability/apps/traces-2.md @@ -17,7 +17,7 @@ By default, transactions are sorted by *Impact*. Impact helps show the most used You can also use queries to filter and search the transactions shown on this page. Note that only properties available on root transactions are searchable. For example, you can’t search for `label.tier: 'high'`, as that field is only available on non-root transactions. -:::{image} ../../../images/observability-apm-traces.png +:::{image} /solutions/images/observability-apm-traces.png :alt: Example view of the Traces overview in Applications UI in Kibana :screenshot: ::: @@ -34,7 +34,7 @@ This functionality is in technical preview and may be changed or removed in a fu Curate your own custom queries, or use the [**Service Map**](../../../solutions/observability/apps/service-map.md) to find and select edges to automatically generate queries based on your selection: -:::{image} ../../../images/observability-trace-explorer.png +:::{image} /solutions/images/observability-trace-explorer.png :alt: Trace explorer :screenshot: ::: \ No newline at end of file diff --git a/solutions/observability/apps/traces.md b/solutions/observability/apps/traces.md index 7c1f2acc41..b061face5e 100644 --- a/solutions/observability/apps/traces.md +++ b/solutions/observability/apps/traces.md @@ -33,19 +33,19 @@ When a service is working on a request, it checks for the existence of this HTTP In this example, Elastic’s Ruby agent communicates with Elastic’s Java agent. Both support the `traceparent` header, and trace data is successfully propagated. -:::{image} ../../../images/observability-dt-trace-ex1.png +:::{image} /solutions/images/observability-dt-trace-ex1.png :alt: How traceparent propagation works ::: In this example, Elastic’s Ruby agent communicates with OpenTelemetry’s Java agent. Both support the `traceparent` header, and trace data is successfully propagated. -:::{image} ../../../images/observability-dt-trace-ex2.png +:::{image} /solutions/images/observability-dt-trace-ex2.png :alt: How traceparent propagation works ::: In this example, the trace meets a piece of middleware that doesn’t propagate the `traceparent` header. The distributed trace ends and any further communication will result in a new trace. -:::{image} ../../../images/observability-dt-trace-ex3.png +:::{image} /solutions/images/observability-dt-trace-ex3.png :alt: How traceparent propagation works ::: @@ -77,7 +77,7 @@ Older Elastic agents use a unique `elastic-apm-traceparent` header. For backward APM's timeline visualization provides a visual deep-dive into each of your application’s traces: -:::{image} ../../../images/observability-apm-distributed-tracing.png +:::{image} /solutions/images/observability-apm-distributed-tracing.png :alt: Distributed tracing in the Applications UI :screenshot: ::: diff --git a/solutions/observability/apps/track-deployments-with-annotations.md b/solutions/observability/apps/track-deployments-with-annotations.md index 239abb8f25..53d6b5ba58 100644 --- a/solutions/observability/apps/track-deployments-with-annotations.md +++ b/solutions/observability/apps/track-deployments-with-annotations.md @@ -14,7 +14,7 @@ navigation_title: "Track deployments with annotations" :::: -:::{image} ../../../images/observability-apm-transaction-annotation.png +:::{image} /solutions/images/observability-apm-transaction-annotation.png :alt: Example view of transactions annotation in the Applications UI :screenshot: ::: diff --git a/solutions/observability/apps/transaction-sampling.md b/solutions/observability/apps/transaction-sampling.md index 34fee32bfb..1545114b3f 100644 --- a/solutions/observability/apps/transaction-sampling.md +++ b/solutions/observability/apps/transaction-sampling.md @@ -35,7 +35,7 @@ In the example in *Figure 1*, `Service A` initiates four transactions and has sa **Figure 1. Upstream sampling decision is respected** -:::{image} ../../../images/observability-dt-sampling-example-1.png +:::{image} /solutions/images/observability-dt-sampling-example-1.png :alt: Distributed tracing and head based sampling example one :screenshot: ::: @@ -44,7 +44,7 @@ In the example in *Figure 2*, `Service A` initiates four transactions and has a **Figure 2. Upstream sampling decision is respected** -:::{image} ../../../images/observability-dt-sampling-example-2.png +:::{image} /solutions/images/observability-dt-sampling-example-2.png :alt: Distributed tracing and head based sampling example two :screenshot: ::: @@ -62,7 +62,7 @@ In the example in *Figure 3*, `Service A` is an Elastic-monitored service that i **Figure 3. Using the `restart_external` trace continuation strategy** -:::{image} ../../../images/observability-dt-sampling-continuation-strategy-restart_external.png +:::{image} /solutions/images/observability-dt-sampling-continuation-strategy-restart_external.png :alt: Distributed tracing and head based sampling with restart_external continuation strategy :screenshot: ::: @@ -71,7 +71,7 @@ Use the **`restart`** trace continuation strategy on an Elastic-monitored servic In the example in *Figure 4*, `Service A` and `Service B` are Elastic-monitored services that use the default trace continuation strategy. `Service A` has a sample rate of `.25` (`25%`), and that sampling decision is respected in `Service B`. `Service C` is an Elastic-monitored service that uses the `restart` trace continuation strategy and has a sample rate of `1` (`100%`). Because it uses `restart`, the upstream sample rate is *not* respected in `Service C` and all four traces will be sampled as new traces in `Service C`. The end result will be five sampled traces. -:::{image} ../../../images/observability-dt-sampling-continuation-strategy-restart.png +:::{image} /solutions/images/observability-dt-sampling-continuation-strategy-restart.png :alt: Distributed tracing and head based sampling with restart continuation strategy :title: Using the `restart` trace continuation strategy ::: @@ -122,7 +122,7 @@ With tail-based sampling, all traces are observed and a sampling decision is onl In this example, `Service A` initiates four transactions. If our sample rate is `.5` (`50%`) for traces with a `success` outcome, and `1` (`100%`) for traces with a `failure` outcome, the sampled traces would look something like this: -:::{image} ../../../images/observability-dt-sampling-example-3.png +:::{image} /solutions/images/observability-dt-sampling-example-3.png :alt: Distributed tracing and tail based sampling example one ::: diff --git a/solutions/observability/apps/transactions-2.md b/solutions/observability/apps/transactions-2.md index 53e90f37f8..d47db17694 100644 --- a/solutions/observability/apps/transactions-2.md +++ b/solutions/observability/apps/transactions-2.md @@ -9,7 +9,7 @@ mapped_urls: A *transaction* describes an event captured by an Elastic APM agent instrumenting a service. APM agents automatically collect performance metrics on HTTP requests, database queries, and much more. -:::{image} ../../../images/observability-apm-transactions-overview.png +:::{image} /solutions/images/observability-apm-transactions-overview.png :alt: Example view of transactions table in the Applications UI :screenshot: ::: @@ -51,7 +51,7 @@ The **Latency**, **Throughput**, **Failed transaction rate**, **Time spent by sp The **Transactions** table displays a list of *transaction groups* for the selected service. In other words, this view groups all transactions of the same name together, and only displays one entry for each group. -:::{image} ../../../images/observability-apm-transactions-table.png +:::{image} /solutions/images/observability-apm-transactions-table.png :alt: Example view of the transactions table in the Applications UI in Kibana :screenshot: ::: @@ -71,7 +71,7 @@ For further details, including troubleshooting and custom implementation instruc The transaction overview page is customized for the JavaScript RUM agent. Specifically, the page highlights **page load times** for your service: -:::{image} ../../../images/observability-apm-geo-ui.png +:::{image} /solutions/images/observability-apm-geo-ui.png :alt: average page load duration distribution :screenshot: ::: @@ -83,7 +83,7 @@ Additional RUM goodies, like core vitals, and visitor breakdown by browser, loca Selecting a transaction group will bring you to the **transaction** details. This page is visually similar to the transaction overview, but it shows data from all transactions within the selected transaction group. -:::{image} ../../../images/observability-apm-transactions-overview.png +:::{image} /solutions/images/observability-apm-transactions-overview.png :alt: Example view of response time distribution :screenshot: ::: @@ -93,7 +93,7 @@ Selecting a transaction group will bring you to the **transaction** details. Thi The latency distribution shows a plot of all transaction durations for the given time period. The following screenshot shows a typical distribution and indicates most of our requests were served quickly — awesome! The requests on the right are taking longer than average; we probably need to focus on them. -:::{image} ../../../images/observability-apm-transaction-duration-dist.png +:::{image} /solutions/images/observability-apm-transaction-duration-dist.png :alt: Example view of latency distribution graph :screenshot: ::: @@ -111,7 +111,7 @@ Each bucket presents up to ten trace samples in a **timeline**, trace sample **m Each sample has a trace timeline waterfall that shows how a typical request in that bucket executed. This waterfall is useful for understanding the parent/child hierarchy of transactions and spans, and ultimately determining *why* a request was slow. For large waterfalls, expand problematic transactions and collapse well-performing ones for easier problem isolation and troubleshooting. -:::{image} ../../../images/observability-apm-transaction-sample.png +:::{image} /solutions/images/observability-apm-transaction-sample.png :alt: Example view of transactions sample :screenshot: ::: @@ -153,7 +153,7 @@ If you’ve correlated your application’s logs and traces, you never have to s To learn how to correlate your logs with your instrumented services, see [Stream application logs](../../../solutions/observability/logs/stream-application-logs.md) -:::{image} ../../../images/observability-apm-logs-tab.png +:::{image} /solutions/images/observability-apm-logs-tab.png :alt: APM logs tab :screenshot: ::: @@ -163,7 +163,7 @@ To learn how to correlate your logs with your instrumented services, see [Stream Correlations surface attributes of your data that are potentially correlated with high-latency or erroneous transactions. To learn more, see [Find transaction latency and failure correlations](../../../solutions/observability/apps/find-transaction-latency-failure-correlations.md). -:::{image} ../../../images/observability-correlations-hover.png +:::{image} /solutions/images/observability-correlations-hover.png :alt: APM lattency correlations :screenshot: ::: \ No newline at end of file diff --git a/solutions/observability/apps/tutorial-monitor-java-application.md b/solutions/observability/apps/tutorial-monitor-java-application.md index cbda1399a2..e8e0502b72 100644 --- a/solutions/observability/apps/tutorial-monitor-java-application.md +++ b/solutions/observability/apps/tutorial-monitor-java-application.md @@ -548,7 +548,7 @@ This command results in roughly 8,000 requests per second, and the equivalent nu There is a summary of the documents at the top, but let’s take a look at a single document. - ![{{kib}} single document view](../../../images/observability-monitor-java-app-kibana-single-document.png "") + ![{{kib}} single document view](/solutions/images/observability-monitor-java-app-kibana-single-document.png "") You can see that a lot more data is indexed than just the event. There is information about the offset in the file, information about the component shipping the logs, the name of the shipper’s name in the output, and there is a `message` field containing log line contents. @@ -587,7 +587,7 @@ This command results in roughly 8,000 requests per second, and the equivalent nu 3. To view a continuous stream of log messages, click **Stream live**. You can also highlight specific terms, as shown here. - ![{{kib}} Logs UI Streaming](../../../images/observability-monitor-java-app-kibana-streaming.png "") + ![{{kib}} Logs UI Streaming](/solutions/images/observability-monitor-java-app-kibana-streaming.png "") Looking at one of the documents being indexed, you can see that the log message is contained in a single field. Verify this by looking at one of those documents. @@ -1294,7 +1294,7 @@ Visualize the number of log messages over time, split by the log level. Since th The final result looks like this. - ![Date Histogram of the log rate per log level](../../../images/observability-monitor-java-app-metrics-kibana-create-visualization-log-rate.png "") + ![Date Histogram of the log rate per log level](/solutions/images/observability-monitor-java-app-metrics-kibana-create-visualization-log-rate.png "") @@ -1364,7 +1364,7 @@ Let’s look at the `process_files_open_files` metric. This should be a rather s Now let’s build a visualization using [Lens](../../../explore-analyze/dashboards.md) in {{kib}}. - ![Lens visualization](../../../images/observability-monitor-java-app-metrics-kibana-create-visualization-open-files.png "") + ![Lens visualization](/solutions/images/observability-monitor-java-app-metrics-kibana-create-visualization-open-files.png "") 5. Below `Add filter`, select the `metricbeat-*` index pattern. This will likely use `filebeat-*` as the default. @@ -1376,7 +1376,7 @@ Let’s look at the `process_files_open_files` metric. This should be a rather s 7. Click **Metrics Explorer**, you can start exploring your data for specific hosts or the CPU usage across your nodes. - ![Metrics UI Log Counter](../../../images/observability-monitor-java-app-metrics-ui-prometheus-event-counter.png "") + ![Metrics UI Log Counter](/solutions/images/observability-monitor-java-app-metrics-ui-prometheus-event-counter.png "") This is an area chart of the total events counter the Javalin app emits. It’s rising because there is a component polling an endpoint that, in turn, produces another log message. The steeper peek was due to sending more requests. But where is the sudden drop-off coming from? A JVM restart. As those metrics are not persisted, they reset on a JVM restart. With that in mind, it’s often better to log the `rate` instead of the `counter` field. @@ -1399,7 +1399,7 @@ Despite a heavily fragmented APM landscape, the terminology often is similar. Th A transaction encapsulates a series of spans, which contain information about the execution of a piece of code. Let’s take a look at this screenshot from the {{kib}} Applications UI. -![A transaction with spans](../../../images/observability-monitor-java-app-apm-transactions.png "") +![A transaction with spans](/solutions/images/observability-monitor-java-app-apm-transactions.png "") This is a Spring Boot application. The `UserProfileController.showProfile()` method is called, which is marked as the transaction. There are two spans within. First, a request is sent to {{es}} using the {{es}} REST client, and after the response is rendered using Thymeleaf. The request to {{es}} is faster than the rendering in this case. @@ -1527,7 +1527,7 @@ A programmatic setup allows you to attach the agent via a line of java in your s Wait a few minutes and let’s finally take a look at the Applications UI. - ![Javalin App Applications UI](../../../images/observability-monitor-java-app-apm-ui-javalin-app.png "") + ![Javalin App Applications UI](/solutions/images/observability-monitor-java-app-apm-ui-javalin-app.png "") As you can see, this is quite the difference to the Spring Boot application shown earlier. The different endpoints are not listed; we can see the requests per minute though including errors. @@ -1557,7 +1557,7 @@ A programmatic setup allows you to attach the agent via a line of java in your s 3. Restart your app and see data flowing in. Test a few different endpoints, especially the one that throws exceptions and the one that triggers a 404. - ![Applications UI with correct transaction names](../../../images/observability-monitor-java-app-apm-ui-javalin-with-transaction-names.png "") + ![Applications UI with correct transaction names](/solutions/images/observability-monitor-java-app-apm-ui-javalin-with-transaction-names.png "") This looks much better, having differences between endpoints. @@ -1591,11 +1591,11 @@ A programmatic setup allows you to attach the agent via a line of java in your s In the overview, you can see that most time is spent in the HTTP client, which is not surprising. - ![Overview](../../../images/observability-monitor-java-app-apm-ui-javalin-wttr-1.png "") + ![Overview](/solutions/images/observability-monitor-java-app-apm-ui-javalin-wttr-1.png "") Our transactions for the `/weather/Munich` now contain a span, showing how much time is spent on retrieving the weather data. Because the HTTP client is instrumented automatically, there is no need to do anything. - ![Transaction with span](../../../images/observability-monitor-java-app-apm-ui-javalin-wttr-2.png "") + ![Transaction with span](/solutions/images/observability-monitor-java-app-apm-ui-javalin-wttr-2.png "") If the `city` parameter if that URL is of high cardinality, this will result in a high amount of URLs mentioned instead of the generic endpoint. If you would like to prevent this, a possibility would be to use `ctx.matchedPath()` to log every call to the weather API as `GET /weather/:city`. This however requires some refactoring by removing the `app.before()` handler and replacing it with a `app.after()` handler. @@ -1651,7 +1651,7 @@ ELASTIC_APM_TRACE_METHODS="de.spinscale.javalin.Log4j2RequestLogger#handle" 3. Restart your app, and see how much time your logging takes. - ![Logging caller trace](../../../images/observability-monitor-java-app-apm-ui-logging-trace.png "") + ![Logging caller trace](/solutions/images/observability-monitor-java-app-apm-ui-logging-trace.png "") The request logger takes roughly 400 microseconds. The whole request takes about 1.3 milliseconds. Approximately a third of the processing of our request goes into logging. @@ -1861,7 +1861,7 @@ By default, Windows log files are stored in `C:\ProgramData\heartbeat\Logs`. ::::::: To view the {{uptime-app}}, select **{{observability}}** → **Uptime**. The overview looks like this. -![Uptime Overview](../../../images/observability-monitor-java-app-uptime-overview.png "") +![Uptime Overview](/solutions/images/observability-monitor-java-app-uptime-overview.png "") You can see the list of monitors and a global overview. Let’s see the details for one of those alerts. Click **Javalin Web Application**. diff --git a/solutions/observability/apps/uptime-monitoring-deprecated.md b/solutions/observability/apps/uptime-monitoring-deprecated.md index e44b35e8f5..0374933c80 100644 --- a/solutions/observability/apps/uptime-monitoring-deprecated.md +++ b/solutions/observability/apps/uptime-monitoring-deprecated.md @@ -37,7 +37,7 @@ In the {{uptime-app}}, you can monitor the status of network endpoints using the | **ICMP monitor** | Check the availability of your hosts. The ICMP monitor uses ICMP (v4 and v6) EchoRequests to check the network reachability of the hosts you are pinging. This will tell you whether thehost is available and connected to the network, but doesn’t tell you if a service on the host is running ornot. | | **TCP monitor** | Monitor the services running on your hosts. The TCP monitor checks individual portsto make sure the service is accessible and running. | -:::{image} ../../../images/observability-uptime-app.png +:::{image} /solutions/images/observability-uptime-app.png :alt: {{uptime-app}} in {{kib}} :screenshot: ::: @@ -51,7 +51,7 @@ The TLS Certificates page in the {{uptime-app}} lists the TLS certificates that In addition to the common name, associated monitors, issuer information, and SHA fingerprints, an assigned status is derived from the threshold values in the [Settings](configure-settings.md) page. -:::{image} ../../../images/observability-tls-certificates.png +:::{image} /solutions/images/observability-tls-certificates.png :alt: TLS certificates :screenshot: ::: diff --git a/solutions/observability/apps/use-advanced-queries-on-application-data.md b/solutions/observability/apps/use-advanced-queries-on-application-data.md index f6f1f0069a..3a50bb6475 100644 --- a/solutions/observability/apps/use-advanced-queries-on-application-data.md +++ b/solutions/observability/apps/use-advanced-queries-on-application-data.md @@ -17,7 +17,7 @@ The query bar comes with a handy autocomplete that helps find the fields and eve When you type, you can begin to see some of the transaction fields available for filtering: -:::{image} ../../../images/observability-apm-query-bar.png +:::{image} /solutions/images/observability-apm-query-bar.png :alt: Example of the Kibana Query bar in Applications UI in Kibana :screenshot: ::: @@ -56,19 +56,19 @@ processor.event: "transaction" AND transaction.name: "" a In this example, we’re interested in viewing all of the `APIRestController#customers` transactions that took between 13 and 14 milliseconds. Here’s what Discover returns: -:::{image} ../../../images/observability-advanced-discover.png +:::{image} /solutions/images/observability-advanced-discover.png :alt: View all transactions in bucket :screenshot: ::: You can now explore the data until you find a specific transaction that you’re interested in. Copy that transaction’s `transaction.id` and paste it into APM to view the data in the context of the APM: -:::{image} ../../../images/observability-specific-transaction-search.png +:::{image} /solutions/images/observability-specific-transaction-search.png :alt: View specific transaction in Applications UI :screenshot: ::: -:::{image} ../../../images/observability-specific-transaction.png +:::{image} /solutions/images/observability-specific-transaction.png :alt: View specific transaction in Applications UI :screenshot: ::: \ No newline at end of file diff --git a/solutions/observability/apps/use-environment-variables-in-configuration.md b/solutions/observability/apps/use-environment-variables-in-configuration.md index 0f040e4d0e..8e5ba8920f 100644 --- a/solutions/observability/apps/use-environment-variables-in-configuration.md +++ b/solutions/observability/apps/use-environment-variables-in-configuration.md @@ -8,7 +8,7 @@ applies_to: # Use environment variables in the configuration [apm-config-env] ::::{note} -![supported deployment methods](../../../images/observability-binary-yes-fm-no.svg "") +![supported deployment methods](/solutions/images/observability-binary-yes-fm-no.svg "") This documentation is only relevant for APM Server binary users. diff --git a/solutions/observability/apps/use-opentelemetry-with-apm.md b/solutions/observability/apps/use-opentelemetry-with-apm.md index 19987212d0..1f493b9d4b 100644 --- a/solutions/observability/apps/use-opentelemetry-with-apm.md +++ b/solutions/observability/apps/use-opentelemetry-with-apm.md @@ -33,7 +33,7 @@ This functionality is in technical preview and may be changed or removed in a fu Elastic offers several distributions of OpenTelemetry language SDKs. A *distribution* is a customized version of an upstream OpenTelemetry repository. Each Elastic Distribution of OpenTelemetry is a customized version of an [OpenTelemetry language SDK](https://opentelemetry.io/docs/languages/). -:::{image} ../../../images/observability-apm-otel-distro.png +:::{image} /solutions/images/observability-apm-otel-distro.png :alt: apm otel distro :screenshot: ::: @@ -61,7 +61,7 @@ For more details about OpenTelemetry distributions in general, visit the [OpenTe Use the OpenTelemetry API/SDKs with [Elastic APM agents](../../../solutions/observability/apps/fleet-managed-apm-server.md#_step_3_install_apm_agents) to translate OpenTelemetry API calls to Elastic APM API calls. -:::{image} ../../../images/observability-apm-otel-api-sdk-elastic-agent.png +:::{image} /solutions/images/observability-apm-otel-api-sdk-elastic-agent.png :alt: apm otel api sdk elastic agent :screenshot: ::: @@ -84,7 +84,7 @@ The {{stack}} natively supports the OpenTelemetry protocol (OTLP). This means tr You can set up an [OpenTelemetry Collector](https://opentelemetry.io/docs/collector/), instrument your application with an [OpenTelemetry language SDK](https://opentelemetry.io/docs/languages/) that sends data to the collector, and use the collector to process and export the data to APM Server. -:::{image} ../../../images/observability-apm-otel-api-sdk-collector.png +:::{image} /solutions/images/observability-apm-otel-api-sdk-collector.png :alt: apm otel api sdk collector :screenshot: ::: diff --git a/solutions/observability/apps/use-synthetics-recorder.md b/solutions/observability/apps/use-synthetics-recorder.md index 9e4de7bbcf..5f64161343 100644 --- a/solutions/observability/apps/use-synthetics-recorder.md +++ b/solutions/observability/apps/use-synthetics-recorder.md @@ -14,7 +14,7 @@ As with any script recording technology, the Elastic Synthetics Recorder should You can use the Synthetics Recorder to [write a synthetic test](../../../solutions/observability/apps/write-synthetic-test.md) by interacting with a web page and exporting journey code that reflects all the actions you took. -:::{image} ../../../images/observability-synthetics-create-test-script-recorder.png +:::{image} /solutions/images/observability-synthetics-create-test-script-recorder.png :alt: Elastic Synthetics Recorder after recording a journey and clicking Export :screenshot: ::: diff --git a/solutions/observability/apps/use-synthetics-with-traffic-filters.md b/solutions/observability/apps/use-synthetics-with-traffic-filters.md index 8a2667d957..ff3dc178a5 100644 --- a/solutions/observability/apps/use-synthetics-with-traffic-filters.md +++ b/solutions/observability/apps/use-synthetics-with-traffic-filters.md @@ -50,7 +50,7 @@ Once you know the CIDR blocks for your testing sources, add them to your {{es}} For example, if you had a {{private-location}} running with a public CIDR block of `1.2.3.4/32` and were running tests from the `Europe - United Kingdom` region, you would first create a traffic filter with the following: -:::{image} ../../../images/observability-synthetics-traffic-filters-create-filter.png +:::{image} /solutions/images/observability-synthetics-traffic-filters-create-filter.png :alt: Create a traffic filter in {{ecloud}} :screenshot: ::: diff --git a/solutions/observability/apps/view-elasticsearch-index-template.md b/solutions/observability/apps/view-elasticsearch-index-template.md index 52d55e7a1d..8f44b8ca97 100644 --- a/solutions/observability/apps/view-elasticsearch-index-template.md +++ b/solutions/observability/apps/view-elasticsearch-index-template.md @@ -59,13 +59,13 @@ In the **Index settings** step, you can specify custom [index settings](elastics * Add custom field mappings that you can index on and search. In the **Mapped fields** tab, add a new field including the [field type](elasticsearch://reference/elasticsearch/mapping-reference/field-data-types.md): - :::{image} ../../../images/observability-custom-index-template-mapped-fields.png + :::{image} /solutions/images/observability-custom-index-template-mapped-fields.png :alt: Editing a component template to add a new mapped field ::: * Add a [runtime field](../../../manage-data/data-store/mapping/runtime-fields.md) that is evaluated at query time. In the **Runtime fields** tab, click **Create runtime field** and provide a field name, type, and optionally a script: - :::{image} ../../../images/observability-custom-index-template-runtime-fields.png + :::{image} /solutions/images/observability-custom-index-template-runtime-fields.png :alt: Editing a component template to add a new runtime field ::: diff --git a/solutions/observability/apps/view-monitor-status.md b/solutions/observability/apps/view-monitor-status.md index f9f40d0286..4072635d8d 100644 --- a/solutions/observability/apps/view-monitor-status.md +++ b/solutions/observability/apps/view-monitor-status.md @@ -22,7 +22,7 @@ Each endpoint, URL, and service represents a *monitor*. To get started with your analysis, use the automated filter options, such as location, port, scheme, and tags, or define a custom filter by field, URL, monitor ID, and other attributes. -:::{image} ../../../images/observability-uptime-filter-bar.png +:::{image} /solutions/images/observability-uptime-filter-bar.png :alt: Uptime filter bar :screenshot: ::: @@ -34,7 +34,7 @@ The snapshot panel displays the overall status of the environment you’re monit Next to the counts, a histogram shows a count of **Pings over time** with a breakdown of `Up` and `Down` counts per time bucket. -:::{image} ../../../images/observability-monitors-chart.png +:::{image} /solutions/images/observability-monitors-chart.png :alt: Monitors chart :screenshot: ::: @@ -51,7 +51,7 @@ Use monitor tags to display a custom assortment of monitors; for example, consid Expand the table row for a specific monitor on the list to view additional information such as which alerts are configured for the monitor, a recent error and when it occurred, the date and time of any recent test runs, and it’s URL. -:::{image} ../../../images/observability-monitors-list.png +:::{image} /solutions/images/observability-monitors-list.png :alt: Monitors list :screenshot: ::: diff --git a/solutions/observability/apps/work-with-params-secrets.md b/solutions/observability/apps/work-with-params-secrets.md index ec1b14334d..7302d1830a 100644 --- a/solutions/observability/apps/work-with-params-secrets.md +++ b/solutions/observability/apps/work-with-params-secrets.md @@ -40,7 +40,7 @@ From any page in the Synthetics UI: 2. Go to the **Global parameters** tab. 3. Define parameters. -:::{image} ../../../images/observability-synthetics-params-secrets-kibana-define.png +:::{image} /solutions/images/observability-synthetics-params-secrets-kibana-define.png :alt: Global parameters tab on the Synthetics Settings page :screenshot: ::: @@ -119,14 +119,14 @@ journey("My Journey", ({ page, params }) => { To use a param in a lightweight monitor that is created in the Synthetics UI, wrap the name of the param in `${}` (for example, `${my_url}`). -:::{image} ../../../images/serverless-synthetics-params-secrets-kibana-use-lightweight.png +:::{image} /solutions/images/serverless-synthetics-params-secrets-kibana-use-lightweight.png :alt: Use a param in a lightweight monitor created in the Synthetics UI :screenshot: ::: To use a param in a browser monitor that is created in the Synthetics UI, add `params.` before the name of the param (for example, `params.my_url`). -:::{image} ../../../images/observability-synthetics-params-secrets-kibana-use-lightweight.png +:::{image} /solutions/images/observability-synthetics-params-secrets-kibana-use-lightweight.png :alt: Use a param in a lightweight monitor created in the Synthetics UI :screenshot: ::: diff --git a/solutions/observability/cicd.md b/solutions/observability/cicd.md index 6f227a9355..6848f7a111 100644 --- a/solutions/observability/cicd.md +++ b/solutions/observability/cicd.md @@ -18,7 +18,7 @@ To provide monitoring dashboards, alerting, and root cause analysis on pipelines Using the APM Server, connect all your OpenTelemetry native CI/CD tools directly to Elastic {{observability}}. -:::{image} ../../images/observability-simple-arch-observability.png +:::{image} /solutions/images/observability-simple-arch-observability.png :alt: Simple architecture of CI/CD observability with Elastic :title: Architecture of CI/CD observability with Elastic ::: @@ -28,7 +28,7 @@ A more advanced CI/CD observability architecture includes an OpenTelemetry Colle * Low latency between the CI/CD tools and the collector is particularly beneficial to ephemeral tools like the otel-cli. * The ability to route the observability signals to multiple backends in addition to Elastic {{observability}}. -:::{image} ../../images/observability-advanced-arch-observability.png +:::{image} /solutions/images/observability-advanced-arch-observability.png :alt: Advanced architecture of CI/CD observability with Elastic :title: Advanced architecture of CI/CD observability with Elastic ::: @@ -45,19 +45,19 @@ Elastic {{observability}} helps CI/CD administrators monitor their platform by p The Jenkins health dashboards provide insights on the build executions, the failures, the provisioning of build agents, the active and idle workers, or the JVM health. -:::{image} ../../images/observability-ci-cd-overview.png +:::{image} /solutions/images/observability-ci-cd-overview.png :alt: CI/CD overview :title: Jenkins KPIs in Elastic {{observability}} :screenshot: ::: -:::{image} ../../images/observability-jenkins-kpis.png +:::{image} /solutions/images/observability-jenkins-kpis.png :alt: Jenkins KPIs :title: Jenkins Provisioning KPIs in Elastic {{observability}} :screenshot: ::: -:::{image} ../../images/observability-jenkins-jvm-indicators.png +:::{image} /solutions/images/observability-jenkins-jvm-indicators.png :alt: Jenkins JVM health indicators :title: Jenkins JVM health indicators in Elastic {{observability}} :screenshot: @@ -72,7 +72,7 @@ Elastic {{observability}} enables troubleshooting CI platform outages by providi In the following image, a Jenkins CI build failed, and its exceptions are reported as errors. Select any of those errors to view the specific information. In this case, it’s errors relating to the CI agent that stopped. -:::{image} ../../images/observability-jenkins-pipeline-build.png +:::{image} /solutions/images/observability-jenkins-pipeline-build.png :alt: Jenkins pipeline builds :title: Jenkins pipeline build error in Elastic {{observability}} :screenshot: @@ -80,13 +80,13 @@ In the following image, a Jenkins CI build failed, and its exceptions are report The Errors overview screen provides a high-level view of the exceptions that CI builds catch. Similar errors are grouped to quickly see which ones are affecting your services and allow you to take action to rectify them. -:::{image} ../../images/observability-jenkins-pipeline-errors.png +:::{image} /solutions/images/observability-jenkins-pipeline-errors.png :alt: Jenkins pipeline build errors :title: Jenkins jobs and pipelines errors in Elastic {{observability}} :screenshot: ::: -:::{image} ../../images/observability-concourse-ci-traces.png +:::{image} /solutions/images/observability-concourse-ci-traces.png :alt: Concourse CI traces view :title: Concourse CI pipeline execution as a trace in Elastic {{observability}} :screenshot: @@ -106,7 +106,7 @@ The visualization of CI/CD pipelines as distributed traces in Elastic {{observab The Applications Services view in Elastic {{observability}} provides a view of all your instrumented CI/CD servers with insights on their KPIs. -:::{image} ../../images/observability-jenkins-servers.png +:::{image} /solutions/images/observability-jenkins-servers.png :alt: Jenkins servers view :title: Jenkins servers in Elastic {{observability}} :screenshot: @@ -114,7 +114,7 @@ The Applications Services view in Elastic {{observability}} provides a view of a The Service page provides more granular insights into your CI/CD workflows by breaking down health and performance metrics by pipeline. To quickly view which pipelines experience the most errors, are the most frequently executed, or are the slowest, you can sort and filter the list. -:::{image} ../../images/observability-jenkins-server.png +:::{image} /solutions/images/observability-jenkins-server.png :alt: Jenkins server view :title: A Jenkins server in Elastic {{observability}} :screenshot: @@ -125,7 +125,7 @@ The Service page provides more granular insights into your CI/CD workflows by br Once you’ve identified the pipeline you want to troubleshoot, you can drill down to get more detailed information about its performance over time. The pipeline summary shows a breakdown of duration and failure rates across the pipeline’s individual builds and jobs to spot slowdowns or failures. -:::{image} ../../images/observability-jenkins-pipeline-overview.png +:::{image} /solutions/images/observability-jenkins-pipeline-overview.png :alt: Jenkins pipeline overview :title: Performance overview of a Jenkins pipeline in Elastic {{observability}} :screenshot: @@ -133,7 +133,7 @@ Once you’ve identified the pipeline you want to troubleshoot, you can drill do The pipelines and traditional jobs are instrumented automatically. If you spot a slow or failing build and need to understand what’s happening, you can drill into the trace view of the build to look for the high duration jobs or jobs with errors. You can then dig into the details to understand the source of the error. -:::{image} ../../images/observability-jenkins-pipeline-trace.png +:::{image} /solutions/images/observability-jenkins-pipeline-trace.png :alt: Trace of a Jenkins pipeline build :title: A Jenkins pipeline build as a trace in Elastic {{observability}} :screenshot: @@ -141,7 +141,7 @@ The pipelines and traditional jobs are instrumented automatically. If you spot a To investigate further, you can view the details of the build captured as labels. -:::{image} ../../images/observability-jenkins-pipeline-context.png +:::{image} /solutions/images/observability-jenkins-pipeline-context.png :alt: Attributes of a Jenkins pipeline execution :title: Contextual attributes of a Jenkins pipeline execution in Elastic {{observability}} :screenshot: @@ -184,14 +184,14 @@ Visualizing logs both in Elastic and through Jenkins is recommended because it p The Jenkins OpenTelemetry Plugin provides pipeline log storage in {{es}} while enabling you to visualize the logs in {{kib}} and continue to display them through the Jenkins pipeline build console. -:::{image} ../../images/observability-ci-cd-visualize-logs-kibana-and-jenkins-console.png +:::{image} /solutions/images/observability-ci-cd-visualize-logs-kibana-and-jenkins-console.png :alt: Jenkins Console Output page displaying both log contents and a link to view logs in Elastic {{observability}} :screenshot: ::: This more advanced setup requires connecting the Jenkins Controller to {{es}} with read permissions on the `logs-apm.app` and preferably on the Metadata of the {{ilm-init}} policy of this index template (by default it’s the `logs-apm.app_logs-default_policy` policy). Use "Validate {{es}} configuration" to verify the setup. -:::{image} ../../images/observability-ci-cd-visualize-logs-kibana-and-jenkins-architecture.png +:::{image} /solutions/images/observability-ci-cd-visualize-logs-kibana-and-jenkins-architecture.png :alt: Architecture diagram for storing pipeline logs in Elastic and visualizing logs in both Elastic and Jenkins :title: Architecture for storing pipeline logs in Elastic and visualizing logs in both Elastic and Jenkins ::: @@ -201,12 +201,12 @@ This more advanced setup requires connecting the Jenkins Controller to {{es}} wi Visualizing logs exclusively in {{kib}} involves a simpler setup that doesn’t require access to {{es}} from the Jenkins Controller. This is because the Jenkins pipeline build console displays a hyperlink to the {{kib}} logs visualization screen instead of displaying the logs in the Jenkins UI. -:::{image} ../../images/observability-ci-cd-visualize-logs-kibana-console.png +:::{image} /solutions/images/observability-ci-cd-visualize-logs-kibana-console.png :alt: Jenkins Console Output page with link to view logs in Elastic {{observability}} :screenshot: ::: -:::{image} ../../images/observability-ci-cd-visualize-logs-kibana-architecture.png +:::{image} /solutions/images/observability-ci-cd-visualize-logs-kibana-architecture.png :alt: Architecture diagram for storing pipeline logs in Elastic and visualizing logs exclusively in Elastic :title: Architecture for storing pipeline logs in Elastic and visualizing logs exclusively in Elastic ::: @@ -224,7 +224,7 @@ Observing CI/CD pipelines is achieved by instrumenting the different CI/CD and D 1. On the Jenkins UI, go to **Manage Jenkins** > **Manage Plugins**. - :::{image} ../../images/observability-jenkins-plugin-manager.png + :::{image} /solutions/images/observability-jenkins-plugin-manager.png :alt: Jenkins Plugin Manager :screenshot: ::: @@ -246,7 +246,7 @@ The OpenTelemetry plugin needs to be configured to report data to an OpenTelemet * If using the Elastic APM secret token authorization, select a **Bearer Authentication Token**, and add the token as a Jenkins secret text credential. - :::{image} ../../images/observability-configure-otel-plugin.png + :::{image} /solutions/images/observability-configure-otel-plugin.png :alt: Configure OTEL plugin :screenshot: ::: @@ -259,7 +259,7 @@ The OpenTelemetry plugin needs to be configured to report data to an OpenTelemet 1. Go to **Add Visualisation Observability Backend** and define the URL for your {{kib}} server. - :::{image} ../../images/observability-kibana-url.png + :::{image} /solutions/images/observability-kibana-url.png :alt: Define {{kib}} URL :screenshot: ::: @@ -289,7 +289,7 @@ For instance, you can follow the below steps: * Import the dashboard in the {{kib}} UI -:::{image} ../../images/observability-jenkins-dashboard-import.png +:::{image} /solutions/images/observability-jenkins-dashboard-import.png :alt: Import {{kib}} dashboard :title: Import dashboard in {{kib}} :screenshot: @@ -297,13 +297,13 @@ For instance, you can follow the below steps: * The new dashboard is now ready to be used: -:::{image} ../../images/observability-jenkins-dashboard-ready.png +:::{image} /solutions/images/observability-jenkins-dashboard-ready.png :alt: Jenkins dashboard in {{kib}} :title: Jenkins dashboard in {{kib}} is ready :screenshot: ::: -:::{image} ../../images/observability-jenkins-dashboard.png +:::{image} /solutions/images/observability-jenkins-dashboard.png :alt: Jenkins dashboard :title: Jenkins dashboard in {{kib}} :screenshot: @@ -357,7 +357,7 @@ You can also trigger your Maven builds from the CI platform and visualize the en When invoking Maven builds with Jenkins, it’s unnecessary to use environment variables to configure the Maven build (`OTEL_EXPORTER_OTLP_ENDPOINT…`) to rely on the Jenkins capability to inject OpenTelemetry configuration as environment variables. For more details, refer to [Install the OpenTelemetry plugin](#ci-cd-install-jenkins). -:::{image} ../../images/observability-jenkins-maven-pipeline.png +:::{image} /solutions/images/observability-jenkins-maven-pipeline.png :alt: Maven builds in Jenkins :title: A Jenkins pipeline executing Maven builds :screenshot: @@ -374,7 +374,7 @@ You can configure your Ansible playbooks with the [Ansible OpenTelemetry callbac The context propagation from the Jenkins job or pipeline is passed to the Ansible run. Therefore, everything that happens in the CI is also shown in the traces. -:::{image} ../../images/observability-jenkins-ansible-pipeline.png +:::{image} /solutions/images/observability-jenkins-ansible-pipeline.png :alt: Ansible playbooks in Jenkins :title: Visibility into your Ansible playbooks :screenshot: @@ -382,7 +382,7 @@ The context propagation from the Jenkins job or pipeline is passed to the Ansibl This integration feeds, out of the box, the Service Map with all the services that are connected to the Ansible Playbook. All of these features can help you quickly and visually assess your services used in your provisioning and Continuous Deployment. -:::{image} ../../images/observability-ansible-service-map.png +:::{image} /solutions/images/observability-ansible-service-map.png :alt: Ansible service map view :title: ServiceMap view of a Jenkins pipeline execution instrumented with the Ansible plugin :screenshot: @@ -397,13 +397,13 @@ AWX requires an Execution Environment with the Ansible and Python packages insta To inject the environment variables and service details, use custom credential types and assign the credentials to the Playbook template. This gives you the flexibility to reuse the endpoint details for Elastic APM and also standardize on custom fields for reporting purposes. -:::{image} ../../images/observability-ansible-automation-apm-endpoint.png +:::{image} /solutions/images/observability-ansible-automation-apm-endpoint.png :alt: Applications Services Endpoint in Ansible Tower :title: An Applications Services Endpoint in Ansible AWX/Tower :screenshot: ::: -:::{image} ../../images/observability-ansible-automation-apm-service-details.png +:::{image} /solutions/images/observability-ansible-automation-apm-service-details.png :alt: Custom fields in Ansible Tower :title: Custom fileds in Ansible AWX/Tower :screenshot: @@ -457,13 +457,13 @@ export OTEL_TRACES_EXPORTER="otlp" make login build push ``` -:::{image} ../../images/observability-jenkins-makefile.png +:::{image} /solutions/images/observability-jenkins-makefile.png :alt: Jenkins build executing an instrumented Makefile :title: A Jenkins build executing a Makefile instrumented with the otel-cli in Elastic {{observability}} :screenshot: ::: -:::{image} ../../images/observability-jenkins-service-map.png +:::{image} /solutions/images/observability-jenkins-service-map.png :alt: Jenkins service map view :title: ServiceMap view of a Jenkins pipeline execution instrumented with the otel-cli :screenshot: @@ -483,7 +483,7 @@ OTEL_SERVICE_NAME=pytest_otel \ pytest --otel-session-name='My_Test_cases' ``` -:::{image} ../../images/observability-pytest-otel-pipeline.png +:::{image} /solutions/images/observability-pytest-otel-pipeline.png :alt: Pytest tests :title: Visibility into your Pytest tests :screenshot: @@ -503,7 +503,7 @@ Context propagation is supported; therefore, you can benefit from the integratio Once Concourse CI tracing is configured, Concourse CI pipeline executions are reported in Elastic {{observability}}. -:::{image} ../../images/observability-jenkins-concourse.png +:::{image} /solutions/images/observability-jenkins-concourse.png :alt: Concourse CI pipeline execution :title: A Concourse CI pipeline execution in Elastic {{observability}} :screenshot: @@ -520,7 +520,7 @@ Elastic {{observability}} exposes HTTP APIs to check the health of services. You The following example shows a canary deployment pipeline that leverages Elastic health check HTTP APIs to automate the quality check before rolling out the deployment from the canary to the entire set of instances: -:::{image} ../../images/observability-ci-cd-canary-deployment-pipeline.png +:::{image} /solutions/images/observability-ci-cd-canary-deployment-pipeline.png :alt: Canary Deployment Pipeline ::: diff --git a/solutions/observability/cloud/gcp-dataflow-templates.md b/solutions/observability/cloud/gcp-dataflow-templates.md index 0d9c84de96..955bac61cf 100644 --- a/solutions/observability/cloud/gcp-dataflow-templates.md +++ b/solutions/observability/cloud/gcp-dataflow-templates.md @@ -30,13 +30,13 @@ You’ll start with installing the Elastic GCP integration to add pre-built dash 1. Find **Integrations** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). 2. Search for `gcp`. - :::{image} ../../../images/observability-monitor-gcp-kibana-integrations.png + :::{image} /solutions/images/observability-monitor-gcp-kibana-integrations.png :alt: {{kib}} integrations ::: 3. Click the Elastic Google Cloud Platform (GCP) integration to see more details about it, then click **Add Google Cloud Platform (GCP)**. - :::{image} ../../../images/observability-monitor-gcp-integration.png + :::{image} /solutions/images/observability-monitor-gcp-integration.png :alt: GCP integration ::: @@ -47,7 +47,7 @@ This tutorial assumes the Elastic cluster is already running. To continue, you To find the Cloud ID of your [deployment](https://cloud.elastic.co/deployments), go to the deployment’s **Overview** page. -![Cloud ID](../../../images/observability-monitor-gcp-cloud-id.png "") +![Cloud ID](/solutions/images/observability-monitor-gcp-cloud-id.png "") Use [{{kib}}](../../../deploy-manage/api-keys/elasticsearch-api-keys.md#create-api-key) to create a Base64-encoded API key to authenticate on your deployment. @@ -67,37 +67,37 @@ Before configuring the Dataflow template, create a Pub/Sub topic and subscriptio 1. Go to the **Logs Router** page to configure GCP to export logs to a Pub/Sub topic. Use the search bar to find the page: - :::{image} ../../../images/observability-monitor-gcp-navigate-logs-router.png + :::{image} /solutions/images/observability-monitor-gcp-navigate-logs-router.png :alt: Navigate to Logs Router page ::: To set up the logs routing sink, click **Create sink**. Set **sink name** as `monitor-gcp-audit-sink`. Select the **Cloud Pub/Sub topic** as the **sink service** and **Create new Cloud Pub/Sub topic** named `monitor-gcp-audit`: - :::{image} ../../../images/observability-monitor-gcp-create-pubsub-topic.png + :::{image} /solutions/images/observability-monitor-gcp-create-pubsub-topic.png :alt: Create Pub/Sub topic ::: Finally, under **Choose logs to include in sink**, add `logName:"cloudaudit.googleapis.com"` (it includes all audit logs). Click **create sink**. It will look something like the following: - :::{image} ../../../images/observability-monitor-gcp-create-sink.png + :::{image} /solutions/images/observability-monitor-gcp-create-sink.png :alt: Create logs routing sink ::: 2. Now go to the **Pub/Sub** page to add a subscription to the topic you just created. Use the search bar to find the page: - :::{image} ../../../images/observability-monitor-gcp-pub-sub.png + :::{image} /solutions/images/observability-monitor-gcp-pub-sub.png :alt: GCP Pub/Sub ::: To add a subscription to the `monitor-gcp-audit` topic click **Create subscription**: - :::{image} ../../../images/observability-monitor-gcp-pub-sub-create-subscription.png + :::{image} /solutions/images/observability-monitor-gcp-pub-sub-create-subscription.png :alt: Create GCP Pub/Sub Subscription ::: Set `monitor-gcp-audit-sub` as the **Subscription ID** and leave the **Delivery type** as pull: - :::{image} ../../../images/observability-monitor-gcp-pub-sub-subscription-id.png + :::{image} /solutions/images/observability-monitor-gcp-pub-sub-subscription-id.png :alt: GCP Pub/Sub Subscription ID ::: @@ -109,19 +109,19 @@ Before configuring the Dataflow template, create a Pub/Sub topic and subscriptio After creating a Pub/Sub topic and subscription, go to the **Dataflow Jobs** page and configure your template to use them. Use the search bar to find the page: -:::{image} ../../../images/observability-monitor-gcp-dataflow-jobs.png +:::{image} /solutions/images/observability-monitor-gcp-dataflow-jobs.png :alt: GCP Dataflow Jobs ::: To create a job, click **Create Job From Template**. Set **Job name** as `auditlogs-stream` and select `Pub/Sub to Elasticsearch` from the **Dataflow template** dropdown menu: -:::{image} ../../../images/observability-monitor-gcp-dataflow-pub-sub-elasticsearch.png +:::{image} /solutions/images/observability-monitor-gcp-dataflow-pub-sub-elasticsearch.png :alt: GCP Dataflow Pub/Sub to {{es}} ::: Before running the job, fill in required parameters: -:::{image} ../../../images/observability-monitor-gcp-dataflow-required-parameters.png +:::{image} /solutions/images/observability-monitor-gcp-dataflow-required-parameters.png :alt: GCP Dataflow Required Parameters ::: @@ -133,7 +133,7 @@ For **Cloud Pub/Sub subscription**, use the subscription you created in the prev After filling the required parameters, click **Show Optional Parameters** and add `audit` as the log type parameter. -:::{image} ../../../images/observability-monitor-gcp-dataflow-optional-parameters.png +:::{image} /solutions/images/observability-monitor-gcp-dataflow-optional-parameters.png :alt: GCP Dataflow Optional Parameters ::: @@ -141,7 +141,7 @@ When you are all set, click **Run Job** and wait for Dataflow to execute the tem Finally, navigate to {{kib}} to see your logs parsed and visualized in the **[Logs GCP] Audit** dashboard. -:::{image} ../../../images/observability-monitor-gcp-dataflow-audit-dashboard.png +:::{image} /solutions/images/observability-monitor-gcp-dataflow-audit-dashboard.png :alt: GCP audit overview dashboard ::: diff --git a/solutions/observability/cloud/ingestion-options.md b/solutions/observability/cloud/ingestion-options.md index 5e8893b5de..f7b7b5b942 100644 --- a/solutions/observability/cloud/ingestion-options.md +++ b/solutions/observability/cloud/ingestion-options.md @@ -26,7 +26,7 @@ You have a number of options for ingesting data with AWS. The following table he The high-level architecture is shown below. -:::{image} ../../../images/observability-ingest-options-overview.png +:::{image} /solutions/images/observability-ingest-options-overview.png :alt: Ingest options :screenshot: ::: diff --git a/solutions/observability/cloud/monitor-amazon-cloud-compute-ec2.md b/solutions/observability/cloud/monitor-amazon-cloud-compute-ec2.md index 1eacb2774d..ddbb8acf50 100644 --- a/solutions/observability/cloud/monitor-amazon-cloud-compute-ec2.md +++ b/solutions/observability/cloud/monitor-amazon-cloud-compute-ec2.md @@ -67,7 +67,7 @@ For more information {{agent}} and integrations, refer to the [{{fleet}} and {{a {{kib}} provides a full data analytics platform with out-of-the-box dashboards that you can clone and enhance to satisfy your custom visualization use cases. For example, to see an overview of your EC2 instance metrics in {{kib}}, go to the **Dashboard** app and navigate to the **[Metrics AWS] EC2 Overview** dashboard. -:::{image} ../../../images/observability-ec2-overview-dashboard.png +:::{image} /solutions/images/observability-ec2-overview-dashboard.png :alt: Screenshot showing the EC2 overview dashboard :screenshot: ::: diff --git a/solutions/observability/cloud/monitor-amazon-kinesis-data-streams.md b/solutions/observability/cloud/monitor-amazon-kinesis-data-streams.md index 9f6397213f..00db4016fd 100644 --- a/solutions/observability/cloud/monitor-amazon-kinesis-data-streams.md +++ b/solutions/observability/cloud/monitor-amazon-kinesis-data-streams.md @@ -69,7 +69,7 @@ For more information {{agent}} and integrations, refer to the [{{fleet}} and {{a {{kib}} provides a full data analytics platform with out-of-the-box dashboards that you can clone and enhance to satisfy your custom visualization use cases. For example, to see an overview of your Kinesis data streams in {{kib}}, go to the **Dashboard** app and navigate to the **[Metrics AWS] Kinesis Overview** dashboard. -:::{image} ../../../images/observability-kinesis-dashboard.png +:::{image} /solutions/images/observability-kinesis-dashboard.png :alt: Screenshot showing the Kinesis overview dashboard :screenshot: ::: diff --git a/solutions/observability/cloud/monitor-amazon-simple-queue-service-sqs.md b/solutions/observability/cloud/monitor-amazon-simple-queue-service-sqs.md index 0a80755216..68062101a4 100644 --- a/solutions/observability/cloud/monitor-amazon-simple-queue-service-sqs.md +++ b/solutions/observability/cloud/monitor-amazon-simple-queue-service-sqs.md @@ -65,7 +65,7 @@ For more information {{agent}} and integrations, refer to the [{{fleet}} and {{a For example, to see an overview of your SQS metrics in {{kib}}, go to the **Dashboard** app and navigate to the **[Metrics AWS] SQS Overview** dashboard. -:::{image} ../../../images/observability-sqs-dashboard.png +:::{image} /solutions/images/observability-sqs-dashboard.png :alt: Screenshot showing the SQS overview dashboard :screenshot: ::: diff --git a/solutions/observability/cloud/monitor-amazon-simple-storage-service-s3.md b/solutions/observability/cloud/monitor-amazon-simple-storage-service-s3.md index 6bbeaf5d5c..8b3c4ca706 100644 --- a/solutions/observability/cloud/monitor-amazon-simple-storage-service-s3.md +++ b/solutions/observability/cloud/monitor-amazon-simple-storage-service-s3.md @@ -68,7 +68,7 @@ For more information {{agent}} and integrations, refer to the [{{fleet}} and {{a {{kib}} provides a full data analytics platform with out-of-the-box dashboards that you can clone and enhance to satisfy your custom visualization use cases. For example, to see an overview of your S3 metrics in {{kib}}, go to the **Dashboard** app and navigate to the **[Metrics AWS] S3 Overview** dashboard. -:::{image} ../../../images/observability-s3-dashboard.png +:::{image} /solutions/images/observability-s3-dashboard.png :alt: Screenshot showing the S3 dashboard :screenshot: ::: diff --git a/solutions/observability/cloud/monitor-amazon-web-services-aws-with-beats.md b/solutions/observability/cloud/monitor-amazon-web-services-aws-with-beats.md index 8093e4ea96..5cef1e98f4 100644 --- a/solutions/observability/cloud/monitor-amazon-web-services-aws-with-beats.md +++ b/solutions/observability/cloud/monitor-amazon-web-services-aws-with-beats.md @@ -41,7 +41,7 @@ To centralize your logs in {{es}}, you need to have an S3 bucket. {{filebeat}}, In the [AWS S3 console](https://s3.console.aws.amazon.com/s3), click on **Create bucket**. Give the bucket a **name** and specify the **region** in which you want it deployed. -:::{image} ../../../images/observability-creating-a-s3-bucket.png +:::{image} /solutions/images/observability-creating-a-s3-bucket.png :alt: S3 bucket creation ::: @@ -58,7 +58,7 @@ Make sure that the queue is created in the same region as the S3 bucket. :::: -:::{image} ../../../images/observability-creating-a-queue.png +:::{image} /solutions/images/observability-creating-a-queue.png :alt: Queue Creation ::: @@ -103,13 +103,13 @@ Now that your queue is created, go to the properties of the S3 bucket you create Specify that you want to send a notification on every object creation event. -:::{image} ../../../images/observability-configure-event-notification.png +:::{image} /solutions/images/observability-configure-event-notification.png :alt: Event Notification Setting ::: Set the destination as the SQS queue you just created. -:::{image} ../../../images/observability-configure-notification-output.png +:::{image} /solutions/images/observability-configure-notification-output.png :alt: Event Notification Setting ::: @@ -305,13 +305,13 @@ Start {{filebeat}} to collect the logs. Here’s what we’ve achieved so far: -:::{image} ../../../images/observability-one-bucket-archi.png +:::{image} /solutions/images/observability-one-bucket-archi.png :alt: Current Architecture ::: Now, let’s configure the `s3access` fileset. The goal here is to be able to monitor how people access the bucket we created. To do this, we’ll create another bucket and another queue. The new architecture will look like this: -:::{image} ../../../images/observability-two-buckets-archi.png +:::{image} /solutions/images/observability-two-buckets-archi.png :alt: Architecture with Access Logging Enabled ::: @@ -319,7 +319,7 @@ Create a new S3 bucket and SQS queue. Ensure that the event notifications on the Now go back to the first bucket, and go to **Properties** > **Server access logging**. Specify that you want to ship the access logs to the bucket you most recently created. -:::{image} ../../../images/observability-Server-Access-Logging.png +:::{image} /solutions/images/observability-Server-Access-Logging.png :alt: Enabling Server Access Logging ::: @@ -364,7 +364,7 @@ Now that the logs are being shipped to {{es}} we can visualize them in {{kib}}. The filesets we used in the previous steps also come with pre-built dashboards that you can use to visualize the data. In {{kib}}, find **Dashboards** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Search for S3 and select the dashboard called: **[Filebeat AWS] S3 Server Access Log Overview**: -:::{image} ../../../images/observability-S3-Server-Access-Logs.png +:::{image} /solutions/images/observability-S3-Server-Access-Logs.png :alt: S3 Server Access Log Overview ::: @@ -572,18 +572,18 @@ You can now start {{metricbeat}}: Now that the metrics are being streamed to {{es}} we can visualize them in {{kib}}. To open **Infrastructure inventory**, find **Infrastructure** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Make sure to show the **AWS** source and the **EC2 Instances**: -:::{image} ../../../images/observability-EC2-instances.png +:::{image} /solutions/images/observability-EC2-instances.png :alt: Your EC2 Infrastructure ::: The metricsets we used in the previous steps also comes with pre-built dashboard that you can use to visualize the data. In {{kib}}, find **Dashboards** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Search for EC2 and select the dashboard called: **[Metricbeat AWS] EC2 Overview**: -:::{image} ../../../images/observability-ec2-dashboard.png +:::{image} /solutions/images/observability-ec2-dashboard.png :alt: EC2 Overview ::: If you want to track your billings on AWS, you can also check the **[Metricbeat AWS] Billing Overview** dashboard: -:::{image} ../../../images/observability-aws-billing.png +:::{image} /solutions/images/observability-aws-billing.png :alt: Billing Overview ::: diff --git a/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md b/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md index 837f3fa704..5ad5adddbd 100644 --- a/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md +++ b/solutions/observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md @@ -183,7 +183,7 @@ It takes a few minutes for {{agent}} to enroll in {{fleet}}, download the config VPC flow logs are sent to an S3 bucket, which sends a notification to the SQS queue. When {{agent}} detects a new message in the queue, it uses the information in the message to retrieve flow logs from the S3 bucket. {{agent}} processes each message, parses it into fields, and then sends the data to {{es}}. -:::{image} ../../../images/observability-agent-tut-one-bucket-archi.png +:::{image} /solutions/images/observability-agent-tut-one-bucket-archi.png :alt: Diagram of the current logging architecture for VPC flow logs ::: @@ -202,7 +202,7 @@ You create a new S3 bucket and queue for the access logs, then configure the old When you’re done, your monitoring architecture will look like this: -:::{image} ../../../images/observability-agent-tut-two-buckets-archi.png +:::{image} /solutions/images/observability-agent-tut-two-buckets-archi.png :alt: Diagram of the logging architecture with access logging enabled ::: @@ -245,14 +245,14 @@ Notice that you can filter on a specific data stream. For example, set `data_str The AWS integration also comes with pre-built dashboards that you can use to visualize the data. In {{kib}}, open the main menu and click **Dashboard**. Search for `VPC Flow` and select the dashboard called **[Logs AWS] VPC Flow Log Overview**: -:::{image} ../../../images/observability-agent-tut-vpcflowlog-dashboard.png +:::{image} /solutions/images/observability-agent-tut-vpcflowlog-dashboard.png :alt: Screenshot of the VPC Flow Log Overview dashboard :screenshot: ::: Next, open the dashboard called **[Logs AWS] S3 Server Access Log Overview**: -:::{image} ../../../images/observability-agent-tut-s3accesslog-dashboard.png +:::{image} /solutions/images/observability-agent-tut-s3accesslog-dashboard.png :alt: Screenshot of the S3 Server Access Log Overview dashboard :screenshot: ::: @@ -303,7 +303,7 @@ It takes a few minutes for {{agent}} to update its configuration and start colle Now that the metrics are streaming into {{es}}, you can visualize them in {{kib}}. Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Select the `metrics-*` data view, then filter on `data_stream.dataset: "aws.ec2_metrics"`: -:::{image} ../../../images/observability-agent-tut-ec2-metrics-discover.png +:::{image} /solutions/images/observability-agent-tut-ec2-metrics-discover.png :alt: Screenshot of the Discover app showing EC2 metrics :screenshot: ::: @@ -312,14 +312,14 @@ The AWS integration also comes with pre-built dashboards that you can use to vis Search for EC2 and select the dashboard called **[Metrics AWS] EC2 Overview**: -:::{image} ../../../images/observability-agent-tut-ec2-overview-dashboard.png +:::{image} /solutions/images/observability-agent-tut-ec2-overview-dashboard.png :alt: Screenshot of the EC2 Overview dashboard :screenshot: ::: To track your AWS billing, open the **[Metrics AWS] Billing Overview** dashboard: -:::{image} ../../../images/observability-agent-tut-billing-dashboard.png +:::{image} /solutions/images/observability-agent-tut-billing-dashboard.png :alt: Screenshot of the Billing Overview dashboard :screenshot: ::: diff --git a/solutions/observability/cloud/monitor-aws-network-firewall-logs.md b/solutions/observability/cloud/monitor-aws-network-firewall-logs.md index 365ce59339..876c4c436d 100644 --- a/solutions/observability/cloud/monitor-aws-network-firewall-logs.md +++ b/solutions/observability/cloud/monitor-aws-network-firewall-logs.md @@ -43,7 +43,7 @@ AWS PrivateLink is not supported. Make sure the deployment is on AWS, because th ## Step 2: Select a resource [firehose-firewall-step-two] -:::{image} ../../../images/observability-firehose-networkfirewall-firewall.png +:::{image} /solutions/images/observability-firehose-networkfirewall-firewall.png :alt: AWS Network Firewall ::: @@ -54,7 +54,7 @@ Creating a Network Firewall is not trivial and is beyond the scope of this guide ## Step 3: Create a stream in Amazon Data Firehose [firehose-firewall-step-three] -:::{image} ../../../images/observability-firehose-networkfirewall-stream.png +:::{image} /solutions/images/observability-firehose-networkfirewall-stream.png :alt: Firehose stream ::: @@ -89,7 +89,7 @@ The Firehose stream is ready to send logs to our Elastic Cloud deployment. ## Step 4: Enable logging [firehose-firewall-step-four] -:::{image} ../../../images/observability-firehose-networkfirewall-logging.png +:::{image} /solutions/images/observability-firehose-networkfirewall-logging.png :alt: AWS Network Firewall logging ::: @@ -109,7 +109,7 @@ At this point, the Network Firewall will start sending logs to the Firehose stre ## Step 5: Visualize your Network Firewall logs in {{kib}} [firehose-firewall-step-five] -:::{image} ../../../images/observability-firehose-networkfirewall-data-stream.png +:::{image} /solutions/images/observability-firehose-networkfirewall-data-stream.png :alt: Firehose monitor Network Firewall logs ::: @@ -117,7 +117,7 @@ With the new logging settings in place, the Network Firewall starts sending log Navigate to {{kib}} and choose **Visualize your logs with Discover**. -:::{image} ../../../images/observability-firehose-networkfirewall-discover.png +:::{image} /solutions/images/observability-firehose-networkfirewall-discover.png :alt: Visualize Network Firewall logs with Discover :screenshot: ::: diff --git a/solutions/observability/cloud/monitor-cloudtrail-logs.md b/solutions/observability/cloud/monitor-cloudtrail-logs.md index 65a7aeb598..71463e9258 100644 --- a/solutions/observability/cloud/monitor-cloudtrail-logs.md +++ b/solutions/observability/cloud/monitor-cloudtrail-logs.md @@ -42,7 +42,7 @@ Make sure the deployment is on AWS, because the Amazon Data Firehose delivery st ## Step 2: Export Cloudtrail events to CloudWatch [firehose-cloudtrail-step-two] -:::{image} ../../../images/observability-firehose-cloudtrail-cloudwatch.png +:::{image} /solutions/images/observability-firehose-cloudtrail-cloudwatch.png :alt: Cloudtrail to CloudWatch ::: @@ -72,7 +72,7 @@ To export CloudTrail logs to CloudWatch, you must set up a **trail** through the Open the log group you just created on CloudWatch and make sure there are events from the CloudTrail you have just created. - :::{image} ../../../images/observability-firehose-verify-events-cloudwatch.png + :::{image} /solutions/images/observability-firehose-verify-events-cloudwatch.png :alt: Verify events in CloudWatch ::: @@ -80,7 +80,7 @@ To export CloudTrail logs to CloudWatch, you must set up a **trail** through the ## Step 3: Set up a Firehose delivery stream [firehose-cloudtrail-step-three] -:::{image} ../../../images/observability-firehose-delivery-stream.png +:::{image} /solutions/images/observability-firehose-delivery-stream.png :alt: Firehose delivery stream ::: @@ -119,7 +119,7 @@ You now have an Amazon Data Firehose delivery specified with: ## Step 4: Set up a subscription filter to route CloudTrail events to a delivery stream [firehose-cloudtrail-step-four] -:::{image} ../../../images/observability-firehose-subscription-filter.png +:::{image} /solutions/images/observability-firehose-subscription-filter.png :alt: Firehose subscription filter ::: @@ -186,7 +186,7 @@ To check if there are destination error logs, go to the AWS console, visit your If everything is correct, this list should be empty. If there’s an error, you can check the details. The following example shows a delivery stream that fails to send records to the Elastic stack due to bad authentication settings: -:::{image} ../../../images/observability-firehose-failed-delivery-stream.png +:::{image} /solutions/images/observability-firehose-failed-delivery-stream.png :alt: Firehose failed delivery stream ::: @@ -197,7 +197,7 @@ The Amazon Data Firehose delivery stream reports the number of failed deliveries With the new subscription filter running, CloudWatch starts routing new CloudTrail log events to the Firehose delivery stream. -:::{image} ../../../images/observability-firehose-monitor-cloudtrail-logs.png +:::{image} /solutions/images/observability-firehose-monitor-cloudtrail-logs.png :alt: Firehose monitor CloudTrail logs ::: @@ -205,18 +205,18 @@ Navigate to {{kib}} and choose among the following monitoring options: * **Visualize your logs with Discover** - :::{image} ../../../images/observability-firehose-cloudtrail-discover.png + :::{image} /solutions/images/observability-firehose-cloudtrail-discover.png :alt: Visualize CloudTrail logs with Disocver ::: * **Visualize your logs with Logs explorer** - :::{image} ../../../images/observability-firehose-cloudtrail-logsexplorer.png + :::{image} /solutions/images/observability-firehose-cloudtrail-logsexplorer.png :alt: Visualize CloudTrail logs with Logs explorer ::: * **Visualize your logs with the CloudTrail Dashboard** - :::{image} ../../../images/observability-firehose-cloudtrail-dashboard.png + :::{image} /solutions/images/observability-firehose-cloudtrail-dashboard.png :alt: Visualize CloudTrail logs with CloudTrail Dashboard ::: diff --git a/solutions/observability/cloud/monitor-cloudwatch-logs.md b/solutions/observability/cloud/monitor-cloudwatch-logs.md index e8cffe5548..3e7ab0273a 100644 --- a/solutions/observability/cloud/monitor-cloudwatch-logs.md +++ b/solutions/observability/cloud/monitor-cloudwatch-logs.md @@ -44,7 +44,7 @@ AWS PrivateLink is not supported. Make sure the deployment is on AWS, because th ## Step 2: Select a CloudWatch log group to monitor [firehose-cloudwatch-step-two] -:::{image} ../../../images/observability-firehose-cloudwatch-log-group.png +:::{image} /solutions/images/observability-firehose-cloudwatch-log-group.png :alt: CloudWatch log group ::: @@ -88,7 +88,7 @@ With the function ready to go, you can invoke it a few times to generate sample Visit the function’s log group. Usually, the AWS console offers a handy link to jump straight to the log group it created for this function’s logs. You should get something similar to the following: -:::{image} ../../../images/observability-firehose-cloudwatch-sample-logs.png +:::{image} /solutions/images/observability-firehose-cloudwatch-sample-logs.png :alt: CloudWatch log group with sample logs ::: @@ -97,7 +97,7 @@ Take note of the log group name for this Lambda function, as you will need it in ## Step 3: Create a stream in Amazon Data Firehose [firehose-cloudwatch-step-three] -:::{image} ../../../images/observability-firehose-cloudwatch-firehose-stream.png +:::{image} /solutions/images/observability-firehose-cloudwatch-firehose-stream.png :alt: Amazon Firehose Stream ::: @@ -135,7 +135,7 @@ The Firehose stream is now ready to send logs to your Elastic Cloud deployment. ## Step 4: Send Lambda function log events to a Firehose stream [firehose-cloudwatch-step-four] -:::{image} ../../../images/observability-firehose-cloudwatch-subscription-filter.png +:::{image} /solutions/images/observability-firehose-cloudwatch-subscription-filter.png :alt: CloudWatch subscription filter ::: @@ -211,7 +211,7 @@ On the [AWS console](https://console.aws.amazon.com/), navigate to your Firehose If everything is running smoothly, this list is empty. If there’s an error, you can check the details. The following example shows a delivery stream that fails to send records to the Elastic stack due to bad authentication settings: -:::{image} ../../../images/observability-firehose-cloudwatch-destination-errors.png +:::{image} /solutions/images/observability-firehose-cloudwatch-destination-errors.png :alt: Firehose destination errors ::: @@ -223,7 +223,7 @@ The Firehose delivery stream reports: ## Step 5: Visualize your logs in {{kib}} [firehose-cloudwatch-step-five] -:::{image} ../../../images/observability-firehose-cloudwatch-data-stream.png +:::{image} /solutions/images/observability-firehose-cloudwatch-data-stream.png :alt: Vizualize logs in Kibana ::: @@ -231,6 +231,6 @@ With the logs streaming to the Elastic stack, you can now visualize them in {{ki In {{kib}}, navigate to the **Discover** page and select the index pattern that matches the Firehose stream name. Here is a sample of logs from the Lambda function you forwarded to the `logs-aws.generic-default` data stream: -:::{image} ../../../images/observability-firehose-cloudwatch-verify-discover.png +:::{image} /solutions/images/observability-firehose-cloudwatch-verify-discover.png :alt: Sample logs in Discover ::: diff --git a/solutions/observability/cloud/monitor-google-cloud-platform-gcp.md b/solutions/observability/cloud/monitor-google-cloud-platform-gcp.md index 5e5af32498..985ab420aa 100644 --- a/solutions/observability/cloud/monitor-google-cloud-platform-gcp.md +++ b/solutions/observability/cloud/monitor-google-cloud-platform-gcp.md @@ -41,13 +41,13 @@ Google Cloud Platform implements [service accounts](https://cloud.google.com/com First, to access the service account menu, click **Menu** → **IAM & Admin** → **Service Accounts**. -:::{image} ../../../images/observability-monitor-gcp-service-account-menu.png +:::{image} /solutions/images/observability-monitor-gcp-service-account-menu.png :alt: Service account menu ::: Next, click **Create Service Account**. Define the new service account name (for example, "gcp-monitor") and the description (for example, "Service account to monitor GCP services using the {{stack}}"). -:::{image} ../../../images/observability-monitor-gcp-service-account-name.png +:::{image} /solutions/images/observability-monitor-gcp-service-account-name.png :alt: Service account name ::: @@ -61,25 +61,25 @@ To monitor GCP services, you need to add these roles to the service account: **Compute Viewer**: -:::{image} ../../../images/observability-monitor-gcp-service-account-roles-compute-viewer.png +:::{image} /solutions/images/observability-monitor-gcp-service-account-roles-compute-viewer.png :alt: Service account roles compute viewer ::: **Monitoring Viewer**: -:::{image} ../../../images/observability-monitor-gcp-service-account-roles-monitoring-viewer.png +:::{image} /solutions/images/observability-monitor-gcp-service-account-roles-monitoring-viewer.png :alt: Service account roles monitoring viewer ::: **Pub/Sub Subscriber**: -:::{image} ../../../images/observability-monitor-gcp-service-account-roles-pubsub-subscriber.png +:::{image} /solutions/images/observability-monitor-gcp-service-account-roles-pubsub-subscriber.png :alt: Service account roles pub/sub subscriber ::: The final result should be the following: -:::{image} ../../../images/observability-monitor-gcp-service-account-roles-final.png +:::{image} /solutions/images/observability-monitor-gcp-service-account-roles-final.png :alt: Service account roles result ::: @@ -87,13 +87,13 @@ Click **Continue**, then skip granting users access to this service. Finally, cl Next, to use the service account, click **Manage keys**. -:::{image} ../../../images/observability-monitor-gcp-service-account-manage-keys.png +:::{image} /solutions/images/observability-monitor-gcp-service-account-manage-keys.png :alt: Service account manage keys ::: Then, add a new JSON key type by selecting **Create new key**. -:::{image} ../../../images/observability-monitor-gcp-service-account-create-key.png +:::{image} /solutions/images/observability-monitor-gcp-service-account-create-key.png :alt: Service account create key ::: @@ -275,7 +275,7 @@ Extra GCP charges on Stackdriver Monitoring API requests may be generated by thi 5. Finally, log into {{kib}} and open the **[{{metricbeat}} GCP] Compute Overview** dashboard. - ![{{metricbeat}} compute overview dashboard](../../../images/observability-monitor-gcp-compute-overview-dashboard.png "") + ![{{metricbeat}} compute overview dashboard](/solutions/images/observability-monitor-gcp-compute-overview-dashboard.png "") @@ -409,37 +409,37 @@ To collect logs from Google Cloud Platform, use the [Google Cloud Platform](beat 1. Go to the **Logs Router** page to configure GCP to export logs to a Pub/Sub topic. Use the search bar to find the page: - :::{image} ../../../images/observability-monitor-gcp-navigate-logs-router.png + :::{image} /solutions/images/observability-monitor-gcp-navigate-logs-router.png :alt: Navigate to Logs Router page ::: To set up the logs routing sink, click **Create sink**. Set **sink name** as `monitor-gcp-audit-sink`. Select the **Cloud Pub/Sub topic** as the **sink service** and **Create new Cloud Pub/Sub topic** named `monitor-gcp-audit`: - :::{image} ../../../images/observability-monitor-gcp-create-pubsub-topic.png + :::{image} /solutions/images/observability-monitor-gcp-create-pubsub-topic.png :alt: Create Pub/Sub topic ::: Finally, under **Choose logs to include in sink**, add `logName:"cloudaudit.googleapis.com"` (it includes all audit logs). Click **create sink**. It will look something like the following: - :::{image} ../../../images/observability-monitor-gcp-create-sink.png + :::{image} /solutions/images/observability-monitor-gcp-create-sink.png :alt: Create logs routing sink ::: 2. Now go to the **Pub/Sub** page to add a subscription to the topic you just created. Use the search bar to find the page: - :::{image} ../../../images/observability-monitor-gcp-pub-sub.png + :::{image} /solutions/images/observability-monitor-gcp-pub-sub.png :alt: GCP Pub/Sub ::: To add a subscription to the `monitor-gcp-audit` topic click **Create subscription**: - :::{image} ../../../images/observability-monitor-gcp-pub-sub-create-subscription.png + :::{image} /solutions/images/observability-monitor-gcp-pub-sub-create-subscription.png :alt: Create GCP Pub/Sub Subscription ::: Set `monitor-gcp-audit-sub` as the **Subscription ID** and leave the **Delivery type** as pull: - :::{image} ../../../images/observability-monitor-gcp-pub-sub-subscription-id.png + :::{image} /solutions/images/observability-monitor-gcp-pub-sub-subscription-id.png :alt: GCP Pub/Sub Subscription ID ::: @@ -482,6 +482,6 @@ To collect logs from Google Cloud Platform, use the [Google Cloud Platform](beat 6. Finally, log into {{kib}} and open the **[{{filebeat}} GCP] Audit** dashboard. - :::{image} ../../../images/observability-monitor-gcp-audit-overview-dashboard.png + :::{image} /solutions/images/observability-monitor-gcp-audit-overview-dashboard.png :alt: {{filebeat}} audit overview dashboard ::: diff --git a/solutions/observability/cloud/monitor-microsoft-azure-openai.md b/solutions/observability/cloud/monitor-microsoft-azure-openai.md index e002fdf406..386da80743 100644 --- a/solutions/observability/cloud/monitor-microsoft-azure-openai.md +++ b/solutions/observability/cloud/monitor-microsoft-azure-openai.md @@ -259,7 +259,7 @@ The Elastic Azure OpenAI integration comes with a built-in overview dashboard to From here, you’ll find visualizations of important metrics for your Azure OpenAI service, like the request rate, error rate, token usage, and chat completion latency. To zoom in on your data, click and drag across the bars in a visualization. -![screenshot of the Azure OpenAI integration dashboard](../../../images/observability-azure-openai-dashboard.png "") +![screenshot of the Azure OpenAI integration dashboard](/solutions/images/observability-azure-openai-dashboard.png "") For more on dashboards and visualization, refer to the [Dashboards and visualizations](../../../explore-analyze/dashboards.md) documentation. @@ -268,11 +268,11 @@ For more on dashboards and visualization, refer to the [Dashboards and visualiza Find **Discover** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). From the data view drop-down, select either `logs-*` or `metrics-*` to view specific data. You can also create data views if, for example, you wanted to view both `logs-*` and `metrics-*` simultaneously. -![screenshot of the Discover data view dropdown](../../../images/observability-discover-data-view-menu.png "") +![screenshot of the Discover data view dropdown](/solutions/images/observability-discover-data-view-menu.png "") From here, filter your data and dive deeper into individual logs to find information and troubleshoot issues. For a list of Azure OpenAI fields you may want to filter by, refer to the [Azure OpenAI integration](https://docs.elastic.co/en/integrations/azure_openai#settings) docs. -:::{image} ../../../images/observability-azure-openai-discover.png +:::{image} /solutions/images/observability-azure-openai-discover.png :alt: screenshot of the discover main page :screenshot: ::: @@ -284,14 +284,14 @@ For more on using Discover and creating data views, refer to the [Discover](../. To view Azure OpenAI logs, open {{kib}} and go to **Logs Explorer** (find `Logs Explorer` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md)). With **Logs Explorer**, you can quickly search and filter your log data, get information about the structure of log fields, and display your findings in a visualization. -:::{image} ../../../images/observability-log-explorer.png +:::{image} /solutions/images/observability-log-explorer.png :alt: screenshot of the logs explorer main page :screenshot: ::: From **Logs Explorer**, you can select the Azure OpenAI integration from the data selector to view your Kubernetes data. -![screenshot of the logs explorer data selector](../../../images/observability-azure-open-ai-data-selector.png "") +![screenshot of the logs explorer data selector](/solutions/images/observability-azure-open-ai-data-selector.png "") From here, filter your log data and dive deeper into individual logs to find information and troubleshoot issues. For a list of Azure OpenAI fields you may want to filter by, refer to the [Azure OpenAI integration](https://docs.elastic.co/en/integrations/azure_openai#settings) documentation. @@ -469,14 +469,14 @@ After ingesting your data, you can filter and explore it using Discover in {{kib * `numeric_labels.prompt_tokens` * `numeric_labels.token_count` -:::{image} ../../../images/observability-azure-openai-apm-discover.png +:::{image} /solutions/images/observability-azure-openai-apm-discover.png :alt: screenshot of the discover main page :screenshot: ::: Then, use these fields to create visualizations and build dashboards. Refer to the [Dashboard and visualizations](../../../explore-analyze/dashboards.md) documentation for more information. -:::{image} ../../../images/observability-azure-openai-apm-dashboard.png +:::{image} /solutions/images/observability-azure-openai-apm-dashboard.png :alt: screenshot of the Azure OpenAI APM dashboard :screenshot: ::: diff --git a/solutions/observability/cloud/monitor-microsoft-azure-with-azure-native-isv-service.md b/solutions/observability/cloud/monitor-microsoft-azure-with-azure-native-isv-service.md index 366f895eb8..9c40cd942d 100644 --- a/solutions/observability/cloud/monitor-microsoft-azure-with-azure-native-isv-service.md +++ b/solutions/observability/cloud/monitor-microsoft-azure-with-azure-native-isv-service.md @@ -59,7 +59,7 @@ Microsoft Azure allows you to find, deploy, and manage {{es}} from within the Az :::: - :::{image} ../../../images/observability-monitor-azure-native-create-elastic-resource.png + :::{image} /solutions/images/observability-monitor-azure-native-create-elastic-resource.png :alt: Screenshot of Elastic resource creation in Azure :screenshot: ::: @@ -67,7 +67,7 @@ Microsoft Azure allows you to find, deploy, and manage {{es}} from within the Az 7. To create the {{es}} deployment, click **Create**. 8. After deployment is complete, click **Go to resource**. Here you can view and configure your deployment details. To access the cluster, click **{{kib}}**. - :::{image} ../../../images/observability-monitor-azure-native-elastic-deployment.png + :::{image} /solutions/images/observability-monitor-azure-native-elastic-deployment.png :alt: Screenshot of deployment details for Elastic resource in Azure :screenshot: ::: @@ -83,7 +83,7 @@ To ingest Azure subscription and resource logs into Elastic, you use the Azure N 1. In the Azure portal, go to your {{es}} resource page and click **Ingest logs and metrics from Azure Services**. 2. Under **Logs**, select both checkboxes to collect subscription activity logs and Azure resource logs. Click **Save**. - :::{image} ../../../images/observability-monitor-azure-native-elastic-config-logs-metrics.png + :::{image} /solutions/images/observability-monitor-azure-native-elastic-config-logs-metrics.png :alt: Screenshot of logs and metrics configuration for Elastic resource in Azure :screenshot: ::: @@ -106,7 +106,7 @@ To ingest Azure subscription and resource logs into Elastic, you use the Azure N 1. In the Azure portal, go to your {{es}} resource and click **Virtual machines**. 2. Select the VMs that you want to collect logs and metrics from, click **Install Extension**, and then click **OK**. - :::{image} ../../../images/observability-monitor-azure-native-elastic-vms.png + :::{image} /solutions/images/observability-monitor-azure-native-elastic-vms.png :alt: Screenshot that shows VMs selected for logs and metrics collection :screenshot: ::: diff --git a/solutions/observability/cloud/monitor-microsoft-azure-with-beats.md b/solutions/observability/cloud/monitor-microsoft-azure-with-beats.md index f8f233be29..7fb8424ae9 100644 --- a/solutions/observability/cloud/monitor-microsoft-azure-with-beats.md +++ b/solutions/observability/cloud/monitor-microsoft-azure-with-beats.md @@ -47,7 +47,7 @@ Microsoft Azure allows you to find, deploy, and manage {{es}} from within the Az 4. Enter the **Subscription**, **Resource group**, and the **Resource name**. 5. Select a region and then click **Review + create**. - ![Create Elastic resource](../../../images/observability-monitor-azure-create-elastic-resource.png "") + ![Create Elastic resource](/solutions/images/observability-monitor-azure-create-elastic-resource.png "") ::::{note} We will cover **logs** and **infrastructure metrics** later in this tutorial. @@ -57,13 +57,13 @@ Microsoft Azure allows you to find, deploy, and manage {{es}} from within the Az 6. To create the {{es}} deployment, click **Create**. 7. After your deployment is complete, click **Go to resource**. Here you can see and configure your deployment details. To access the cluster, click **{{kib}}**. - ![Elastic resource](../../../images/observability-monitor-azure-elastic-deployment.png "") + ![Elastic resource](/solutions/images/observability-monitor-azure-elastic-deployment.png "") 1. To single sign-on directly into Elastic, select your Azure account. 2. To see if there is any available data, click **Observability**. There should be no data yet, but next, you will ingest logs. - ![{{kib}} {{observability}} page (no data)](../../../images/observability-monitor-azure-kibana-observability-page-empty.png "") + ![{{kib}} {{observability}} page (no data)](/solutions/images/observability-monitor-azure-kibana-observability-page-empty.png "") @@ -73,11 +73,11 @@ To ingest Azure subscription and resource logs into Elastic using the Microsoft 1. On to the {{es}} resource page in Azure, click **Ingest logs and metrics from Azure Services**. - ![Click on Ingest logs and metrics from Azure Services](../../../images/observability-monitor-azure-elastic-click-ingest-logs.png "") + ![Click on Ingest logs and metrics from Azure Services](/solutions/images/observability-monitor-azure-elastic-click-ingest-logs.png "") 2. Check both checkboxes and click **Save**. - ![Elastic configure logs and metrics](../../../images/observability-monitor-azure-elastic-config-logs-metrics.png "") + ![Elastic configure logs and metrics](/solutions/images/observability-monitor-azure-elastic-config-logs-metrics.png "") ::::{note} This configuration can also be applied during the Elastic resource creation. To make the concepts clearer, this tutorial separates the two steps. @@ -98,11 +98,11 @@ To ingest Azure subscription and resource logs into Elastic using the Microsoft 1. Go to your Elastic resource and click **Virtual machines**. - ![Elastic resource](../../../images/observability-monitor-azure-elastic-deployment.png "") + ![Elastic resource](/solutions/images/observability-monitor-azure-elastic-deployment.png "") 2. Select the VMs that you want to collect logs and metrics from, click **Install Extension**, and then click **OK**. - ![Select VMs to collect logs and metrics from](../../../images/observability-monitor-azure-elastic-vms.png "") + ![Select VMs to collect logs and metrics from](/solutions/images/observability-monitor-azure-elastic-vms.png "") 3. Wait until it is installed and sending data (if the list does not update, click **Refresh** ). To see the logs from the VM, open **Logs Explorer** (find `Logs Explorer` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md)). @@ -127,21 +127,21 @@ The Azure Monitor REST API allows you to get insights into your Azure resources 1. Go to the [Azure Management Portal](https://portal.azure.com/). Search and click on **Azure Active Directory**. - ![Search and click on Azure Active Directory](../../../images/observability-monitor-azure-search-active-directory.png "") + ![Search and click on Azure Active Directory](/solutions/images/observability-monitor-azure-search-active-directory.png "") 2. Click on **App registrations** in the navigation pane of the selected Active Directory and then click on **New registration**. - ![Click on App registrations](../../../images/observability-monitor-azure-click-app-registration.png "") + ![Click on App registrations](/solutions/images/observability-monitor-azure-click-app-registration.png "") 3. Type the name of your application (this tutorial uses `monitor-azure`) and click on **Register** (leave all the other options with the default value). - ![Register an application](../../../images/observability-monitor-azure-register-app.png "") + ![Register an application](/solutions/images/observability-monitor-azure-register-app.png "") Copy the **Application (client) ID**, and save it for future reference. This id is required to configure {{metricbeat}} to connect to your Azure account. 4. Click on **Certificates & secrets**. Then, click on **New client secret** to create a new security key. - ![Click on new client secret](../../../images/observability-monitor-azure-click-client-secret.png "") + ![Click on new client secret](/solutions/images/observability-monitor-azure-click-client-secret.png "") 5. Type a key description and select a key duration in the expire list. Click on **Add** to create a client secret. The next page will display the key value under the **Value** field. Copy the secret and save it (along with your Client ID) for future reference. @@ -158,7 +158,7 @@ After creating the Azure service principal you need to grant it the correct perm 1. On Azure Portal, search and click on **Subscriptions**. - ![Search and click on Subscriptions](../../../images/observability-monitor-azure-search-subscriptions.png "") + ![Search and click on Subscriptions](/solutions/images/observability-monitor-azure-search-subscriptions.png "") 2. In the Subscriptions page, click on your subscription. 3. Click on **Access control (IAM)** in the subscription navigation pane. @@ -166,7 +166,7 @@ After creating the Azure service principal you need to grant it the correct perm 5. Select the **Reader** role. 6. In the **Select** field, type the description name of the configured service principal (`monitor-azure`). - ![Add role assignment](../../../images/observability-monitor-azure-add-role-assignment.png "") + ![Add role assignment](/solutions/images/observability-monitor-azure-add-role-assignment.png "") 7. Select the application and click on save to grant the service principal access to your subscription. @@ -177,15 +177,15 @@ To configure {{metricbeat}} you need the {{es}} cluster details. 1. On the {{es}} resource page, click **Manage changes in {{ecloud}}**. - ![Elastic resource](../../../images/observability-monitor-azure-elastic-deployment.png "") + ![Elastic resource](/solutions/images/observability-monitor-azure-elastic-deployment.png "") 2. Copy the **Cloud ID** and keep it safe. You will use it later. - ![{{ecloud}} deployment](../../../images/observability-monitor-azure-kibana-deployment.png "") + ![{{ecloud}} deployment](/solutions/images/observability-monitor-azure-kibana-deployment.png "") 3. Click **Security** and then click **Reset password**. Confirm, and copy the password. Keep it safe as you will use it later. - ![{{ecloud}} security](../../../images/observability-monitor-azure-kibana-security.png "") + ![{{ecloud}} security](/solutions/images/observability-monitor-azure-kibana-security.png "") You can run {{metricbeat}} on any machine. This tutorial uses a small Azure VM, **B2s** (2 vCPUs, 4 GB memory), with an Ubuntu distribution. @@ -372,4 +372,4 @@ Extra Azure charges on metric queries my be generated by this module. Please see 6. Finally, log into {{kib}} and open the **[{{metricbeat}} Azure] Billing overview** dashboard. Keep in mind it collects data every 24 hours. - ![{{metricbeat}} azure billing overview dashboard](../../../images/observability-monitor-azure-billing-overview-dashboard.png "") + ![{{metricbeat}} azure billing overview dashboard](/solutions/images/observability-monitor-azure-billing-overview-dashboard.png "") diff --git a/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md b/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md index 28f901e751..1cc5236c4d 100644 --- a/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md +++ b/solutions/observability/cloud/monitor-microsoft-azure-with-elastic-agent.md @@ -41,7 +41,7 @@ The [Azure REST API](https://learn.microsoft.com/en-us/rest/api/azure/) allows y 2. In the navigation pane, select **App registrations** and then click **New registration**. 3. Type the name of your application (this tutorial uses `ingest-tutorial-monitor-azure`) and click **Register** (accept the default values for other settings). - :::{image} ../../../images/observability-agent-tut-azure-register-app.png + :::{image} /solutions/images/observability-agent-tut-azure-register-app.png :alt: Screenshot of the application registration :screenshot: ::: @@ -50,7 +50,7 @@ The [Azure REST API](https://learn.microsoft.com/en-us/rest/api/azure/) allows y 4. In the navigation pane, select **Certificates & secrets**, and then click **New client secret** to create a new security key. - :::{image} ../../../images/observability-agent-tut-azure-click-client-secret.png + :::{image} /solutions/images/observability-agent-tut-azure-click-client-secret.png :alt: Screenshot of adding a new client secret :screenshot: ::: @@ -78,7 +78,7 @@ After creating the Azure service principal, you need to grant it the correct per 8. For the description, enter the name of your service principal. 9. Click **Next** to review the role assignment: - :::{image} ../../../images/observability-agent-tut-azure-add-role-assignment.png + :::{image} /solutions/images/observability-agent-tut-azure-add-role-assignment.png :alt: Screen capture of adding a role assignment :screenshot: ::: @@ -115,7 +115,7 @@ To add the integration: **Subscription ID** : The subscription ID listed on the main Subscriptions page. - :::{image} ../../../images/observability-agent-tut-azure-integration-settings.png + :::{image} /solutions/images/observability-agent-tut-azure-integration-settings.png :alt: Screenshot of integration settings for Azure :screenshot: ::: @@ -161,7 +161,7 @@ It takes a few minutes for {{agent}} to enroll in {{fleet}}, download the config Now that the metrics are streaming to {{es}}, you can visualize them in {{kib}}. Find **Dashboards** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Search for Azure Billing and select the dashboard called **[Azure Billing] Billing Overview**. -:::{image} ../../../images/observability-agent-tut-azure-billing-dashboard.png +:::{image} /solutions/images/observability-agent-tut-azure-billing-dashboard.png :alt: Screenshot of Azure billing overview dashboard :screenshot: ::: @@ -187,7 +187,7 @@ To create an Azure event hub: 3. Click **Create** and create a new Event Hubs namespace. You’ll need to create a new resource group, or choose an existing one. 4. Enter the required settings for the namespace and click **Review + create**. - :::{image} ../../../images/observability-agent-tut-azure-create-eventhub.png + :::{image} /solutions/images/observability-agent-tut-azure-create-eventhub.png :alt: Screenshot of window for creating an event hub namespace :screenshot: ::: @@ -202,7 +202,7 @@ To create an Azure event hub: Typically you create an event hub for each service you want to monitor. For example, imagine that you want to collect activity logs from the Azure Monitor service plus signin and audit logs from the Active Directory service. Rather than sending all logs to a single event hub, you create an event hub for each service: -:::{image} ../../../images/observability-agent-tut-azure-event-hub-diagram.png +:::{image} /solutions/images/observability-agent-tut-azure-event-hub-diagram.png :alt: Diagram that shows an event hub for Active Directory logs and an event hub for activity logs ::: @@ -231,7 +231,7 @@ To configure diagnostic settings for the Azure Monitor service: 5. In the list of log categories, select the logs you want to export. 6. Under Destination details, select **Stream to an event hub** and select the namespace and event hub you created earlier. For example: - :::{image} ../../../images/observability-agent-tut-azure-log-categories.png + :::{image} /solutions/images/observability-agent-tut-azure-log-categories.png :alt: Screenshot of Azure diagnostic settings showing Administrative :screenshot: ::: @@ -268,7 +268,7 @@ To add the integration: **Storage account key** : A valid access key defined for the storage account. - :::{image} ../../../images/observability-agent-tut-azure-activity-log-settings.png + :::{image} /solutions/images/observability-agent-tut-azure-activity-log-settings.png :alt: Screenshot of integration settings for Azure activity logs :screenshot: ::: @@ -287,7 +287,7 @@ Now that logs are streaming into {{es}}, you can visualize them in {{kib}}. To s The Azure activity logs integration also comes with pre-built dashboards that you can use to visualize the data. In {{kib}}, open the main menu and click **Dashboard**. Search for Azure activity and select the dashboard called **[Logs Azure] User Activity**: -:::{image} ../../../images/observability-agent-tut-azure-activity-logs-dashboard.png +:::{image} /solutions/images/observability-agent-tut-azure-activity-logs-dashboard.png :alt: Screenshot of Azure activity logs dashboard :screenshot: ::: diff --git a/solutions/observability/cloud/monitor-virtual-private-cloud-vpc-flow-logs.md b/solutions/observability/cloud/monitor-virtual-private-cloud-vpc-flow-logs.md index d93dd13cf0..bb49f32ea5 100644 --- a/solutions/observability/cloud/monitor-virtual-private-cloud-vpc-flow-logs.md +++ b/solutions/observability/cloud/monitor-virtual-private-cloud-vpc-flow-logs.md @@ -53,14 +53,14 @@ You can filter the logs on the following: You want to see what IP addresses are trying to hit your web servers. Then, you want to understand which IP addresses you’re getting the most `REJECT` actions from. You can expand the `source.ip` field and quickly get a breakdown that shows `185.156.73.54` is the most rejected for the last 3 or more hours you’ve turned on VPC flow logs. -:::{image} ../../../images/observability-discover-ip-addresses.png +:::{image} /solutions/images/observability-discover-ip-addresses.png :alt: IP addresses in Discover :screenshot: ::: You can also create a visualization by choosing **Visualize**. You get the following donut chart, which you can add to a dashboard. -:::{image} ../../../images/observability-discover-visualize-chart.png +:::{image} /solutions/images/observability-discover-visualize-chart.png :alt: Visualization chart in Discover :screenshot: ::: @@ -69,7 +69,7 @@ On top of the IP addresses, you also want to know what port is being hit on your If you select the destination port field, the pop-up shows that port `8081` is being targeted. This port is generally used for the administration of Apache Tomcat. This is a potential security issue, however port `8081` is turned off for outside traffic, hence the `REJECT`. -:::{image} ../../../images/observability-discover-destination-port.png +:::{image} /solutions/images/observability-discover-destination-port.png :alt: Destination port in Discover :screenshot: ::: @@ -82,14 +82,14 @@ Elastic Observability provides the ability to detect anomalies on logs using Mac * Log rate: Automatically detects anomalous log entry rates * Categorization: Automatically categorizes log messages -:::{image} ../../../images/observability-ml-anomalies-detection.png +:::{image} /solutions/images/observability-ml-anomalies-detection.png :alt: Anomalies detection with ML :screenshot: ::: For your VPC flow log, you can enable both features. When you look at what was detected for anomalous log entry rates, you get the following results: -:::{image} ../../../images/observability-ml-anomalies-results.png +:::{image} /solutions/images/observability-ml-anomalies-results.png :alt: Anomalies results with ML :screenshot: ::: @@ -98,14 +98,14 @@ Elastic detected a spike in logs when you turned on VPC flow logs for your appli You can drill down into this anomaly with ML and analyze further. -:::{image} ../../../images/observability-ml-anomalies-explorer.png +:::{image} /solutions/images/observability-ml-anomalies-explorer.png :alt: Anomalies explorer in ML :screenshot: ::: Because you know that a spike exists, you can also use the Elastic AIOps Labs Explain Log Rate Spikes capability. By grouping them, you can see what is causing some of the spikes. -:::{image} ../../../images/observability-ml-spike.png +:::{image} /solutions/images/observability-ml-spike.png :alt: Spikes in ML :screenshot: ::: @@ -117,7 +117,7 @@ Elastic provides an out-of-the-box dashboard to show the top IP addresses hittin You can enhance this baseline dashboard with the visualizations you find in Discover. -:::{image} ../../../images/observability-flow-log-dashboard.png +:::{image} /solutions/images/observability-flow-log-dashboard.png :alt: Flow logs dashboard :screenshot: ::: diff --git a/solutions/observability/cloud/monitor-web-application-firewall-waf-logs.md b/solutions/observability/cloud/monitor-web-application-firewall-waf-logs.md index a605a0bc86..7788f19020 100644 --- a/solutions/observability/cloud/monitor-web-application-firewall-waf-logs.md +++ b/solutions/observability/cloud/monitor-web-application-firewall-waf-logs.md @@ -131,7 +131,7 @@ watch -n 5 curl -i https://.cloudfront.net Navigate to Kibana and visualize the first WAF logs in your {{stack}}. -:::{image} ../../../images/observability-firehose-waf-logs.png +:::{image} /solutions/images/observability-firehose-waf-logs.png :alt: Firehose WAF logs in Kibana :screenshot: ::: diff --git a/solutions/observability/data-set-quality-monitoring.md b/solutions/observability/data-set-quality-monitoring.md index af66424b80..02063d0d82 100644 --- a/solutions/observability/data-set-quality-monitoring.md +++ b/solutions/observability/data-set-quality-monitoring.md @@ -26,9 +26,9 @@ The quality of your data sets is based on the percentage of degraded documents i From the data set table, you’ll find information for each data set such as its namespace, when the data set was last active, and the percentage of degraded docs. The percentage of degraded documents determines the data set’s quality according to the following scale: -* Good (![Good icon](../../images/serverless-green-dot-icon.png "")): 0% of the documents in the data set are degraded. -* Degraded (![Degraded icon](../../images/serverless-yellow-dot-icon.png "")): Greater than 0% and up to 3% of the documents in the data set are degraded. -* Poor (![Poor icon](../../images/serverless-red-dot-icon.png "")): Greater than 3% of the documents in the data set are degraded. +* Good (![Good icon](/solutions/images/serverless-green-dot-icon.png "")): 0% of the documents in the data set are degraded. +* Degraded (![Degraded icon](/solutions/images/serverless-yellow-dot-icon.png "")): Greater than 0% and up to 3% of the documents in the data set are degraded. +* Poor (![Poor icon](/solutions/images/serverless-red-dot-icon.png "")): Greater than 3% of the documents in the data set are degraded. Opening the details of a specific data set shows the degraded documents history, a summary for the data set, and other details that can help you determine if you need to investigate any issues. @@ -42,7 +42,7 @@ The Data Set Quality page has a couple of different ways to help you find ignore To open the details page for a data set with poor or degraded quality and view ignored fields: -1. From the data set table, click ![expand icon](../../images/serverless-expand.svg "") next to a data set with poor or degraded quality. +1. From the data set table, click ![expand icon](/solutions/images/serverless-expand.svg "") next to a data set with poor or degraded quality. 2. From the details, scroll down to **Quality issues**. The **Quality issues** section shows fields that have been ignored, the number of documents that contain ignored fields, and the timestamp of last occurrence of the field being ignored. @@ -55,11 +55,11 @@ To use Logs Explorer or Discover to find ignored fields in individual logs: 1. Find data sets with degraded documents using the **Degraded Docs** column of the data sets table. 2. Click the percentage in the **Degraded Docs** column to open the data set in Logs Explorer or Discover. -The **Documents** table in Logs Explorer or Discover is automatically filtered to show documents that were not parsed correctly. Under the **actions** column, you’ll find the degraded document icon (![degraded document icon](../../images/serverless-indexClose.svg "")). +The **Documents** table in Logs Explorer or Discover is automatically filtered to show documents that were not parsed correctly. Under the **actions** column, you’ll find the degraded document icon (![degraded document icon](/solutions/images/serverless-indexClose.svg "")). Now that you know which documents contain ignored fields, examine them more closely to find the origin of the issue: -1. Under the **actions** column, click ![expand icon](../../images/serverless-expand.svg "") to open the document details. +1. Under the **actions** column, click ![expand icon](/solutions/images/serverless-expand.svg "") to open the document details. 2. Select the **JSON** tab. 3. Scroll towards the end of the JSON to find the `ignored_field_values`. diff --git a/solutions/observability/get-started.md b/solutions/observability/get-started.md index d29e6820f5..a052f314f4 100644 --- a/solutions/observability/get-started.md +++ b/solutions/observability/get-started.md @@ -28,7 +28,7 @@ Learn about key features available to help you get value from your observability Learn how to spin up a deployment on {{ech}} or create an Observability Serverless project and use Elastic Observability to gain deeper insight into the behavior of your applications and systems. -:::{image} ../../images/observability-get-started.svg +:::{image} /solutions/images/observability-get-started.svg :alt: get started ::: diff --git a/solutions/observability/get-started/add-data-from-splunk.md b/solutions/observability/get-started/add-data-from-splunk.md index 4a7763c7d8..ecc4cf4256 100644 --- a/solutions/observability/get-started/add-data-from-splunk.md +++ b/solutions/observability/get-started/add-data-from-splunk.md @@ -16,7 +16,7 @@ Apache, AWS CloudTrail, Nginx, and Zeek integrations offer the ability to seamle These integrations work by using the `httpjson` input in {{agent}} to run a Splunk search via the Splunk REST API and then extract the raw event from the results. The raw event is then processed via the {{agent}}. The Splunk search is customizable and the interval between searches is customizable. These integrations only get new data since the last query, not historical data. -:::{image} ../../../images/observability-elastic-agent-splunk.png +:::{image} /solutions/images/observability-elastic-agent-splunk.png :alt: Splunk integration components :screenshot: ::: @@ -45,7 +45,7 @@ Find **Integrations** in the main menu or use the [global search field](/explore Enable "Collect logs from third-party REST API" and disable both "Collect logs from Nginx instances" and "Collect metrics from Nginx instances". -:::{image} ../../../images/observability-kibana-fleet-third-party-rest-api.png +:::{image} /solutions/images/observability-kibana-fleet-third-party-rest-api.png :alt: {{fleet}} showing enabling third-party REST API :screenshot: ::: @@ -61,7 +61,7 @@ The Splunk username and password must be of a user with a role or capability to SSL Configuration is available under the "Advanced options". These may be necessary if Splunk Enterprise server uses self-signed certificates. See [SSL Options](beats://reference/filebeat/configuration-ssl.md) for valid configuration options. -:::{image} ../../../images/observability-kibana-fleet-third-party-rest-settings.png +:::{image} /solutions/images/observability-kibana-fleet-third-party-rest-settings.png :alt: {{fleet}} showing enabling third-party REST API settings :screenshot: ::: @@ -79,7 +79,7 @@ Be aware that each time the {{agent}} connects to the Splunk Enterprise REST API Tags may be added in the "Advanced options". For example, if you’d like to tag events coming from Splunk with a *Splunk* tag, you can add it here. By default, the forward tag is present to indicate that events are being forwarded via an intermediary, i.e. Splunk. -:::{image} ../../../images/observability-kibana-fleet-third-party-rest-dataset-settings.png +:::{image} /solutions/images/observability-kibana-fleet-third-party-rest-dataset-settings.png :alt: {{fleet}} showing enabling third-party REST API settings :screenshot: ::: diff --git a/solutions/observability/get-started/get-started-with-dashboards.md b/solutions/observability/get-started/get-started-with-dashboards.md index 3ea738f9ed..aa37ec49fc 100644 --- a/solutions/observability/get-started/get-started-with-dashboards.md +++ b/solutions/observability/get-started/get-started-with-dashboards.md @@ -13,7 +13,7 @@ You can also create new dashboards and visualizations based on your data views t In your Observability project, go to **Dashboards** to see installed dashboards or create your own. This example shows dashboards loaded by the System integration: -:::{image} ../../../images/serverless-dashboards.png +:::{image} /solutions/images/serverless-dashboards.png :alt: Screenshot showing list of System dashboards :screenshot: ::: diff --git a/solutions/observability/get-started/quickstart-collect-data-with-aws-firehose.md b/solutions/observability/get-started/quickstart-collect-data-with-aws-firehose.md index ce2f389a60..2e49314a32 100644 --- a/solutions/observability/get-started/quickstart-collect-data-with-aws-firehose.md +++ b/solutions/observability/get-started/quickstart-collect-data-with-aws-firehose.md @@ -153,7 +153,7 @@ The following table shows the type of data ingested by the supported AWS service 1. In {{kib}}, go to the **Observability** UI and click **Add Data**. 2. Under **What do you want to monitor?** select **Cloud**, **AWS**, and then select **AWS Firehose**. - :::{image} ../../../images/observability-quickstart-aws-firehose-entry-point.png + :::{image} /solutions/images/observability-quickstart-aws-firehose-entry-point.png :alt: AWS Firehose entry point :screenshot: ::: @@ -171,7 +171,7 @@ The following table shows the type of data ingested by the supported AWS service 2. In your {{obs-serverless}} project, go to **Add Data**. 3. Under **What do you want to monitor?** select **Cloud**, **AWS**, and then select **AWS Firehose**. - :::{image} ../../../images/serverless-quickstart-aws-firehose-entry-point.png + :::{image} /solutions/images/serverless-quickstart-aws-firehose-entry-point.png :alt: AWS Firehose entry point :screenshot: ::: @@ -187,14 +187,14 @@ The following table shows the type of data ingested by the supported AWS service After installation is complete and all relevant data is flowing into Elastic, the **Visualize your data** section allows you to access the different dashboards for the various services. -:::{image} ../../../images/observability-quickstart-aws-firehose-dashboards.png +:::{image} /solutions/images/observability-quickstart-aws-firehose-dashboards.png :alt: AWS Firehose dashboards :screenshot: ::: Here is an example of the VPC Flow logs dashboard: -:::{image} ../../../images/observability-quickstart-aws-firehose-vpc-flow.png +:::{image} /solutions/images/observability-quickstart-aws-firehose-vpc-flow.png :alt: AWS Firehose VPC flow :screenshot: ::: diff --git a/solutions/observability/get-started/quickstart-monitor-hosts-with-elastic-agent.md b/solutions/observability/get-started/quickstart-monitor-hosts-with-elastic-agent.md index a8824039f5..90454460f1 100644 --- a/solutions/observability/get-started/quickstart-monitor-hosts-with-elastic-agent.md +++ b/solutions/observability/get-started/quickstart-monitor-hosts-with-elastic-agent.md @@ -68,7 +68,7 @@ The script also generates an {{agent}} configuration file that you can use with 1. In {{kib}}, go to the **Observability** UI and click **Add Data**. 2. Under **What do you want to monitor?** select **Host**, and then select **Elastic Agent: Logs & Metrics**. - :::{image} ../../../images/observability-quickstart-monitor-hosts-entry-point.png + :::{image} /solutions/images/observability-quickstart-monitor-hosts-entry-point.png :alt: Host monitoring entry point :screenshot: ::: @@ -92,7 +92,7 @@ The script also generates an {{agent}} configuration file that you can use with 2. In your {{obs-serverless}} project, go to **Add Data**. 3. Under **What do you want to monitor?** select **Host**, and then select **Elastic Agent: Logs & Metrics**. - :::{image} ../../../images/serverless-quickstart-monitor-hosts-entry-point.png + :::{image} /solutions/images/serverless-quickstart-monitor-hosts-entry-point.png :alt: Host monitoring entry point :screenshot: ::: @@ -141,7 +141,7 @@ After installation is complete and all relevant data is flowing into Elastic, th For example, you can navigate the **Host overview** dashboard to explore detailed metrics about system usage and throughput. Metrics that indicate a possible problem are highlighted in red. -:::{image} ../../../images/observability-quickstart-host-overview.png +:::{image} /solutions/images/observability-quickstart-host-overview.png :alt: Host overview dashboard :screenshot: ::: diff --git a/solutions/observability/get-started/quickstart-monitor-hosts-with-opentelemetry.md b/solutions/observability/get-started/quickstart-monitor-hosts-with-opentelemetry.md index 717c2d7cfe..7d2d3e1ebe 100644 --- a/solutions/observability/get-started/quickstart-monitor-hosts-with-opentelemetry.md +++ b/solutions/observability/get-started/quickstart-monitor-hosts-with-opentelemetry.md @@ -69,7 +69,7 @@ Follow these steps to collect logs and metrics using the EDOT Collector: 1. In {{kib}}, go to the **Observability** UI and click **Add Data**. 2. Under **What do you want to monitor?** select **Host**, and then select **OpenTelemetry: Logs & Metrics**. - :::{image} ../../../images/observability-quickstart-monitor-hosts-otel-entry-point.png + :::{image} /solutions/images/observability-quickstart-monitor-hosts-otel-entry-point.png :alt: Host monitoring entry point :screenshot: ::: @@ -99,7 +99,7 @@ Logs are collected from setup onward, so you won’t see logs that occurred befo 3. Select **Collect and analyze logs**, and then select **OpenTelemetry**. 4. Under **What do you want to monitor?** select **Host**, and then select **Elastic Agent: Logs & Metrics**. - :::{image} ../../../images/serverless-quickstart-monitor-hosts-otel-entry-point.png + :::{image} /solutions/images/serverless-quickstart-monitor-hosts-otel-entry-point.png :alt: Host monitoring entry point :screenshot: ::: diff --git a/solutions/observability/get-started/quickstart-monitor-kubernetes-cluster-with-elastic-agent.md b/solutions/observability/get-started/quickstart-monitor-kubernetes-cluster-with-elastic-agent.md index b15c0f08ba..5987eae016 100644 --- a/solutions/observability/get-started/quickstart-monitor-kubernetes-cluster-with-elastic-agent.md +++ b/solutions/observability/get-started/quickstart-monitor-kubernetes-cluster-with-elastic-agent.md @@ -63,7 +63,7 @@ The kubectl command installs the standalone Elastic Agent in your Kubernetes clu 1. In {{kib}}, go to the **Observability** UI and click **Add Data**. 2. Under **What do you want to monitor?** select **Kubernetes**, and then select **Elastic Agent: Logs & Metrics**. - :::{image} ../../../images/observability-quickstart-k8s-entry-point.png + :::{image} /solutions/images/observability-quickstart-k8s-entry-point.png :alt: Kubernetes entry point :screenshot: ::: @@ -87,7 +87,7 @@ The kubectl command installs the standalone Elastic Agent in your Kubernetes clu 2. In your {{obs-serverless}} project, go to **Add Data**. 3. Under **What do you want to monitor?** select **Kubernetes**, and then select **Elastic Agent: Logs & Metrics**. - :::{image} ../../../images/serverless-quickstart-k8s-entry-point.png + :::{image} /solutions/images/serverless-quickstart-k8s-entry-point.png :alt: Kubernetes entry point :screenshot: ::: @@ -108,7 +108,7 @@ The kubectl command installs the standalone Elastic Agent in your Kubernetes clu After installation is complete and all relevant data is flowing into Elastic, the **Visualize your data** section allows you to access the Kubernetes Cluster Overview dashboard that can be used to monitor the health of the cluster. -:::{image} ../../../images/observability-quickstart-k8s-overview.png +:::{image} /solutions/images/observability-quickstart-k8s-overview.png :alt: Kubernetes overview dashboard :screenshot: ::: diff --git a/solutions/observability/get-started/quickstart-unified-kubernetes-observability-with-elastic-distributions-of-opentelemetry-edot.md b/solutions/observability/get-started/quickstart-unified-kubernetes-observability-with-elastic-distributions-of-opentelemetry-edot.md index d26fb64245..4b47e4b537 100644 --- a/solutions/observability/get-started/quickstart-unified-kubernetes-observability-with-elastic-distributions-of-opentelemetry-edot.md +++ b/solutions/observability/get-started/quickstart-unified-kubernetes-observability-with-elastic-distributions-of-opentelemetry-edot.md @@ -66,7 +66,7 @@ For a more detailed description of the components and advanced configuration, re 1. In {{kib}}, go to the **Observability** UI and click **Add Data**. 2. Under **What do you want to monitor?** select **Kubernetes**, and then select **OpenTelemetry: Full Observability**. - :::{image} ../../../images/observability-quickstart-k8s-otel-entry-point.png + :::{image} /solutions/images/observability-quickstart-k8s-otel-entry-point.png :alt: Kubernetes-OTel entry point :screenshot: ::: @@ -96,7 +96,7 @@ For a more detailed description of the components and advanced configuration, re 2. In your {{obs-serverless}} project, go to **Add Data**. 3. Under **What do you want to monitor?** select **Kubernetes**, and then select **OpenTelemetry: Full Observability**. - :::{image} ../../../images/serverless-quickstart-k8s-otel-entry-point.png + :::{image} /solutions/images/serverless-quickstart-k8s-otel-entry-point.png :alt: Kubernetes-OTel entry point :screenshot: ::: @@ -128,7 +128,7 @@ For a more detailed description of the components and advanced configuration, re After installation is complete and all relevant data is flowing into Elastic, the **Visualize your data** section provides a link to the **[OTEL][Metrics Kubernetes]Cluster Overview** dashboard used to monitor the health of the cluster. -:::{image} ../../../images/observability-quickstart-k8s-otel-dashboard.png +:::{image} /solutions/images/observability-quickstart-k8s-otel-dashboard.png :alt: Kubernetes overview dashboard :screenshot: ::: diff --git a/solutions/observability/get-started/what-is-elastic-observability.md b/solutions/observability/get-started/what-is-elastic-observability.md index 91c93ac44d..d7a2c4f7dd 100644 --- a/solutions/observability/get-started/what-is-elastic-observability.md +++ b/solutions/observability/get-started/what-is-elastic-observability.md @@ -11,7 +11,7 @@ mapped_urls: [Elastic {{observability}}](https://www.elastic.co/observability) provides a single stack to unify your logs, infrastructure metrics, application traces, user experience data, synthetics, and universal profiling. Ingest your data directly to {{es}}, where you can further process and enhance the data, before visualizing it and adding alerts in {{kib}}. -:::{image} ../../../images/observability-what-is-observability.svg +:::{image} /solutions/images/observability-what-is-observability.svg :alt: Elastic {{observability}} overview diagram ::: @@ -21,7 +21,7 @@ Analyze log data from your hosts, services, Kubernetes, Apache, and many more. In **Logs Explorer** (powered by Discover), you can quickly search and filter your log data, get information about the structure of the fields, and display your findings in a visualization. -:::{image} ../../../images/serverless-log-explorer-overview.png +:::{image} /solutions/images/serverless-log-explorer-overview.png :alt: Logs Explorer showing log events :screenshot: ::: @@ -39,7 +39,7 @@ Instrument your code and collect performance data and errors at runtime by insta The **Service** inventory provides a quick, high-level overview of the health and general performance of all instrumented services. -:::{image} ../../../images/serverless-services-inventory.png +:::{image} /solutions/images/serverless-services-inventory.png :alt: Service inventory showing health and performance of instrumented services :screenshot: ::: @@ -53,7 +53,7 @@ Monitor system and service metrics from your servers, Docker, Kubernetes, Promet On the {{observability}} **Overview** page, the **Hosts** table shows your top hosts with the most significant resource footprints. These metrics help you evaluate host efficiency and determine if resource consumption is impacting end users. -:::{image} ../../../images/observability-metrics-summary.png +:::{image} /solutions/images/observability-metrics-summary.png :alt: Summary of Hosts on the {{observability}} overview page :screenshot: ::: @@ -71,7 +71,7 @@ Quantify and analyze the perceived performance of your web application with {{us On the {{observability}} **Overview** page, the **{{user-experience}}** chart provides a snapshot of core web vitals for the service with the most traffic. -:::{image} ../../../images/observability-obs-overview-ue.png +:::{image} /solutions/images/observability-obs-overview-ue.png :alt: Summary of {{user-experience}} metrics on the {{observability}} overview page :screenshot: ::: @@ -101,7 +101,7 @@ Stay aware of potential issues in your environments with Observability’s alert On the **Alerts** page, the **Alerts** table provides a snapshot of alerts occurring within the specified time frame. The table includes the alert status, when it was last updated, the reason for the alert, and more. -:::{image} ../../../images/serverless-observability-alerts-overview.png +:::{image} /solutions/images/serverless-observability-alerts-overview.png :alt: Summary of Alerts on the Observability overview page :screenshot: ::: @@ -115,7 +115,7 @@ Set clear, measurable targets for your service performance, based on factors lik From the SLO overview list, you can see all of your SLOs and a quick summary of what’s happening in each one: -:::{image} ../../../images/serverless-slo-dashboard.png +:::{image} /solutions/images/serverless-slo-dashboard.png :alt: Dashboard showing list of SLOs :screenshot: ::: @@ -126,7 +126,7 @@ From the SLO overview list, you can see all of your SLOs and a quick summary of Collect and share information about observability issues by creating cases. Cases allow you to track key investigation details, add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also send cases to third-party systems, such as ServiceNow and Jira. -:::{image} ../../../images/serverless-cases.png +:::{image} /solutions/images/serverless-cases.png :alt: Screenshot showing list of cases :screenshot: ::: @@ -141,7 +141,7 @@ Reduce the time and effort required to detect, understand, investigate, and reso * Find and investigate the causes of unusual spikes or drops in log rates. * Detect distribution changes, trend changes, and other statistically significant change points in a metric of your time series data. -:::{image} ../../../images/serverless-log-rate-analysis.png +:::{image} /solutions/images/serverless-log-rate-analysis.png :alt: Log rate analysis page showing log rate spike :screenshot: ::: diff --git a/solutions/observability/incident-management/alerting.md b/solutions/observability/incident-management/alerting.md index caa60218bc..123399d627 100644 --- a/solutions/observability/incident-management/alerting.md +++ b/solutions/observability/incident-management/alerting.md @@ -22,12 +22,12 @@ Once you’ve defined your rules, you can monitor any alerts triggered by these On the **Alerts** page, the Alerts table provides a snapshot of alerts occurring within the specified time frame. The table includes the alert status, when it was last updated, the reason for the alert, and more. -:::{image} ../../../images/serverless-observability-alerts-overview.png +:::{image} /solutions/images/serverless-observability-alerts-overview.png :alt: Summary of Alerts :screenshot: ::: -You can filter this table by alert status or time period, customize the visible columns, and search for specific alerts (for example, alerts related to a specific service or environment) using KQL. Select **View alert detail** from the **More actions** menu ![action menu](../../../images/serverless-boxesHorizontal.svg ""), or click the Reason link for any alert to [view alert](../../../solutions/observability/incident-management/view-alerts.md) in detail, and you can then either **View in app** or **View rule details**. +You can filter this table by alert status or time period, customize the visible columns, and search for specific alerts (for example, alerts related to a specific service or environment) using KQL. Select **View alert detail** from the **More actions** menu ![action menu](/solutions/images/serverless-boxesHorizontal.svg ""), or click the Reason link for any alert to [view alert](../../../solutions/observability/incident-management/view-alerts.md) in detail, and you can then either **View in app** or **View rule details**. ## Next steps [observability-alerting-next-steps] diff --git a/solutions/observability/incident-management/cases.md b/solutions/observability/incident-management/cases.md index 0ec02d143a..fa43404f77 100644 --- a/solutions/observability/incident-management/cases.md +++ b/solutions/observability/incident-management/cases.md @@ -8,7 +8,7 @@ mapped_urls: Collect and share information about observability issues by creating a case. Cases allow you to track key investigation details, add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also send cases to third-party systems by [configuring external connectors](../../../solutions/observability/incident-management/configure-case-settings.md). -:::{image} ../../../images/observability-cases.png +:::{image} /solutions/images/observability-cases.png :alt: Cases page :screenshot: ::: \ No newline at end of file diff --git a/solutions/observability/incident-management/configure-access-to-cases.md b/solutions/observability/incident-management/configure-access-to-cases.md index 5c4b2276ce..8b9d93f701 100644 --- a/solutions/observability/incident-management/configure-access-to-cases.md +++ b/solutions/observability/incident-management/configure-access-to-cases.md @@ -14,7 +14,7 @@ If you are using an on-premises {{kib}} deployment and want your email notificat For more details, refer to [feature access based on user privileges](../../../deploy-manage/manage-spaces.md#spaces-control-user-access). -:::{image} ../../../images/observability-cases-privileges.png +:::{image} /solutions/images/observability-cases-privileges.png :alt: cases privileges :screenshot: ::: diff --git a/solutions/observability/incident-management/configure-case-settings.md b/solutions/observability/incident-management/configure-case-settings.md index f0ece20250..a80924a062 100644 --- a/solutions/observability/incident-management/configure-case-settings.md +++ b/solutions/observability/incident-management/configure-case-settings.md @@ -16,7 +16,7 @@ For Observability serverless projects, the **Editor** role or higher is required To change case closure options and add custom fields, templates, and connectors for external incident management systems, go to **Cases** → **Settings**. -:::{image} ../../../images/observability-cases-settings.png +:::{image} /solutions/images/observability-cases-settings.png :alt: View case settings :screenshot: ::: @@ -55,7 +55,7 @@ After creating a connector, you can set your cases to [automatically close](../. 1. From the **Incident management system** list, select **Add new connector**. 2. Select the system to send cases to: **{{sn}}**, **{{jira}}**, **{{ibm-r}}**, **{{swimlane}}**, **TheHive**, or **{{webhook-cm}}**. - :::{image} ../../../images/serverless-observability-cases-add-connector.png + :::{image} /solutions/images/serverless-observability-cases-add-connector.png :alt: Add a connector to send cases to an external source :screenshot: ::: @@ -99,7 +99,7 @@ To create a custom field: 1. In the **Custom fields** section, click **Add field**. - :::{image} ../../../images/observability-cases-add-custom-field.png + :::{image} /solutions/images/observability-cases-add-custom-field.png :alt: Add a custom field in case settings :screenshot: ::: @@ -124,7 +124,7 @@ To create a template: 1. In the **Templates** section, click **Add template**. - :::{image} ../../../images/serverless-observability-cases-templates.png + :::{image} /solutions/images/serverless-observability-cases-templates.png :alt: Add a case template :screenshot: ::: diff --git a/solutions/observability/incident-management/configure-service-level-objective-slo-access.md b/solutions/observability/incident-management/configure-service-level-objective-slo-access.md index 4ed43f658d..cbd685b6fa 100644 --- a/solutions/observability/incident-management/configure-service-level-objective-slo-access.md +++ b/solutions/observability/incident-management/configure-service-level-objective-slo-access.md @@ -43,7 +43,7 @@ Set the following privileges for the SLO Editor role: 2. Click **Add index privilege**. 3. In the **Indices** field, add the indices for which you plan to create SLOs. Then, add `read` and `view_index_metadata` to the **Privileges** field. The following example shows `logs-*`, but you can specify any indices. - :::{image} ../../../images/observability-slo-es-priv-editor.png + :::{image} /solutions/images/observability-slo-es-priv-editor.png :alt: Cluster and index privileges for SLO Editor role :screenshot: ::: @@ -52,7 +52,7 @@ Set the following privileges for the SLO Editor role: 5. From the **Spaces** dropdown, either select any specific spaces you want the role to apply to, or select **All Spaces**. 6. Set **Observability → SLOs** to `All`. - :::{image} ../../../images/observability-slo-kibana-priv-all.png + :::{image} /solutions/images/observability-slo-kibana-priv-all.png :alt: SLO Kibana all privileges :screenshot: ::: @@ -66,7 +66,7 @@ Set the following privileges for the SLO Read role: 1. Under **Index privileges** in the **Elasticsearch** section, add `.slo-observability-*` to the **Indices** field and `read` and `view_index_metadata` to the **Privileges** field. - :::{image} ../../../images/observability-slo-es-priv-viewer.png + :::{image} /solutions/images/observability-slo-es-priv-viewer.png :alt: Index privileges for SLO Viewer role :screenshot: ::: @@ -75,7 +75,7 @@ Set the following privileges for the SLO Read role: 3. From the **Spaces** dropdown, either select any specific spaces you want the role to apply to, or select **All Spaces**. 4. Set **Observability → SLOs** to `Read`. - :::{image} ../../../images/observability-slo-kibana-priv-read.png + :::{image} /solutions/images/observability-slo-kibana-priv-read.png :alt: SLO Kibana read privileges :screenshot: ::: diff --git a/solutions/observability/incident-management/create-an-anomaly-detection-rule.md b/solutions/observability/incident-management/create-an-anomaly-detection-rule.md index d7362df802..ea9bf3813e 100644 --- a/solutions/observability/incident-management/create-an-anomaly-detection-rule.md +++ b/solutions/observability/incident-management/create-an-anomaly-detection-rule.md @@ -34,7 +34,7 @@ To create an anomaly detection rule: 4. Specify a name and optional tags for the rule. You can use these tags later to filter alerts. 5. Verify that the correct job is selected and configure the alert details: - :::{image} ../../../images/serverless-anomaly-detection-alert.png + :::{image} /solutions/images/serverless-anomaly-detection-alert.png :alt: Anomaly detection alert settings :screenshot: ::: @@ -113,14 +113,14 @@ After you select a connector, you must set the action frequency. You can choose Alternatively, you can set the action frequency to **For each alert** and specify the conditions each alert must meet for the action to run. For example, you can send an email only when alert status changes to critical. -:::{image} ../../../images/serverless-alert-action-frequency.png +:::{image} /solutions/images/serverless-alert-action-frequency.png :alt: Configure when a rule is triggered :screenshot: ::: With the **Run when** menu you can choose if an action runs when the the anomaly score matched the condition or was recovered. For example, you can add a corresponding action for each state to ensure you are alerted when the anomaly score was matched and also when it recovers. -:::{image} ../../../images/serverless-alert-anomaly-action-frequency-recovered.png +:::{image} /solutions/images/serverless-alert-anomaly-action-frequency-recovered.png :alt: Choose between anomaly score matched condition or recovered :screenshot: ::: @@ -129,9 +129,9 @@ With the **Run when** menu you can choose if an action runs when the the anomaly :::::{dropdown} Action variables -Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](../../../images/serverless-indexOpen.svg "") and selecting from a list of available variables. +Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](/solutions/images/serverless-indexOpen.svg "") and selecting from a list of available variables. -:::{image} ../../../images/serverless-action-variables-popup.png +:::{image} /solutions/images/serverless-action-variables-popup.png :alt: Action variables list :screenshot: ::: diff --git a/solutions/observability/incident-management/create-an-apm-anomaly-rule.md b/solutions/observability/incident-management/create-an-apm-anomaly-rule.md index 3af1d6e32e..e7161fd4c8 100644 --- a/solutions/observability/incident-management/create-an-apm-anomaly-rule.md +++ b/solutions/observability/incident-management/create-an-apm-anomaly-rule.md @@ -22,7 +22,7 @@ For Observability serverless projects, the **Editor** role or higher is required You can create an anomaly rule to alert you when either the latency, throughput, or failed transaction rate of a service is abnormal. Anomaly rules can be set at different levels: environment, service, and/or transaction type. Add actions to raise alerts via services or third-party integrations (for example, send an email or create a Jira issue). -:::{image} ../../../images/serverless-alerts-create-apm-anomaly.png +:::{image} /solutions/images/serverless-alerts-create-apm-anomaly.png :alt: Create rule for APM anomaly alert :screenshot: ::: @@ -91,14 +91,14 @@ After you select a connector, you must set the action frequency. You can choose Alternatively, you can set the action frequency to **For each alert** and specify the conditions each alert must meet for the action to run. For example, you can send an email only when the alert status changes to critical. -:::{image} ../../../images/serverless-alert-action-frequency.png +:::{image} /solutions/images/serverless-alert-action-frequency.png :alt: Configure when a rule is triggered :screenshot: ::: With the **Run when** menu you can choose if an action runs when the threshold for an alert is reached, or when the alert is recovered. For example, you can add a corresponding action for each state to ensure you are alerted when the rule is triggered and also when it recovers. -:::{image} ../../../images/serverless-alert-apm-action-frequency-recovered.png +:::{image} /solutions/images/serverless-alert-apm-action-frequency-recovered.png :alt: Choose between threshold met or recovered :screenshot: ::: @@ -107,9 +107,9 @@ With the **Run when** menu you can choose if an action runs when the threshold f :::::{dropdown} Action variables -Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](../../../images/serverless-indexOpen.svg "") and selecting from a list of available variables. +Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](/solutions/images/serverless-indexOpen.svg "") and selecting from a list of available variables. -:::{image} ../../../images/serverless-action-variables-popup.png +:::{image} /solutions/images/serverless-action-variables-popup.png :alt: Action variables list :screenshot: ::: diff --git a/solutions/observability/incident-management/create-an-elasticsearch-query-rule.md b/solutions/observability/incident-management/create-an-elasticsearch-query-rule.md index 16fc612ca7..956106ec42 100644 --- a/solutions/observability/incident-management/create-an-elasticsearch-query-rule.md +++ b/solutions/observability/incident-management/create-an-elasticsearch-query-rule.md @@ -29,7 +29,7 @@ An {{es}} query rule can be defined using {{es}} Query Domain Specific Language When you create an {{es}} query rule, your choice of query type affects the information you must provide. For example: -:::{image} ../../../images/serverless-alerting-rule-types-es-query-conditions.png +:::{image} /solutions/images/serverless-alerting-rule-types-es-query-conditions.png :alt: Define the condition to detect :screenshot: ::: @@ -81,14 +81,14 @@ Use the **Test query** feature to verify that your query is valid. If you use query DSL, KQL, or Lucene, the query runs against the selected indices using the configured time window. The number of documents that match the query is displayed. For example: -:::{image} ../../../images/serverless-alerting-rule-types-es-query-valid.png +:::{image} /solutions/images/serverless-alerting-rule-types-es-query-valid.png :alt: Test {{es}} query returns number of matches when valid :screenshot: ::: If you use an ES|QL query, a table is displayed. For example: -:::{image} ../../../images/serverless-alerting-rule-types-esql-query-valid.png +:::{image} /solutions/images/serverless-alerting-rule-types-esql-query-valid.png :alt: Test ES|QL query returns a table when valid :screenshot: ::: @@ -143,7 +143,7 @@ For more information on creating connectors, refer to [Connectors](../../../depl :::::{dropdown} Action frequency After you select a connector, you must set the action frequency. You can choose to create a **Summary of alerts** on each check interval or on a custom interval. For example, you can send email notifications that summarize the new, ongoing, and recovered alerts at a custom interval: -:::{image} ../../../images/serverless-alerting-es-query-rule-action-summary.png +:::{image} /solutions/images/serverless-alerting-es-query-rule-action-summary.png :alt: UI for defining alert summary action in an {{es}} query rule :screenshot: ::: @@ -152,7 +152,7 @@ Alternatively, you can set the action frequency to **For each alert** and specif With the **Run when** menu you can choose how often the action runs (at each check interval, only when the alert status changes, or at a custom action interval). You must also choose an action group, which indicates whether the action runs when the query is matched or when the alert is recovered. Each connector supports a specific set of actions for each action group. For example: -:::{image} ../../../images/serverless-alerting-es-query-rule-action-query-matched.png +:::{image} /solutions/images/serverless-alerting-es-query-rule-action-query-matched.png :alt: UI for defining a recovery action :screenshot: ::: @@ -163,9 +163,9 @@ You can further refine the conditions under which actions run by specifying that :::::{dropdown} Action variables -Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](../../../images/serverless-indexOpen.svg "") and selecting from a list of available variables. +Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](/solutions/images/serverless-indexOpen.svg "") and selecting from a list of available variables. -:::{image} ../../../images/serverless-action-variables-popup.png +:::{image} /solutions/images/serverless-action-variables-popup.png :alt: Action variables list :screenshot: ::: diff --git a/solutions/observability/incident-management/create-an-error-count-threshold-rule.md b/solutions/observability/incident-management/create-an-error-count-threshold-rule.md index 98e17053ae..e913a97c47 100644 --- a/solutions/observability/incident-management/create-an-error-count-threshold-rule.md +++ b/solutions/observability/incident-management/create-an-error-count-threshold-rule.md @@ -18,7 +18,7 @@ For Observability serverless projects, the **Editor** role or higher is required Create an error count threshold rule to alert you when the number of errors in a service exceeds a defined threshold. Threshold rules can be set at different levels: environment, service, transaction type, and/or transaction name. -:::{image} ../../../images/serverless-alerts-create-rule-error-count.png +:::{image} /solutions/images/serverless-alerts-create-rule-error-count.png :alt: Create rule for error count threshold alert :screenshot: ::: @@ -89,14 +89,14 @@ After you select a connector, you must set the action frequency. You can choose Alternatively, you can set the action frequency to **For each alert** and specify the conditions each alert must meet for the action to run. For example, you can send an email only when the alert status changes to critical. -:::{image} ../../../images/serverless-alert-action-frequency.png +:::{image} /solutions/images/serverless-alert-action-frequency.png :alt: Configure when a rule is triggered :screenshot: ::: With the **Run when** menu you can choose if an action runs when the threshold for an alert is reached, or when the alert is recovered. For example, you can add a corresponding action for each state to ensure you are alerted when the rule is triggered and also when it recovers. -:::{image} ../../../images/serverless-alert-apm-action-frequency-recovered.png +:::{image} /solutions/images/serverless-alert-apm-action-frequency-recovered.png :alt: Choose between threshold met or recovered :screenshot: ::: @@ -105,9 +105,9 @@ With the **Run when** menu you can choose if an action runs when the threshold f :::::{dropdown} Action variables -Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](../../../images/serverless-indexOpen.svg "") and selecting from a list of available variables. +Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](/solutions/images/serverless-indexOpen.svg "") and selecting from a list of available variables. -:::{image} ../../../images/serverless-action-variables-popup.png +:::{image} /solutions/images/serverless-action-variables-popup.png :alt: Action variables list :screenshot: ::: @@ -181,6 +181,6 @@ Based on the criteria above, define the following rule details: Next, select the **Email** connector and click **Create a connector**. Fill out the required details: sender, host, port, etc., and select **Save**. -A default message is provided as a starting point for your alert. You can use the Mustache template syntax (`{{variable}}`) to pass additional alert values at the time a condition is detected to an action. A list of available variables can be accessed by clicking the Add variable icon ![Add variable](../../../images/serverless-indexOpen.svg ""). +A default message is provided as a starting point for your alert. You can use the Mustache template syntax (`{{variable}}`) to pass additional alert values at the time a condition is detected to an action. A list of available variables can be accessed by clicking the Add variable icon ![Add variable](/solutions/images/serverless-indexOpen.svg ""). Select **Save**. The alert has been created and is now active! \ No newline at end of file diff --git a/solutions/observability/incident-management/create-an-inventory-rule.md b/solutions/observability/incident-management/create-an-inventory-rule.md index c1d38046af..5ad5ca15c8 100644 --- a/solutions/observability/incident-management/create-an-inventory-rule.md +++ b/solutions/observability/incident-management/create-an-inventory-rule.md @@ -37,7 +37,7 @@ Conditions for each rule can be applied to specific metrics relating to the inve In this example, Kubernetes Pods is the selected inventory type. The conditions state that you will receive a critical alert for any pods within the `ingress-nginx` namespace with a memory usage of 95% or above and a warning alert if memory usage is 90% or above. The chart shows the results of applying the rule to the last 20 minutes of data. Note that the chart time range is 20 times the value of the look-back window specified in the `FOR THE LAST` field. -:::{image} ../../../images/serverless-inventory-alert.png +:::{image} /solutions/images/serverless-inventory-alert.png :alt: Inventory rule :screenshot: ::: @@ -86,14 +86,14 @@ For more information on creating connectors, refer to [Connectors](../../../depl :::::{dropdown} Action frequency After you select a connector, you must set the action frequency. You can choose to create a summary of alerts on each check interval or on a custom interval. For example, send email notifications that summarize the new, ongoing, and recovered alerts each hour: -:::{image} ../../../images/serverless-action-alert-summary.png +:::{image} /solutions/images/serverless-action-alert-summary.png :alt: Action types :screenshot: ::: Alternatively, you can set the action frequency such that you choose how often the action runs (for example, at each check interval, only when the alert status changes, or at a custom action interval). In this case, you define precisely when the alert is triggered by selecting a specific threshold condition: `Alert`, `Warning`, or `Recovered` (a value that was once above a threshold has now dropped below it). -:::{image} ../../../images/serverless-inventory-threshold-run-when-selection.png +:::{image} /solutions/images/serverless-inventory-threshold-run-when-selection.png :alt: Configure when an alert is triggered :screenshot: ::: @@ -103,7 +103,7 @@ You can also further refine the conditions under which actions run by specifying * **If alert matches query**: Enter a KQL query that defines field-value pairs or query conditions that must be met for notifications to send. The query only searches alert documents in the indices specified for the rule. * **If alert is generated during timeframe**: Set timeframe details. Notifications are only sent if alerts are generated within the timeframe you define. -:::{image} ../../../images/serverless-conditional-alerts.png +:::{image} /solutions/images/serverless-conditional-alerts.png :alt: Configure a conditional alert :screenshot: ::: @@ -112,9 +112,9 @@ You can also further refine the conditions under which actions run by specifying :::::{dropdown} Action variables -Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](../../../images/serverless-indexOpen.svg "") and selecting from a list of available variables. +Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](/solutions/images/serverless-indexOpen.svg "") and selecting from a list of available variables. -:::{image} ../../../images/serverless-action-variables-popup.png +:::{image} /solutions/images/serverless-action-variables-popup.png :alt: Action variables list :screenshot: ::: diff --git a/solutions/observability/incident-management/create-an-slo-burn-rate-rule.md b/solutions/observability/incident-management/create-an-slo-burn-rate-rule.md index 3e720b2908..1fd62129be 100644 --- a/solutions/observability/incident-management/create-an-slo-burn-rate-rule.md +++ b/solutions/observability/incident-management/create-an-slo-burn-rate-rule.md @@ -23,13 +23,13 @@ Create an SLO burn rate rule to get alerts when the burn rate is too high over a Choose which SLO to monitor and then define multiple burn rate windows with appropriate severity. For each period, the burn rate is computed as the error rate divided by the error budget. When the burn rates for both periods surpass the threshold, an alert is triggered. Add actions to raise alerts via services or third-party integrations e.g. mail, Slack, Jira. -:::{image} ../../../images/serverless-slo-alerts-create-rule.png +:::{image} /solutions/images/serverless-slo-alerts-create-rule.png :alt: Create rule for failed transaction rate threshold :screenshot: ::: ::::{tip} -These steps show how to use the **Alerts** UI. You can also create an SLO burn rate rule directly from **Observability*** → ***SLOs**. Click the more options icon (![More options](../../../images/serverless-boxesVertical.svg "")) to the right of the SLO you want to add a burn rate rule for, and select **![Bell](../../../images/serverless-bell.svg "") Create new alert rule** from the menu. +These steps show how to use the **Alerts** UI. You can also create an SLO burn rate rule directly from **Observability*** → ***SLOs**. Click the more options icon (![More options](/solutions/images/serverless-boxesVertical.svg "")) to the right of the SLO you want to add a burn rate rule for, and select **![Bell](/solutions/images/serverless-bell.svg "") Create new alert rule** from the menu. When you use the UI to create an SLO, a default SLO burn rate alert rule is created automatically. The burn rate rule will use the default configuration and no connector. You must configure a connector if you want to receive alerts for SLO breaches. @@ -99,14 +99,14 @@ After you select a connector, you must set the action frequency. You can choose Alternatively, you can set the action frequency to **For each alert** and specify the conditions each alert must meet for the action to run. For example, you can send an email only when the alert status changes to critical. -:::{image} ../../../images/serverless-alert-action-frequency.png +:::{image} /solutions/images/serverless-alert-action-frequency.png :alt: Configure when a rule is triggered :screenshot: ::: With the **Run when** menu you can choose if an action runs for a specific severity (critical, high, medium, low), or when the alert is recovered. For example, you can add a corresponding action for each severity you want an alert for, and also for when the alert recovers. -:::{image} ../../../images/serverless-slo-action-frequency.png +:::{image} /solutions/images/serverless-slo-action-frequency.png :alt: Choose between severity or recovered :screenshot: ::: @@ -115,9 +115,9 @@ With the **Run when** menu you can choose if an action runs for a specific sever :::::{dropdown} Action variables -Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](../../../images/serverless-indexOpen.svg "") and selecting from a list of available variables. +Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](/solutions/images/serverless-indexOpen.svg "") and selecting from a list of available variables. -:::{image} ../../../images/serverless-action-variables-popup.png +:::{image} /solutions/images/serverless-action-variables-popup.png :alt: Action variables list :screenshot: ::: diff --git a/solutions/observability/incident-management/create-an-slo.md b/solutions/observability/incident-management/create-an-slo.md index 272fbe2549..8e64bdd73b 100644 --- a/solutions/observability/incident-management/create-an-slo.md +++ b/solutions/observability/incident-management/create-an-slo.md @@ -245,7 +245,7 @@ For more information about configuring the rule, see [Create an SLO burn rate ru After you’ve created your SLO, you can monitor it from the *SLOs* page in Observability, but you can also add an *SLO Overview* panel to a custom dashboard. Read more about dashboards in [Dashboard and visualizations](../../../explore-analyze/dashboards.md). -:::{image} ../../../images/observability-slo-overview-embeddable-widget.png +:::{image} /solutions/images/observability-slo-overview-embeddable-widget.png :alt: Using the Add panel button to add an SLO Overview widget to a dashboard :screenshot: ::: \ No newline at end of file diff --git a/solutions/observability/incident-management/create-an-uptime-duration-anomaly-rule.md b/solutions/observability/incident-management/create-an-uptime-duration-anomaly-rule.md index 332df65a08..e073bb3cd3 100644 --- a/solutions/observability/incident-management/create-an-uptime-duration-anomaly-rule.md +++ b/solutions/observability/incident-management/create-an-uptime-duration-anomaly-rule.md @@ -25,7 +25,7 @@ The *anomaly score* is a value from `0` to `100`, which indicates the significan | **major** | Score `50` and above. | | **critical** | Score `75` and above. | -:::{image} ../../../images/observability-response-durations-alert.png +:::{image} /solutions/images/observability-response-durations-alert.png :alt: Uptime response duration rule :screenshot: ::: @@ -64,14 +64,14 @@ Some connector types are paid commercial features, while others are free. For a After you select a connector, you must set the action frequency. You can choose to create a summary of alerts on each check interval or on a custom interval. For example, send email notifications that summarize the new, ongoing, and recovered alerts every twelve hours: -:::{image} ../../../images/observability-duration-anomaly-alert-summary.png +:::{image} /solutions/images/observability-duration-anomaly-alert-summary.png :alt: Action types :screenshot: ::: Alternatively, you can set the action frequency such that you choose how often the action runs (for example, at each check interval, only when the alert status changes, or at a custom action interval). In this case, you must also select the specific threshold condition that affects when actions run: `Uptime Duration Anomaly` or `Recovered`. -:::{image} ../../../images/observability-duration-anomaly-run-when-selection.png +:::{image} /solutions/images/observability-duration-anomaly-run-when-selection.png :alt: Configure when a rule is triggered :screenshot: ::: @@ -81,7 +81,7 @@ Alternatively, you can set the action frequency such that you choose how often t Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables. -:::{image} ../../../images/observability-duration-anomaly-alert-default-message.png +:::{image} /solutions/images/observability-duration-anomaly-alert-default-message.png :alt: Default notification message for Uptime duration anomaly rules with open "Add variable" popup listing available action variables :screenshot: ::: @@ -91,7 +91,7 @@ Use the default notification message or customize it. You can add more context t To receive a notification when the alert recovers, select **Run when Recovered**. Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables. -:::{image} ../../../images/observability-duration-anomaly-alert-recovery.png +:::{image} /solutions/images/observability-duration-anomaly-alert-recovery.png :alt: Default recovery message for Uptime duration anomaly rules with open "Add variable" popup listing available action variables :screenshot: ::: diff --git a/solutions/observability/incident-management/create-custom-threshold-rule.md b/solutions/observability/incident-management/create-custom-threshold-rule.md index f865eaf987..69c9927bdb 100644 --- a/solutions/observability/incident-management/create-custom-threshold-rule.md +++ b/solutions/observability/incident-management/create-custom-threshold-rule.md @@ -22,7 +22,7 @@ Create a custom threshold rule to trigger an alert when an {{obs-serverless}} da 2. Click **Manage Rules** → **Create rule**. 3. Under **Select rule type**, select **Custom threshold**. -:::{image} ../../../images/serverless-custom-threshold-rule.png +:::{image} /solutions/images/serverless-custom-threshold-rule.png :alt: Rule details (custom threshold) :screenshot: ::: @@ -130,7 +130,7 @@ The behavior of the alert depends on whether any **group alerts by** fields are ::::{note} **How to untrack decommissioned hosts** -If a host (for example, `host-1`) is decommissioned, you probably no longer want to see "no data" alerts about it. To mark an alert as untracked: Go to the Alerts table, click the ![More actions](../../../images/serverless-boxesHorizontal.svg "") icon to expand the "More actions" menu, and click *Mark as untracked*. +If a host (for example, `host-1`) is decommissioned, you probably no longer want to see "no data" alerts about it. To mark an alert as untracked: Go to the Alerts table, click the ![More actions](/solutions/images/serverless-boxesHorizontal.svg "") icon to expand the "More actions" menu, and click *Mark as untracked*. :::: @@ -179,7 +179,7 @@ For more information on creating connectors, refer to [Connectors](../../../depl :::::{dropdown} Action frequency After you select a connector, you must set the action frequency. You can choose to create a summary of alerts on each check interval or on a custom interval. Alternatively, you can set the action frequency such that you choose how often the action runs (for example, at each check interval, only when the alert status changes, or at a custom action interval). In this case, you must also select the specific threshold condition that affects when actions run: `Alert`, `No Data`, or `Recovered`. -:::{image} ../../../images/serverless-custom-threshold-run-when.png +:::{image} /solutions/images/serverless-custom-threshold-run-when.png :alt: Configure when a rule is triggered :screenshot: ::: @@ -189,7 +189,7 @@ You can also further refine the conditions under which actions run by specifying * **If alert matches query**: Enter a KQL query that defines field-value pairs or query conditions that must be met for notifications to send. The query only searches alert documents in the indices specified for the rule. * **If alert is generated during timeframe**: Set timeframe details. Notifications are only sent if alerts are generated within the timeframe you define. -:::{image} ../../../images/serverless-logs-threshold-conditional-alert.png +:::{image} /solutions/images/serverless-logs-threshold-conditional-alert.png :alt: Configure a conditional alert :screenshot: ::: @@ -198,9 +198,9 @@ You can also further refine the conditions under which actions run by specifying :::::{dropdown} Action variables -Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](../../../images/serverless-indexOpen.svg "") and selecting from a list of available variables. +Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](/solutions/images/serverless-indexOpen.svg "") and selecting from a list of available variables. -:::{image} ../../../images/serverless-action-variables-popup.png +:::{image} /solutions/images/serverless-action-variables-popup.png :alt: Action variables list :screenshot: ::: diff --git a/solutions/observability/incident-management/create-failed-transaction-rate-threshold-rule.md b/solutions/observability/incident-management/create-failed-transaction-rate-threshold-rule.md index a838d2ec55..3c79d3f133 100644 --- a/solutions/observability/incident-management/create-failed-transaction-rate-threshold-rule.md +++ b/solutions/observability/incident-management/create-failed-transaction-rate-threshold-rule.md @@ -18,7 +18,7 @@ navigation_title: "Failed transaction rate threshold" You can create a failed transaction rate threshold rule to alert you when the rate of transaction errors in a service exceeds a defined threshold. Threshold rules can be set at different levels: environment, service, transaction type, and/or transaction name. Add actions to raise alerts via services or third-party integrations e.g. mail, Slack, Jira. -:::{image} ../../../images/serverless-alerts-create-rule-failed-transaction-rate.png +:::{image} /solutions/images/serverless-alerts-create-rule-failed-transaction-rate.png :alt: Create rule for failed transaction rate threshold alert :screenshot: ::: @@ -89,14 +89,14 @@ After you select a connector, you must set the action frequency. You can choose Alternatively, you can set the action frequency to **For each alert** and specify the conditions each alert must meet for the action to run. For example, you can send an email only when the alert status changes to critical. -:::{image} ../../../images/serverless-alert-action-frequency.png +:::{image} /solutions/images/serverless-alert-action-frequency.png :alt: Configure when a rule is triggered :screenshot: ::: With the **Run when** menu you can choose if an action runs when the threshold for an alert is reached, or when the alert is recovered. For example, you can add a corresponding action for each state to ensure you are alerted when the rule is triggered and also when it recovers. -:::{image} ../../../images/serverless-alert-apm-action-frequency-recovered.png +:::{image} /solutions/images/serverless-alert-apm-action-frequency-recovered.png :alt: Choose between threshold met or recovered :screenshot: ::: @@ -105,9 +105,9 @@ With the **Run when** menu you can choose if an action runs when the threshold f :::::{dropdown} Action variables -Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](../../../images/serverless-indexOpen.svg "") and selecting from a list of available variables. +Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](/solutions/images/serverless-indexOpen.svg "") and selecting from a list of available variables. -:::{image} ../../../images/serverless-action-variables-popup.png +:::{image} /solutions/images/serverless-action-variables-popup.png :alt: Action variables list :screenshot: ::: @@ -178,6 +178,6 @@ Based on the criteria above, define the following rule details: Next, select the **Email** connector and click **Create a connector**. Fill out the required details: sender, host, port, etc., and select **Save**. -A default message is provided as a starting point for your alert. You can use the Mustache template syntax (`{{variable}}`) to pass additional alert values at the time a condition is detected to an action. A list of available variables can be accessed by clicking the Add variable icon ![Add variable](../../../images/serverless-indexOpen.svg ""). +A default message is provided as a starting point for your alert. You can use the Mustache template syntax (`{{variable}}`) to pass additional alert values at the time a condition is detected to an action. A list of available variables can be accessed by clicking the Add variable icon ![Add variable](/solutions/images/serverless-indexOpen.svg ""). Select **Save**. The alert has been created and is now active! \ No newline at end of file diff --git a/solutions/observability/incident-management/create-latency-threshold-rule.md b/solutions/observability/incident-management/create-latency-threshold-rule.md index db0e30a05a..f03e29f74e 100644 --- a/solutions/observability/incident-management/create-latency-threshold-rule.md +++ b/solutions/observability/incident-management/create-latency-threshold-rule.md @@ -18,7 +18,7 @@ navigation_title: "Latency threshold" You can create a latency threshold rule to alert you when the latency of a specific transaction type in a service exceeds a defined threshold. Threshold rules can be set at different levels: environment, service, transaction type, and/or transaction name. Add actions to raise alerts via services or third-party integrations e.g. mail, Slack, Jira. -:::{image} ../../../images/serverless-alerts-create-rule-apm-latency-threshold.png +:::{image} /solutions/images/serverless-alerts-create-rule-apm-latency-threshold.png :alt: Create rule for APM latency threshold alert :screenshot: ::: @@ -93,14 +93,14 @@ After you select a connector, you must set the action frequency. You can choose Alternatively, you can set the action frequency to **For each alert** and specify the conditions each alert must meet for the action to run. For example, you can send an email only when the alert status changes to critical. -:::{image} ../../../images/serverless-alert-action-frequency.png +:::{image} /solutions/images/serverless-alert-action-frequency.png :alt: Configure when a rule is triggered :screenshot: ::: With the **Run when** menu you can choose if an action runs when the threshold for an alert is reached, or when the alert is recovered. For example, you can add a corresponding action for each state to ensure you are alerted when the rule is triggered and also when it recovers. -:::{image} ../../../images/serverless-alert-apm-action-frequency-recovered.png +:::{image} /solutions/images/serverless-alert-apm-action-frequency-recovered.png :alt: Choose between threshold met or recovered :screenshot: ::: @@ -109,9 +109,9 @@ With the **Run when** menu you can choose if an action runs when the threshold f :::::{dropdown} Action variables -Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](../../../images/serverless-indexOpen.svg "") and selecting from a list of available variables. +Use the default notification message or customize it. You can add more context to the message by clicking the Add variable icon ![Add variable](/solutions/images/serverless-indexOpen.svg "") and selecting from a list of available variables. -:::{image} ../../../images/serverless-action-variables-popup.png +:::{image} /solutions/images/serverless-action-variables-popup.png :alt: Action variables list :screenshot: ::: diff --git a/solutions/observability/incident-management/create-log-threshold-rule.md b/solutions/observability/incident-management/create-log-threshold-rule.md index 0de6dcb57c..29dae6932d 100644 --- a/solutions/observability/incident-management/create-log-threshold-rule.md +++ b/solutions/observability/incident-management/create-log-threshold-rule.md @@ -9,7 +9,7 @@ mapped_pages: # Create a log threshold rule [logs-threshold-alert] -:::{image} ../../../images/observability-log-threshold-alert.png +:::{image} /solutions/images/observability-log-threshold-alert.png :alt: Log threshold alert configuration :screenshot: ::: @@ -60,7 +60,7 @@ When group by fields are selected, but no documents contain the selected field(s :::: -:::{image} ../../../images/observability-log-threshold-alert-group-by.png +:::{image} /solutions/images/observability-log-threshold-alert-group-by.png :alt: Log threshold rule group by :screenshot: ::: @@ -70,7 +70,7 @@ When group by fields are selected, but no documents contain the selected field(s To determine how many log entries would match each part of your configuration, you can view a chart preview for each condition. This is useful for determining how many log entries would match each part of your configuration. When a group by is set, the chart displays a bar per group. To view the preview, select the arrow next to the condition. -:::{image} ../../../images/observability-log-threshold-alert-chart-previews.png +:::{image} /solutions/images/observability-log-threshold-alert-chart-previews.png :alt: Log threshold chart previews :screenshot: ::: @@ -84,7 +84,7 @@ To understand how one query compares to another query, create a ratio rule. This The following example triggers an alert when there are twice as many error logs to warning logs. -:::{image} ../../../images/observability-log-threshold-alert-ratio.png +:::{image} /solutions/images/observability-log-threshold-alert-ratio.png :alt: Log threshold ratio rule :screenshot: ::: @@ -127,7 +127,7 @@ Some connector types are paid commercial features, while others are free. For a After you select a connector, you must set the action frequency. You can choose to create a summary of alerts on each check interval or on a custom interval. Alternatively, you can set the action frequency such that you choose how often the action runs (for example, at each check interval, only when the alert status changes, or at a custom action interval). In this case, you must also select the specific threshold condition that affects when actions run: `Fired` or `Recovered`. -:::{image} ../../../images/observability-log-threshold-run-when-selection.png +:::{image} /solutions/images/observability-log-threshold-run-when-selection.png :alt: Configure when a rule is triggered :screenshot: ::: @@ -137,7 +137,7 @@ You can also further refine the conditions under which actions run by specifying * **If alert matches query**: Enter a KQL query that defines field-value pairs or query conditions that must be met for notifications to send. The query only searches alert documents in the indices specified for the rule. * **If alert is generated during timeframe**: Set timeframe details. Notifications are only sent if alerts are generated within the timeframe you define. -:::{image} ../../../images/observability-logs-threshold-conditional-alert.png +:::{image} /solutions/images/observability-logs-threshold-conditional-alert.png :alt: Configure a conditional alert :screenshot: ::: @@ -147,7 +147,7 @@ You can also further refine the conditions under which actions run by specifying Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables. -:::{image} ../../../images/observability-logs-threshold-alert-default-message.png +:::{image} /solutions/images/observability-logs-threshold-alert-default-message.png :alt: Default notification message for log threshold rules with open "Add variable" popup listing available action variables :screenshot: ::: @@ -191,7 +191,7 @@ When setting a **group by**, we recommend using the **more than** comparator for When a rule check is performed, a query is built based on the configuration of the rule. For the vast majority of cases it shouldn’t be necessary to know what these queries are. However, to determine an optimal configuration or to aid with debugging, it might be useful to see the structure of these queries. Below is an example {{es}} query for the following configuration: -:::{image} ../../../images/observability-log-threshold-alert-es-query-ungrouped.png +:::{image} /solutions/images/observability-log-threshold-alert-es-query-ungrouped.png :alt: Log threshold ungrouped {{es}} query example :screenshot: ::: @@ -243,7 +243,7 @@ When a rule check is performed, a query is built based on the configuration of t 2. Taken from the **Timestamp** setting -:::{image} ../../../images/observability-log-threshold-alert-es-query-grouped.png +:::{image} /solutions/images/observability-log-threshold-alert-es-query-grouped.png :alt: Log threshold grouped {{es}} query example :screenshot: ::: diff --git a/solutions/observability/incident-management/create-manage-cases.md b/solutions/observability/incident-management/create-manage-cases.md index f0eceea933..2ca118c96e 100644 --- a/solutions/observability/incident-management/create-manage-cases.md +++ b/solutions/observability/incident-management/create-manage-cases.md @@ -36,7 +36,7 @@ Open a new case to keep track of issues and share the details with colleagues. T 8. After you’ve completed all of the required fields, click **Create case**. ::::{tip} -You can also create a case from an alert or add an alert to an existing case. From the **Alerts** page, click the **More options** ![More actions](../../../images/serverless-boxesHorizontal.svg "") icon and choose either **Add to existing case** or **Create new case**, and select or complete the details as required. +You can also create a case from an alert or add an alert to an existing case. From the **Alerts** page, click the **More options** ![More actions](/solutions/images/serverless-boxesHorizontal.svg "") icon and choose either **Add to existing case** or **Create new case**, and select or complete the details as required. :::: @@ -46,7 +46,7 @@ You can also create a case from an alert or add an alert to an existing case. Fr After you create a case, you can upload and manage files on the **Files** tab: -:::{image} ../../../images/serverless-cases-files-tab.png +:::{image} /solutions/images/serverless-cases-files-tab.png :alt: A list of files attached to a case :screenshot: ::: @@ -73,7 +73,7 @@ There is a 10 MiB size limit for images. For all other MIME types, the limit is ## Send cases to external incident management systems [observability-create-a-new-case-send-cases-to-external-incident-management-systems] -To send a case to an external system, click the ![push](../../../images/serverless-importAction.svg "") button in the *External incident management system* section of the individual case page. This information is not sent automatically. If you make further changes to the shared case fields, you should push the case again. +To send a case to an external system, click the ![push](/solutions/images/serverless-importAction.svg "") button in the *External incident management system* section of the individual case page. This information is not sent automatically. If you make further changes to the shared case fields, you should push the case again. For more information about configuring connections to external incident management systems, refer to [Configure case settings](../../../solutions/observability/incident-management/configure-case-settings.md). diff --git a/solutions/observability/incident-management/create-manage-rules.md b/solutions/observability/incident-management/create-manage-rules.md index 5e7bb49051..0d28bfed9b 100644 --- a/solutions/observability/incident-management/create-manage-rules.md +++ b/solutions/observability/incident-management/create-manage-rules.md @@ -42,11 +42,11 @@ Learn more about Observability rules and how to create them: You start by defining the rule and how often it should be evaluated. You can extend these rules by adding an appropriate action (for example, send an email or create an issue) to be triggered when the rule conditions are met. These actions are defined within each rule and implemented by the appropriate connector for that action e.g. Slack, Jira. You can create any rules from scratch using the **Manage Rules** page, or you can create specific rule types from their respective UIs and benefit from some of the details being pre-filled (for example, Name and Tags). * For APM alert types, you can select **Alerts and rules** and create rules directly from the **Services**, **Traces**, and **Dependencies** UIs. -* For SLO alert types, from the **SLOs** page open the **More actions** menu ![action menu](../../../images/serverless-boxesHorizontal.svg "") for an SLO and select **Create new alert rule**. Alternatively, when you create a new SLO, the **Create new SLO burn rate alert rule** checkbox is enabled by default and will prompt you to [Create SLO burn rate rule](../../../solutions/observability/incident-management/create-an-slo-burn-rate-rule.md) upon saving the SLO. +* For SLO alert types, from the **SLOs** page open the **More actions** menu ![action menu](/solutions/images/serverless-boxesHorizontal.svg "") for an SLO and select **Create new alert rule**. Alternatively, when you create a new SLO, the **Create new SLO burn rate alert rule** checkbox is enabled by default and will prompt you to [Create SLO burn rate rule](../../../solutions/observability/incident-management/create-an-slo-burn-rate-rule.md) upon saving the SLO. -After a rule is created, you can open the **More actions** menu ![More actions](../../../images/serverless-boxesHorizontal.svg "") and select **Edit rule** to check or change the definition, and/or add or modify actions. +After a rule is created, you can open the **More actions** menu ![More actions](/solutions/images/serverless-boxesHorizontal.svg "") and select **Edit rule** to check or change the definition, and/or add or modify actions. -:::{image} ../../../images/serverless-alerts-edit-rule.png +:::{image} /solutions/images/serverless-alerts-edit-rule.png :alt: Edit rule (failed transaction rate) :screenshot: ::: @@ -64,7 +64,7 @@ From the action menu you can also: Click on an individual rule on the **{{rules-app}}** page to view details including the rule name, status, definition, execution history, related alerts, and more. -:::{image} ../../../images/serverless-alerts-detail-apm-anomaly.png +:::{image} /solutions/images/serverless-alerts-detail-apm-anomaly.png :alt: Rule details (APM anomaly) :screenshot: ::: diff --git a/solutions/observability/incident-management/create-metric-threshold-rule.md b/solutions/observability/incident-management/create-metric-threshold-rule.md index 490083a53e..ab08293215 100644 --- a/solutions/observability/incident-management/create-metric-threshold-rule.md +++ b/solutions/observability/incident-management/create-metric-threshold-rule.md @@ -28,7 +28,7 @@ Conditions for each rule can be applied to specific metrics that you select. You In this example, the conditions state that you will receive a critical alert for hosts with a CPU usage of 120% or above and a warning alert if CPU usage is 100% or above. Note that you will receive an alert only if memory usage is 20% or above, as per the second condition. -:::{image} ../../../images/observability-metrics-alert.png +:::{image} /solutions/images/observability-metrics-alert.png :alt: Metric threshold alert :screenshot: ::: @@ -38,7 +38,7 @@ When you select **Alert me if there’s no data**, the rule is triggered if the ## Filtering and grouping [filtering-and-grouping] -:::{image} ../../../images/observability-metrics-alert-filters-and-group.png +:::{image} /solutions/images/observability-metrics-alert-filters-and-group.png :alt: Metric threshold filter and group fields :screenshot: ::: @@ -89,14 +89,14 @@ Some connector types are paid commercial features, while others are free. For a After you select a connector, you must set the action frequency. You can choose to create a summary of alerts on each check interval or on a custom interval. For example, send email notifications that summarize the new, ongoing, and recovered alerts each hour: -:::{image} ../../../images/observability-action-alert-summary.png +:::{image} /solutions/images/observability-action-alert-summary.png :alt: Action types :screenshot: ::: Alternatively, you can set the action frequency such that you choose how often the action runs (for example, at each check interval, only when the alert status changes, or at a custom action interval). In this case, you must also select the specific threshold condition that affects when actions run: `Alert`, `Warning`, `No data`, or `Recovered` (a value that was once above a threshold has now dropped below it). -:::{image} ../../../images/observability-metrics-threshold-run-when-selection.png +:::{image} /solutions/images/observability-metrics-threshold-run-when-selection.png :alt: Configure when a rule is triggered :screenshot: ::: @@ -106,7 +106,7 @@ You can also further refine the conditions under which actions run by specifying * **If alert matches query**: Enter a KQL query that defines field-value pairs or query conditions that must be met for notifications to send. The query only searches alert documents in the indices specified for the rule. * **If alert is generated during timeframe**: Set timeframe details. Notifications are only sent if alerts are generated within the timeframe you define. -:::{image} ../../../images/observability-metric-threshold-conditional-alerts.png +:::{image} /solutions/images/observability-metric-threshold-conditional-alerts.png :alt: Configure a conditional alert :screenshot: ::: @@ -116,7 +116,7 @@ You can also further refine the conditions under which actions run by specifying Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables. -:::{image} ../../../images/observability-metrics-threshold-alert-default-message.png +:::{image} /solutions/images/observability-metrics-threshold-alert-default-message.png :alt: Default notification message for metric threshold rules with open "Add variable" popup listing available action variables :screenshot: ::: diff --git a/solutions/observability/incident-management/create-monitor-status-rule.md b/solutions/observability/incident-management/create-monitor-status-rule.md index 1de6c45b4e..3a59f231f2 100644 --- a/solutions/observability/incident-management/create-monitor-status-rule.md +++ b/solutions/observability/incident-management/create-monitor-status-rule.md @@ -19,7 +19,7 @@ Within the Synthetics UI, create a **Monitor Status** rule to receive notificati The **Filter by** section controls the scope of the rule. The rule will only check monitors that match the filters defined in this section. In this example, the rule will only alert on `browser` monitors located in `Asia/Pacific - Japan`. -:::{image} ../../../images/serverless-synthetic-monitor-filters.png +:::{image} /solutions/images/serverless-synthetic-monitor-filters.png :alt: Filter by section of the Synthetics monitor status rule :screenshot: ::: @@ -41,7 +41,7 @@ You can also set **Advanced options** such as the number of consecutive runs tha In this example, the conditions will be met any time a `browser` monitor is down `3` of the last `5` times the monitor ran across any locations that match the filter. These conditions will be evaluated every minute, and you will only receive an alert when the conditions are met three times consecutively. -:::{image} ../../../images/serverless-synthetic-monitor-conditions.png +:::{image} /solutions/images/serverless-synthetic-monitor-conditions.png :alt: Filters and conditions defining a Synthetics monitor status rule :screenshot: ::: @@ -79,14 +79,14 @@ Some connector types are paid commercial features, while others are free. For a After you select a connector, you must set the action frequency. You can choose to create a summary of alerts on each check interval or on a custom interval. For example, send email notifications that summarize the new, ongoing, and recovered alerts each hour: -:::{image} ../../../images/serverless-synthetic-monitor-action-types-summary.png +:::{image} /solutions/images/serverless-synthetic-monitor-action-types-summary.png :alt: synthetic monitor action types summary :screenshot: ::: Alternatively, you can set the action frequency such that you choose how often the action runs (for example, at each check interval, only when the alert status changes, or at a custom action interval). In this case, you must also select the specific threshold condition that affects when actions run: the *Synthetics monitor status* changes or when it is *Recovered* (went from down to up). -:::{image} ../../../images/serverless-synthetic-monitor-action-types-each-alert.png +:::{image} /solutions/images/serverless-synthetic-monitor-action-types-each-alert.png :alt: synthetic monitor action types each alert :screenshot: ::: @@ -96,7 +96,7 @@ You can also further refine the conditions under which actions run by specifying * **If alert matches query**: Enter a KQL query that defines field-value pairs or query conditions that must be met for notifications to send. The query only searches alert documents in the indices specified for the rule. * **If alert is generated during timeframe**: Set timeframe details. Notifications are only sent if alerts are generated within the timeframe you define. -:::{image} ../../../images/serverless-synthetic-monitor-action-types-more-options.png +:::{image} /solutions/images/serverless-synthetic-monitor-action-types-more-options.png :alt: synthetic monitor action types more options :screenshot: ::: @@ -106,7 +106,7 @@ You can also further refine the conditions under which actions run by specifying Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables. -:::{image} ../../../images/serverless-synthetic-monitor-action-variables.png +:::{image} /solutions/images/serverless-synthetic-monitor-action-variables.png :alt: synthetic monitor action variables :screenshot: ::: @@ -200,7 +200,7 @@ Let’s create a rule for any monitor that shows `Down` more than three times in This rule covers all the monitors you have running. You can use a query to specify specific monitors, and you can also have different conditions for each one. -:::{image} ../../../images/observability-monitor-status-alert.png +:::{image} /solutions/images/observability-monitor-status-alert.png :alt: Monitor status rule :screenshot: ::: @@ -214,21 +214,21 @@ You can extend your rules by connecting them to actions that use the following s You can configure action types on the [Settings](../../../solutions/observability/apps/configure-settings.md#configure-uptime-alert-connectors) page. -:::{image} ../../../images/observability-uptime-alert-connectors.png +:::{image} /solutions/images/observability-uptime-alert-connectors.png :alt: Uptime rule connectors :screenshot: ::: After you select a connector, you must set the action frequency. You can choose to create a summary of alerts on each check interval or on a custom interval. For example, send email notifications that summarize the new, ongoing, and recovered alerts each hour: -:::{image} ../../../images/observability-action-alert-summary.png +:::{image} /solutions/images/observability-action-alert-summary.png :alt: Action frequency summary of alerts :screenshot: ::: Alternatively, you can set the action frequency such that you choose how often the action runs (for example, at each check interval, only when the alert status changes, or at a custom action interval). In this case, you must also select the specific threshold condition that affects when actions run: `Uptime Down Monitor` or `Recovered`. -:::{image} ../../../images/observability-uptime-run-when-selection.png +:::{image} /solutions/images/observability-uptime-run-when-selection.png :alt: Action frequency for each alert :screenshot: ::: @@ -238,7 +238,7 @@ Alternatively, you can set the action frequency such that you choose how often t Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables. -:::{image} ../../../images/observability-monitor-status-alert-default-message.png +:::{image} /solutions/images/observability-monitor-status-alert-default-message.png :alt: Default notification message for monitor status rules with open "Add variable" popup listing available action variables :screenshot: ::: @@ -248,7 +248,7 @@ Use the default notification message or customize it. You can add more context t To receive a notification when the alert recovers, select **Run when Recovered**. Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables. -:::{image} ../../../images/observability-monitor-status-alert-recovery.png +:::{image} /solutions/images/observability-monitor-status-alert-recovery.png :alt: Default recovery message for monitor status rules with open "Add variable" popup listing available action variables :screenshot: ::: diff --git a/solutions/observability/incident-management/create-tls-certificate-rule.md b/solutions/observability/incident-management/create-tls-certificate-rule.md index 97bbc8af99..c893ee550d 100644 --- a/solutions/observability/incident-management/create-tls-certificate-rule.md +++ b/solutions/observability/incident-management/create-tls-certificate-rule.md @@ -37,7 +37,7 @@ You can also set **Advanced options** such as the number of consecutive runs tha In this example, the conditions are met when any of the TLS certificates on sites we’re monitoring is expiring within 30 days or is older than 730 days. These conditions are evaluated every 6 hours, and you will only receive an alert when the conditions are met three times consecutively. -:::{image} ../../../images/observability-tls-rule-synthetics-conditions.png +:::{image} /solutions/images/observability-tls-rule-synthetics-conditions.png :alt: Conditions and advanced options defining a Synthetics TLS certificate rule :screenshot: ::: @@ -74,14 +74,14 @@ Some connector types are paid commercial features, while others are free. For a After you select a connector, you must set the action frequency. You can choose to create a summary of alerts on each check interval or on a custom interval. For example, send email notifications that summarize the new, ongoing, and recovered alerts each hour: -:::{image} ../../../images/observability-tls-rule-synthetics-action-types-summary.png +:::{image} /solutions/images/observability-tls-rule-synthetics-action-types-summary.png :alt: tls rule synthetics action types summary :screenshot: ::: Alternatively, you can set the action frequency such that you choose how often the action runs (for example, at each check interval, only when the alert status changes, or at a custom action interval). In this case, you must also select the specific threshold condition that affects when actions run: the *Synthetics TLS certificate* changes or when it is *Recovered* (went from down to up). -:::{image} ../../../images/observability-tls-rule-synthetics-action-types-each-alert.png +:::{image} /solutions/images/observability-tls-rule-synthetics-action-types-each-alert.png :alt: tls rule synthetics action types each alert :screenshot: ::: @@ -91,7 +91,7 @@ You can also further refine the conditions under which actions run by specifying * **If alert matches query**: Enter a KQL query that defines field-value pairs or query conditions that must be met for notifications to send. The query only searches alert documents in the indices specified for the rule. * **If alert is generated during timeframe**: Set timeframe details. Notifications are only sent if alerts are generated within the timeframe you define. -:::{image} ../../../images/observability-tls-rule-synthetics-action-types-more-options.png +:::{image} /solutions/images/observability-tls-rule-synthetics-action-types-more-options.png :alt: tls rule synthetics action types more options :screenshot: ::: @@ -101,7 +101,7 @@ You can also further refine the conditions under which actions run by specifying Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables. -:::{image} ../../../images/observability-tls-rule-synthetics-action-variables.png +:::{image} /solutions/images/observability-tls-rule-synthetics-action-variables.png :alt: tls rule synthetics action variables :screenshot: ::: @@ -180,7 +180,7 @@ You can specify the following thresholds for your rule: In this example, the conditions are met when any of the TLS certificates on sites we’re monitoring is expiring within 30 days or is older than 730 days. These conditions are evaluated every 6 hours, and you will only receive an alert when the conditions are met three times consecutively. -:::{image} ../../../images/observability-tls-rule-uptime-conditions.png +:::{image} /solutions/images/observability-tls-rule-uptime-conditions.png :alt: Monitor status rule :screenshot: ::: @@ -219,14 +219,14 @@ Some connector types are paid commercial features, while others are free. For a After you select a connector, you must set the action frequency. You can choose to create a summary of alerts on each check interval or on a custom interval. For example, send email notifications that summarize the new, ongoing, and recovered alerts each hour: -:::{image} ../../../images/observability-tls-rule-uptime-action-types-summary.png +:::{image} /solutions/images/observability-tls-rule-uptime-action-types-summary.png :alt: tls rule uptime action types summary :screenshot: ::: Alternatively, you can set the action frequency such that you choose how often the action runs (for example, at each check interval, only when the alert status changes, or at a custom action interval). In this case, you must also select the specific threshold condition that affects when actions run: *Uptime TLS Alert* or *Recovered* (went from down to up). -:::{image} ../../../images/observability-tls-rule-uptime-action-types-each-alert.png +:::{image} /solutions/images/observability-tls-rule-uptime-action-types-each-alert.png :alt: tls rule uptime action types each alert :screenshot: ::: @@ -236,7 +236,7 @@ You can also further refine the conditions under which actions run by specifying * **If alert matches query**: Enter a KQL query that defines field-value pairs or query conditions that must be met for notifications to send. The query only searches alert documents in the indices specified for the rule. * **If alert is generated during timeframe**: Set timeframe details. Notifications are only sent if alerts are generated within the timeframe you define. -:::{image} ../../../images/observability-tls-rule-uptime-action-types-more-options.png +:::{image} /solutions/images/observability-tls-rule-uptime-action-types-more-options.png :alt: tls rule uptime action types more options :screenshot: ::: @@ -246,7 +246,7 @@ You can also further refine the conditions under which actions run by specifying Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables. -:::{image} ../../../images/observability-tls-rule-uptime-default-message.png +:::{image} /solutions/images/observability-tls-rule-uptime-default-message.png :alt: Default notification message for TLS rules with open "Add variable" popup listing available action variables :screenshot: ::: diff --git a/solutions/observability/incident-management/service-level-objectives-slos.md b/solutions/observability/incident-management/service-level-objectives-slos.md index 8048f23162..91ceb55378 100644 --- a/solutions/observability/incident-management/service-level-objectives-slos.md +++ b/solutions/observability/incident-management/service-level-objectives-slos.md @@ -35,7 +35,7 @@ In addition to these key concepts related to SLO functionality, see [Understandi From the SLO overview, you can see all of your SLOs and a quick summary of what’s happening in each one: -:::{image} ../../../images/observability-slo-dashboard.png +:::{image} /solutions/images/observability-slo-dashboard.png :alt: Dashboard showing list of SLOs :screenshot: ::: @@ -47,7 +47,7 @@ Select an SLO from the overview to see additional details including: * **Error budget burn down:** the remaining error budget and how it’s trending over the SLO time window. * **Alerts:** active alerts if you’ve set any [SLO burn rate alert rules](../../../solutions/observability/incident-management/create-an-slo-burn-rate-rule.md) for the SLO. -:::{image} ../../../images/serverless-slo-detailed-view.png +:::{image} /solutions/images/serverless-slo-detailed-view.png :alt: Detailed view of a single SLO :screenshot: ::: @@ -57,25 +57,25 @@ Select an SLO from the overview to see additional details including: You can apply searches and filters to quickly find the SLOs you’re interested in. -:::{image} ../../../images/serverless-slo-filtering-options.png +:::{image} /solutions/images/serverless-slo-filtering-options.png :alt: Options for filtering SLOs in the overview :screenshot: ::: -* **Apply structured filters:** Next to the search field, click the **Add filter** ![Add filter icon](../../../images/serverless-plusInCircleFilled.svg "") icon to add a custom filter. Notice that you can use `OR` and `AND` to combine filters. The structured filter can be disabled, inverted, or pinned across all apps. +* **Apply structured filters:** Next to the search field, click the **Add filter** ![Add filter icon](/solutions/images/serverless-plusInCircleFilled.svg "") icon to add a custom filter. Notice that you can use `OR` and `AND` to combine filters. The structured filter can be disabled, inverted, or pinned across all apps. * **Enter a semi-structured search:** In the search field, start typing a field name to get suggestions for field names and operators that you can use to build a structured query. The semi-structured search will filter SLOs for matches, and only return matching SLOs. * Use the **Status** and **Tags** menus to include or exclude SLOs from the view based on the status or defined tags. There are also options to sort and group the SLOs displayed in the overview: -:::{image} ../../../images/serverless-slo-group-by.png +:::{image} /solutions/images/serverless-slo-group-by.png :alt: SLOs sorted by SLO status and grouped by tags :screenshot: ::: * **Sort by**: SLI value, SLO status, Error budget consumed, or Error budget remaining. * **Group by**: None, Tags, Status, or SLI type. -* Click icons to switch between a card view (![Card view icon](../../../images/serverless-apps.svg "")), list view (![List view icon](../../../images/serverless-list.svg "")), or compact view (![Compact view icon](../../../images/serverless-tableDensityCompact.svg "")]). +* Click icons to switch between a card view (![Card view icon](/solutions/images/serverless-apps.svg "")), list view (![List view icon](/solutions/images/serverless-list.svg "")), or compact view (![Compact view icon](/solutions/images/serverless-tableDensityCompact.svg "")]). ## SLO dashboard panels [observability-slos-slo-dashboard-panels] @@ -87,7 +87,7 @@ Available SLO panels include: * **SLO Overview**: Visualize a selected SLO’s health, including name, current SLI value, target, and status. * **SLO Alerts**: Visualize one or more SLO alerts, including status, rule name, duration, and reason. In addition, configure and update alerts, or create cases directly from the panel. -:::{image} ../../../images/serverless-slo-dashboard-panel.png +:::{image} /solutions/images/serverless-slo-dashboard-panel.png :alt: Detailed view of an SLO dashboard panel :screenshot: ::: diff --git a/solutions/observability/incident-management/triage-slo-burn-rate-breaches.md b/solutions/observability/incident-management/triage-slo-burn-rate-breaches.md index a60ea54626..e50d3c4d87 100644 --- a/solutions/observability/incident-management/triage-slo-burn-rate-breaches.md +++ b/solutions/observability/incident-management/triage-slo-burn-rate-breaches.md @@ -14,7 +14,7 @@ SLO burn rate breaches occur when the percentage of bad events over a specified To triage issues quickly, go to the alert details page: 1. Open the SLO and click **Alerts**. -2. From the Alerts table, click the ![More actions](../../../images/observability-boxesHorizontal.svg "") icon next to the alert and select **View alert details**. +2. From the Alerts table, click the ![More actions](/solutions/images/observability-boxesHorizontal.svg "") icon next to the alert and select **View alert details**. The alert details page shows information about the alert, including when the alert was triggered, the duration of the alert, the source SLO, and the rule that triggered the alert. You can follow the links to navigate to the source SLO or rule definition. @@ -22,7 +22,7 @@ Explore charts on the page to learn more about the SLO breach: * **Burn rate chart**. The first chart shows the burn rate during the time range when the alert was active. The line indicates how close the SLO came to breaching the threshold. - :::{image} ../../../images/observability-slo-burn-rate-breach.png + :::{image} /solutions/images/observability-slo-burn-rate-breach.png :alt: Alert details for SLO burn rate breach :screenshot: ::: @@ -34,7 +34,7 @@ Explore charts on the page to learn more about the SLO breach: * **Alerts history chart**. The next chart provides information about alerts for the same rule and group over the last 30 days. It shows the number of those alerts that were triggered per day, the total number of alerts triggered throughout the 30 days, and the average time it took to recover after a breach. - :::{image} ../../../images/observability-log-threshold-breach-alert-history-chart.png + :::{image} /solutions/images/observability-log-threshold-breach-alert-history-chart.png :alt: Alert history chart in alert details for SLO burn rate breach :screenshot: ::: @@ -50,5 +50,5 @@ The contents of the alert details page may vary depending on the type of SLI tha After investigating the alert, you may want to: * Click **Snooze the rule** to snooze notifications for a specific time period or indefinitely. -* Click the ![Actions](../../../images/observability-boxesVertical.svg "") icon and select **Add to case** to add the alert to a new or existing case. To learn more, refer to [Cases](../../../solutions/observability/incident-management/cases.md). -* Click the ![Actions](../../../images/observability-boxesVertical.svg "") icon and select **Mark as untracked**. When an alert is marked as untracked, actions are no longer generated. You can choose to move active alerts to this state when you disable or delete rules. \ No newline at end of file +* Click the ![Actions](/solutions/images/observability-boxesVertical.svg "") icon and select **Add to case** to add the alert to a new or existing case. To learn more, refer to [Cases](../../../solutions/observability/incident-management/cases.md). +* Click the ![Actions](/solutions/images/observability-boxesVertical.svg "") icon and select **Mark as untracked**. When an alert is marked as untracked, actions are no longer generated. You can choose to move active alerts to this state when you disable or delete rules. \ No newline at end of file diff --git a/solutions/observability/incident-management/triage-threshold-breaches.md b/solutions/observability/incident-management/triage-threshold-breaches.md index afbee98a3b..76a52f748e 100644 --- a/solutions/observability/incident-management/triage-threshold-breaches.md +++ b/solutions/observability/incident-management/triage-threshold-breaches.md @@ -14,7 +14,7 @@ Threshold breaches occur when an {{observability}} data type reaches or exceeds To triage issues quickly, go to the alert details page: 1. Find **Alerts** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). -2. From the Alerts table, click the ![More actions](../../../images/observability-boxesHorizontal.svg "") icon next to the alert and select **View alert details**. +2. From the Alerts table, click the ![More actions](/solutions/images/observability-boxesHorizontal.svg "") icon next to the alert and select **View alert details**. The alert details page shows information about the alert, including when the alert was triggered, the duration of the alert, and the last status update. If there is a "group by" field specified in the rule, the page also includes the source. You can follow the links to navigate to the rule definition. @@ -22,7 +22,7 @@ Explore charts on the page to learn more about the threshold breach: * **Charts for each condition**. The page includes a chart for each condition specified in the rule. These charts help you understand when the breach occurred and its severity. - :::{image} ../../../images/observability-log-threshold-breach-condition-chart.png + :::{image} /solutions/images/observability-log-threshold-breach-condition-chart.png :alt: Chart for a condition in alert details for log threshold breach :screenshot: ::: @@ -34,14 +34,14 @@ Explore charts on the page to learn more about the threshold breach: * **Log rate analysis chart**. If your rule is intended to detect log threshold breaches (that is, it has a single condition that uses a count aggregation), you can run a log rate analysis, assuming you have the required license. Running a log rate analysis is useful for detecting significant dips or spikes in the number of logs. Notice that you can adjust the baseline and deviation, and then run the analysis again. For more information about using the log rate analysis feature, refer to the [AIOps Labs](../../../explore-analyze/machine-learning/machine-learning-in-kibana/xpack-ml-aiops.md#log-rate-analysis) documentation. - :::{image} ../../../images/observability-log-threshold-breach-log-rate-analysis.png + :::{image} /solutions/images/observability-log-threshold-breach-log-rate-analysis.png :alt: Log rate analysis chart in alert details for log threshold breach :screenshot: ::: * **Alerts history chart**. The next chart provides information about alerts for the same rule and group over the last 30 days. It shows the number of those alerts that were triggered per day, the total number of alerts triggered throughout the 30 days, and the average time it took to recover after a breach. - :::{image} ../../../images/observability-log-threshold-breach-alert-history-chart.png + :::{image} /solutions/images/observability-log-threshold-breach-alert-history-chart.png :alt: Alert history chart in alert details for log threshold breach :screenshot: ::: @@ -52,5 +52,5 @@ Analyze these charts to better understand when the breach started, it’s curren After investigating the alert, you may want to: * Click **Snooze the rule** to snooze notifications for a specific time period or indefinitely. -* Click the ![Actions](../../../images/observability-boxesVertical.svg "") icon and select **Add to case** to add the alert to a new or existing case. To learn more, refer to [Cases](../../../solutions/observability/incident-management/cases.md). -* Click the ![Actions](../../../images/observability-boxesVertical.svg "") icon and select **Mark as untracked**. When an alert is marked as untracked, actions are no longer generated. You can choose to move active alerts to this state when you disable or delete rules. \ No newline at end of file +* Click the ![Actions](/solutions/images/observability-boxesVertical.svg "") icon and select **Add to case** to add the alert to a new or existing case. To learn more, refer to [Cases](../../../solutions/observability/incident-management/cases.md). +* Click the ![Actions](/solutions/images/observability-boxesVertical.svg "") icon and select **Mark as untracked**. When an alert is marked as untracked, actions are no longer generated. You can choose to move active alerts to this state when you disable or delete rules. \ No newline at end of file diff --git a/solutions/observability/incident-management/view-alerts.md b/solutions/observability/incident-management/view-alerts.md index e42afd5c37..febfd79563 100644 --- a/solutions/observability/incident-management/view-alerts.md +++ b/solutions/observability/incident-management/view-alerts.md @@ -21,7 +21,7 @@ You can track and manage alerts for your applications and SLOs from the **Alerts You can centrally manage rules from the [{{kib}} Management UI](../../../explore-analyze/alerts-cases/alerts/create-manage-rules.md) that provides a set of built-in [rule types](../../../explore-analyze/alerts-cases/alerts/rule-types.md) and [connectors](../../../deploy-manage/manage-connectors.md) for you to use. Click **Manage Rules**. :::: -:::{image} ../../../images/serverless-observability-alerts-view.png +:::{image} /solutions/images/serverless-observability-alerts-view.png :alt: Alerts page :screenshot: ::: @@ -42,7 +42,7 @@ There are a few ways to inspect the details for a specific alert. From the **Alerts** table, you can click on a specific alert to open the alert detail flyout to view a summary of the alert without leaving the page. There you’ll see the current status of the alert, its duration, and when it was last updated. To help you determine what caused the alert, you can view the expected and actual threshold values, and the rule that produced the alert. -:::{image} ../../../images/serverless-alert-details-flyout.png +:::{image} /solutions/images/serverless-alert-details-flyout.png :alt: Alerts detail (APM anomaly) :screenshot: ::: @@ -59,7 +59,7 @@ There are three common alert statuses: : The conditions for the rule are no longer met and recovery actions should be generated. `untracked` -: The corresponding rule is disabled or you’ve marked the alert as untracked. To mark the alert as untracked, go to the **Alerts** table, click the ![More actions](../../../images/serverless-boxesHorizontal.svg "") icon to expand the *More actions* menu, and click **Mark as untracked**. When an alert is marked as untracked, actions are no longer generated. You can choose to move active alerts to this state when you disable or delete rules. +: The corresponding rule is disabled or you’ve marked the alert as untracked. To mark the alert as untracked, go to the **Alerts** table, click the ![More actions](/solutions/images/serverless-boxesHorizontal.svg "") icon to expand the *More actions* menu, and click **Mark as untracked**. When an alert is marked as untracked, actions are no longer generated. You can choose to move active alerts to this state when you disable or delete rules. ::::{note} **Flapping alerts** @@ -72,12 +72,12 @@ The flapping state is possible only if you have enabled alert flapping detection To further inspect the rule: * From the alert detail flyout, click **View rule details**. -* From the **Alerts** table, click the ![More actions](../../../images/serverless-boxesHorizontal.svg "") icon and select **View rule details**. +* From the **Alerts** table, click the ![More actions](/solutions/images/serverless-boxesHorizontal.svg "") icon and select **View rule details**. To view the alert in the app that triggered it: * From the alert detail flyout, click **View in app**. -* From the **Alerts** table, click the ![View in app](../../../images/serverless-eye.svg "") icon. +* From the **Alerts** table, click the ![View in app](/solutions/images/serverless-eye.svg "") icon. ## Customize the alerts table [observability-view-alerts-customize-the-alerts-table] @@ -95,7 +95,7 @@ You can also use the toolbar buttons in the upper-right to customize the display ## Add alerts to cases [observability-view-alerts-add-alerts-to-cases] -From the **Alerts** table, you can add one or more alerts to a case. Click the ![More actions](../../../images/serverless-boxesHorizontal.svg "") icon to add the alert to a new or existing case. You can add an unlimited amount of alerts from any rule type. +From the **Alerts** table, you can add one or more alerts to a case. Click the ![More actions](/solutions/images/serverless-boxesHorizontal.svg "") icon to add the alert to a new or existing case. You can add an unlimited amount of alerts from any rule type. ::::{note} Each case can have a maximum of 1,000 alerts. diff --git a/solutions/observability/infra-and-hosts/add-symbols-for-native-frames.md b/solutions/observability/infra-and-hosts/add-symbols-for-native-frames.md index 576b424c3b..312f54162b 100644 --- a/solutions/observability/infra-and-hosts/add-symbols-for-native-frames.md +++ b/solutions/observability/infra-and-hosts/add-symbols-for-native-frames.md @@ -29,7 +29,7 @@ Before using the `symbtool` binary, create an [Elasticsearch API token](../../.. You also need to copy the **Symbols** endpoint from the deployment overview page. Pass this URL using the `-u` or `--url` argument. -:::{image} ../../../images/observability-profiling-symbolizer-url.png +:::{image} /solutions/images/observability-profiling-symbolizer-url.png :alt: profiling symbolizer url :screenshot: ::: diff --git a/solutions/observability/infra-and-hosts/analyze-compare-hosts.md b/solutions/observability/infra-and-hosts/analyze-compare-hosts.md index 007b58a212..f1825a3b02 100644 --- a/solutions/observability/infra-and-hosts/analyze-compare-hosts.md +++ b/solutions/observability/infra-and-hosts/analyze-compare-hosts.md @@ -23,7 +23,7 @@ To access the **Hosts** page in: - **Elastic Stack,** find **Infrastructure** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). - **Serverless,** go to **Infrastructure → Hosts** in your Elastic Observability Serverless project. -:::{image} ../../../images/serverless-hosts.png +:::{image} /solutions/images/serverless-hosts.png :alt: Screenshot of the Hosts page :screenshot: ::: @@ -91,7 +91,7 @@ To see metrics for a specific host, refer to [View host details](../../../soluti Metrics visualizations are powered by Lens, meaning you can continue your analysis in Lens if you require more flexibility. Hover your cursor over a visualization, then click the ellipsis icon in the upper-right corner to open the visualization in Lens. -:::{image} ../../../images/serverless-hosts-open-in-lens.png +:::{image} /solutions/images/serverless-hosts-open-in-lens.png :alt: Screenshot showing option to open in Lens :screenshot: ::: @@ -105,7 +105,7 @@ For more information about using Lens, refer to the [{{kib}} documentation about On the **Logs** tab of the **Hosts** page, view logs for the systems you are monitoring and search for specific log entries. This view shows logs for all of the hosts returned by the current query. -:::{image} ../../../images/serverless-hosts-logs.png +:::{image} /solutions/images/serverless-hosts-logs.png :alt: Screenshot showing Logs view :screenshot: ::: @@ -123,7 +123,7 @@ From the **Actions** menu, you can choose to: * View rule details. * View alert details. -:::{image} ../../../images/serverless-hosts-view-alerts.png +:::{image} /solutions/images/serverless-hosts-view-alerts.png :alt: Screenshot showing Alerts view :screenshot: ::: @@ -146,7 +146,7 @@ To learn more about creating and managing rules, refer to [Alerting](../../../so ## View host details [view-host-details] -Without leaving the **Hosts** page, you can view enhanced metrics relating to each host running in your infrastructure. In the list of hosts, find the host you want to monitor, then click the **Toggle dialog with details** icon ![expand icon](../../../images/serverless-expand-icon.png "") to display the host details overlay. +Without leaving the **Hosts** page, you can view enhanced metrics relating to each host running in your infrastructure. In the list of hosts, find the host you want to monitor, then click the **Toggle dialog with details** icon ![expand icon](/solutions/images/serverless-expand-icon.png "") to display the host details overlay. ::::{tip} To expand the overlay and view more detail, click **Open as page** in the upper-right corner. @@ -167,7 +167,7 @@ Hover over a specific time period on a chart to compare the various metrics at t Click **Show all** to drill down into related data. -:::{image} ../../../images/serverless-overview-overlay.png +:::{image} /solutions/images/serverless-overview-overlay.png :alt: Host overview :screenshot: ::: @@ -180,7 +180,7 @@ The **Metadata** tab lists all the meta information relating to the host, includ This information can help when investigating events—for example, when filtering by operating system or architecture. -:::{image} ../../../images/serverless-metadata-overlay.png +:::{image} /solutions/images/serverless-metadata-overlay.png :alt: Host metadata :screenshot: ::: @@ -191,7 +191,7 @@ This information can help when investigating events—for example, when filterin :::::{dropdown} Metrics The **Metrics** tab shows host metrics organized by type and is more complete than the view available in the *Overview* tab. -:::{image} ../../../images/serverless-metrics-overlay.png +:::{image} /solutions/images/serverless-metrics-overlay.png :alt: Metrics :screenshot: ::: @@ -222,7 +222,7 @@ The processes listed in the **Top processes** table are based on an aggregation | **Memory** | The percentage of memory (`system.process.memory.rss.pct`) the process occupied in main memory (RAM). | | **State** | The current state of the process and the total number of processes (`system.process.state`). Expected values are: `running`, `sleeping`, `dead`, `stopped`, `idle`, `zombie`, and `unknown`. | -:::{image} ../../../images/serverless-processes-overlay.png +:::{image} /solutions/images/serverless-processes-overlay.png :alt: Host processes :screenshot: ::: @@ -241,7 +241,7 @@ The **Universal Profiling** tab shows CPU usage down to the application code lev For more on Universal Profiling, refer to the [Universal Profiling](../../../solutions/observability/infra-and-hosts/universal-profiling.md) docs. -:::{image} ../../../images/observability-universal-profiling-overlay.png +:::{image} /solutions/images/observability-universal-profiling-overlay.png :alt: Host Universal Profiling :screenshot: ::: @@ -259,7 +259,7 @@ The **Logs** tab displays logs relating to the host that you have selected. By d To view the logs in the {{logs-app}} for a detailed analysis, click **Open in Logs**. -:::{image} ../../../images/serverless-logs-overlay.png +:::{image} /solutions/images/serverless-logs-overlay.png :alt: Host logs :screenshot: ::: @@ -274,7 +274,7 @@ Along with the name of each anomaly job, detected anomalies with a severity scor To drill down and analyze the metric anomaly, select **Actions** → **Open in Anomaly Explorer**. You can also select **Actions** → **Show in Inventory** to view the host Inventory page, filtered by the specific metric. -:::{image} ../../../images/serverless-anomalies-overlay.png +:::{image} /solutions/images/serverless-anomalies-overlay.png :alt: Anomalies :screenshot: ::: @@ -314,7 +314,7 @@ Other options include: * Add, remove, reorder, and resize columns. * Sort field names in ascending or descending order. -:::{image} ../../../images/serverless-osquery-overlay.png +:::{image} /solutions/images/serverless-osquery-overlay.png :alt: Osquery :screenshot: ::: @@ -342,7 +342,7 @@ There are a few reasons why you may see dashed lines in your charts. In this example, the data emission rate is lower than the Lens chart interval. A dashed line connects the known data points to make it easier to visualize trends in the data. -:::{image} ../../../images/serverless-hosts-dashed.png +:::{image} /solutions/images/serverless-hosts-dashed.png :alt: Screenshot showing dashed chart :screenshot: ::: @@ -360,7 +360,7 @@ Want to dig in further while maintaining the selected time duration? Hover over A solid line indicates that the chart interval is set appropriately for the data transmission rate. In this example, a solid line turns into a dashed line—indicating missing data. You may want to investigate this time period to determine if there is an outage or issue. -:::{image} ../../../images/serverless-hosts-missing-data.png +:::{image} /solutions/images/serverless-hosts-missing-data.png :alt: Screenshot showing missing data :screenshot: ::: @@ -372,7 +372,7 @@ In the example shown in the screenshot, the data emission rate is lower than the This missing data can be hard to spot at first glance. The green boxes outline regular data emissions, while the missing data is outlined in pink. Similar to the above scenario, you may want to investigate the time period with the missing data to determine if there is an outage or issue. -:::{image} ../../../images/serverless-hosts-dashed-and-missing.png +:::{image} /solutions/images/serverless-hosts-dashed-and-missing.png :alt: Screenshot showing dashed lines and missing data :screenshot: ::: @@ -383,7 +383,7 @@ This missing data can be hard to spot at first glance. The green boxes outline r ### What does *this host has been detected by APM* mean? [observability-analyze-hosts-what-does-mean] -In the Hosts view, you might see a question mark icon (![Question mark icon](../../../images/serverless-questionInCircle.svg "")) before a host name with a tooltip note stating that the host has been detected by APM. +In the Hosts view, you might see a question mark icon (![Question mark icon](/solutions/images/serverless-questionInCircle.svg "")) before a host name with a tooltip note stating that the host has been detected by APM. When a host is detected by APM, but is not collecting full metrics (for example, through the [system integration](https://www.elastic.co/docs/current/integrations/system)), it will be listed as a host with the partial metrics collected by APM. diff --git a/solutions/observability/infra-and-hosts/detect-metric-anomalies.md b/solutions/observability/infra-and-hosts/detect-metric-anomalies.md index 71b90c4fae..dd02a63d66 100644 --- a/solutions/observability/infra-and-hosts/detect-metric-anomalies.md +++ b/solutions/observability/infra-and-hosts/detect-metric-anomalies.md @@ -72,7 +72,7 @@ After creating {{ml}} jobs, you cannot change the settings. You can recreate the :::: -:::{image} ../../../images/serverless-metrics-ml-jobs.png +:::{image} /solutions/images/serverless-metrics-ml-jobs.png :alt: Infrastructure {{ml-app}} anomalies :screenshot: ::: @@ -94,7 +94,7 @@ These predefined {{anomaly-jobs}} use [custom rules](https://www.elastic.co/guid On the **Infrastructure inventory** page, click **Show history** to view the metric values within the selected time frame. Detected anomalies with an anomaly score equal to 50 or higher are highlighted in red. To examine the detected anomalies, use the Anomaly Explorer. -:::{image} ../../../images/serverless-metrics-history-chart.png +:::{image} /solutions/images/serverless-metrics-history-chart.png :alt: History :screenshot: ::: \ No newline at end of file diff --git a/solutions/observability/infra-and-hosts/explore-infrastructure-metrics-over-time.md b/solutions/observability/infra-and-hosts/explore-infrastructure-metrics-over-time.md index 4fcee741ce..d6b7811733 100644 --- a/solutions/observability/infra-and-hosts/explore-infrastructure-metrics-over-time.md +++ b/solutions/observability/infra-and-hosts/explore-infrastructure-metrics-over-time.md @@ -13,7 +13,7 @@ Additionally, for detailed analyses of your metrics, you can annotate and save v To open **Metrics Explorer**, find **Infrastructure** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). -:::{image} ../../../images/observability-metrics-explorer.png +:::{image} /solutions/images/observability-metrics-explorer.png :alt: Metrics Explorer :screenshot: ::: @@ -40,7 +40,7 @@ As an example, let’s view the system load metrics for hosts we’re currently There is now an individual graph displaying the average values of the metrics for each host. - :::{image} ../../../images/observability-metrics-explorer-filter.png + :::{image} /solutions/images/observability-metrics-explorer-filter.png :alt: Metrics Explorer query :screenshot: ::: @@ -59,7 +59,7 @@ As an example, let’s view the system load metrics for hosts we’re currently In this visualization the max of `host.network.egress.bytes` is displayed, filtered by `host.name` and `system.network.name`. - :::{image} ../../../images/observability-metrics-time-series.png + :::{image} /solutions/images/observability-metrics-time-series.png :alt: Time series chart :screenshot: ::: diff --git a/solutions/observability/infra-and-hosts/get-started-with-system-metrics.md b/solutions/observability/infra-and-hosts/get-started-with-system-metrics.md index 3b396cab28..99866cfde0 100644 --- a/solutions/observability/infra-and-hosts/get-started-with-system-metrics.md +++ b/solutions/observability/infra-and-hosts/get-started-with-system-metrics.md @@ -63,14 +63,14 @@ In this step, add the System integration to monitor host logs and metrics. 4. Configure the integration name and optionally add a description. Make sure that **Collect logs from System instances** and **Collect metrics from System instances** are turned on. 5. Expand each configuration section to verify that the settings are correct for your host. For example, if you’re deploying {{agent}} on macOS hosts, you need to add a new path to the *System syslog logs* section by clicking **Add row** and specifying `/var/log/system.log`. - :::{image} ../../../images/observability-kibana-agent-add-log-path.png + :::{image} /solutions/images/observability-kibana-agent-add-log-path.png :alt: Configuration page for adding log paths to the {{agent}} System integration :screenshot: ::: 6. Click **Save and continue**. This step takes a minute or two to complete. When it’s done, you’ll have an agent policy that contains a system integration policy for the configuration you just specified. - :::{image} ../../../images/observability-kibana-system-policy.png + :::{image} /solutions/images/observability-kibana-system-policy.png :alt: Configuration page for adding the {{agent}} System integration :screenshot: ::: @@ -107,7 +107,7 @@ The **Add agent** flyout has two options: **Enroll in {{fleet}}** and **Run stan 2. Download, install, and enroll the {{agent}} on your host by selecting your host operating system and following the **Install {{agent}} on your host** step. - :::{image} ../../../images/observability-kibana-agent-flyout.png + :::{image} /solutions/images/observability-kibana-agent-flyout.png :alt: Add agent flyout in {{kib}} :screenshot: ::: diff --git a/solutions/observability/infra-and-hosts/get-started-with-universal-profiling.md b/solutions/observability/infra-and-hosts/get-started-with-universal-profiling.md index 02065629af..e7fef52a14 100644 --- a/solutions/observability/infra-and-hosts/get-started-with-universal-profiling.md +++ b/solutions/observability/infra-and-hosts/get-started-with-universal-profiling.md @@ -69,7 +69,7 @@ To set up Universal Profiling on your {{ecloud}} deployment, you need to [config After enabling Universal Profiling on your deployment for the first time, select any subheading under **Universal Profiling** in the navigation menu to open the following page: -:::{image} ../../../images/observability-profiling-setup-popup.png +:::{image} /solutions/images/observability-profiling-setup-popup.png :alt: profiling setup popup :screenshot: ::: @@ -119,7 +119,7 @@ To install the Universal Profiling Agent using the {{agent}} and the Universal P 1. Copy the `secret token` and `Universal Profiling Collector url` from the Elastic Agent Integration - :::{image} ../../../images/observability-profiling-elastic-agent.png + :::{image} /solutions/images/observability-profiling-elastic-agent.png :alt: profiling elastic agent :screenshot: ::: @@ -131,7 +131,7 @@ To install the Universal Profiling Agent using the {{agent}} and the Universal P 1. Add the Universal Profiling collector URL to the **Universal Profiling collector endpoint** field. 2. Add the secret token to the **Authorization** field. - :::{image} ../../../images/observability-profililing-elastic-agent-creds.png + :::{image} /solutions/images/observability-profililing-elastic-agent-creds.png :alt: profililing elastic agent creds :screenshot: ::: @@ -147,7 +147,7 @@ After clicking **Set up Universal Profiling** in the previous step, you’ll see The following is an example of the provided instructions for {{k8s}}: -:::{image} ../../../images/observability-profiling-k8s-hostagent.png +:::{image} /solutions/images/observability-profiling-k8s-hostagent.png :alt: profiling k8s hostagent :screenshot: ::: diff --git a/solutions/observability/infra-and-hosts/run-universal-profiling-on-self-hosted-elastic-stack.md b/solutions/observability/infra-and-hosts/run-universal-profiling-on-self-hosted-elastic-stack.md index 729a86fb3e..ea788f58cd 100644 --- a/solutions/observability/infra-and-hosts/run-universal-profiling-on-self-hosted-elastic-stack.md +++ b/solutions/observability/infra-and-hosts/run-universal-profiling-on-self-hosted-elastic-stack.md @@ -59,7 +59,7 @@ The backend is made up of two services: the collector and the symbolizer. * The collector receives profiling data from the Universal Profiling Agents and sends it to {{es}}. It listens on an HTTP server and serves a gRPC endpoint. * The symbolizer processes debug symbols that are not available on the Universal Profiling Agent, and symbolizes native frames from OS packages. It also listens on an HTTP server and serves an endpoint to upload private debug symbols. Refer to [Adding symbols](add-symbols-for-native-frames.md) for more information on the importance of adding symbols. -:::{image} ../../../images/observability-profiling-self-managed-ingestion-architecture.png +:::{image} /solutions/images/observability-profiling-self-managed-ingestion-architecture.png :alt: profiling self managed ingestion architecture :screenshot: ::: diff --git a/solutions/observability/infra-and-hosts/tutorial-observe-kubernetes-deployments.md b/solutions/observability/infra-and-hosts/tutorial-observe-kubernetes-deployments.md index 22305a77ad..91d016cba3 100644 --- a/solutions/observability/infra-and-hosts/tutorial-observe-kubernetes-deployments.md +++ b/solutions/observability/infra-and-hosts/tutorial-observe-kubernetes-deployments.md @@ -43,7 +43,7 @@ The {{stack}} provides the following components for monitoring Kubernetes: 4. {{es}} for storing and searching your data. 5. {{observability}} apps in {{kib}} for visualizing and managing your observability data. -:::{image} ../../../images/observability-k8s-monitoring-architecture.png +:::{image} /solutions/images/observability-k8s-monitoring-architecture.png :alt: Kubernetes monitoring architecture ::: @@ -56,7 +56,7 @@ The default installation of {{agent}} is deployed to Kubernetes as a DaemonSet t The default deployments include processors, when needed, for enriching events with cloud and host metadata. -:::{image} ../../../images/observability-metadata-processors.png +:::{image} /solutions/images/observability-metadata-processors.png :alt: Metadata processors for cloud ::: @@ -457,7 +457,7 @@ After configuring your integration, you need to download and update your manifes 2. Click **Add {{agent}} to your hosts**. 3. Under **Enroll in Fleet?**, select **Run standalone**. - :::{image} ../../../images/observability-run-standalone-option.png + :::{image} /solutions/images/observability-run-standalone-option.png :alt: Select run standalone under Enroll in Fleet :screenshot: ::: @@ -500,7 +500,7 @@ To view the performance and health metrics collected by {{agent}}, find **Infras On the **Infrastructure inventory** page, you can switch between different views to see an overview of the containers and pods running on Kubernetes: -:::{image} ../../../images/observability-metrics-inventory.png +:::{image} /solutions/images/observability-metrics-inventory.png :alt: Inventory page that shows Kubernetes pods :screenshot: ::: @@ -509,7 +509,7 @@ For more on using the Inventory page, refer to [View infrastructure metrics by r On the **Metrics Explorer** page, you can group and analyze metrics for the resources that you are monitoring. -:::{image} ../../../images/observability-monitor-k8s-metrics-explorer.png +:::{image} /solutions/images/observability-monitor-k8s-metrics-explorer.png :alt: Metrics dashboard that shows CPU usage for Kubernetes pods :screenshot: ::: @@ -523,14 +523,14 @@ Find `Logs Explorer` in the [global search field](/explore-analyze/find-and-orga With **Logs Explorer**, you can quickly search and filter your log data, get information about the structure of log fields, and display your findings in a visualization. -:::{image} ../../../images/observability-log-explorer.png +:::{image} /solutions/images/observability-log-explorer.png :alt: screenshot of the logs explorer main page :screenshot: ::: From **Logs Explorer**, you can select the Kubernetes integration from the data selector to view your Kubernetes data. -![screenshot of the logs explorer main page](../../../images/observability-logs-explorer-applications.png "") +![screenshot of the logs explorer main page](/solutions/images/observability-logs-explorer-applications.png "") From here, you can filter your log data and dive deeper into individual logs to find and troubleshoot issues. For more information, refer to: @@ -1167,7 +1167,7 @@ Application trace data is available in the **Service Inventory**. To open **Serv The **Applications** app allows you to monitor your software services and applications in real-time: visualize detailed performance information on your services, identify and analyze errors, and monitor host-level and agent-specific metrics like JVM and Go runtime metrics. -:::{image} ../../../images/observability-apm-app-landing.png +:::{image} /solutions/images/observability-apm-app-landing.png :alt: Applications UI Kubernetes :screenshot: ::: @@ -1176,7 +1176,7 @@ Having access to application-level insights with just a few clicks can drastical Best of all, because Kubernetes environment variables have been mapped to APM metadata events, you can filter your trace data by Kubernetes `namespace`, `node.name`, `pod.name`, and `pod.uid`. -:::{image} ../../../images/observability-apm-app-kubernetes-filter.png +:::{image} /solutions/images/observability-apm-app-kubernetes-filter.png :alt: Applications UI Kubernetes :screenshot: ::: diff --git a/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md b/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md index 96797707b6..738b047c60 100644 --- a/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md +++ b/solutions/observability/infra-and-hosts/tutorial-observe-nginx-instances.md @@ -189,7 +189,7 @@ The nginx integration has a built-in dashboard that shows the full picture of yo The **Metrics Nginx overview** shows visual representations of total requests, processed requests, heartbeat/up, active connections, reading/writing/waiting rates, request rate, accepts and handled rates, and drops rate. -:::{image} ../../../images/observability-nginx-metrics-dashboard.png +:::{image} /solutions/images/observability-nginx-metrics-dashboard.png :alt: nginx metrics dashboard :screenshot: ::: @@ -210,7 +210,7 @@ Filter your results to see logs from the nginx integration from the data selecto 1. Under **Integrations**, select **Nginx**. - :::{image} ../../../images/observability-nginx-data-selector.png + :::{image} /solutions/images/observability-nginx-data-selector.png :alt: nginx integration in the data selector :screenshot: ::: @@ -219,7 +219,7 @@ Filter your results to see logs from the nginx integration from the data selecto The **Documents** table now shows your nginx logs: -:::{image} ../../../images/observability-nginx-logs-explorer.png +:::{image} /solutions/images/observability-nginx-logs-explorer.png :alt: Logs Explorer showing nginx error logs :screenshot: ::: @@ -236,14 +236,14 @@ The nginx integration has built-in dashboards that show the full picture of your The **Nginx logs overview** dashboard shows visual representations of geographical log details, response codes over time, errors over time, the top pages sending logs, data volume, a breakdown of which operating systems are sending logs, and a breakdown of which browsers are sending logs. -:::{image} ../../../images/observability-nginx-logs-overview-dashboard.png +:::{image} /solutions/images/observability-nginx-logs-overview-dashboard.png :alt: nginx logs overview dashboard :screenshot: ::: The **Nginx access and error logs** dashboard shows your access logs over time, and lists your access and error logs. -:::{image} ../../../images/observability-nginx-logs-access-error-dashboard.png +:::{image} /solutions/images/observability-nginx-logs-access-error-dashboard.png :alt: nginx access and error logs dashboard :screenshot: ::: diff --git a/solutions/observability/infra-and-hosts/understanding-no-results-found-message.md b/solutions/observability/infra-and-hosts/understanding-no-results-found-message.md index 6c1a82dfba..7af382750b 100644 --- a/solutions/observability/infra-and-hosts/understanding-no-results-found-message.md +++ b/solutions/observability/infra-and-hosts/understanding-no-results-found-message.md @@ -37,7 +37,7 @@ This could be for any of these reasons: * You have explicitly chosen not to send these metrics. You may choose to limit the metrics sent to Elastic to save on space and improve cluster performance. For example, the System integration has options to choose which metrics you want to send. You can [edit the integration policy](https://www.elastic.co/guide/en/fleet/current/edit-or-delete-integration-policy.html) to begin collecting the missing metrics. For example: - :::{image} ../../../images/serverless-turn-on-system-metrics.png + :::{image} /solutions/images/serverless-turn-on-system-metrics.png :alt: Screenshot showing system cpu and diskio metrics selected for collection :screenshot: ::: \ No newline at end of file diff --git a/solutions/observability/infra-and-hosts/universal-profiling-index-life-cycle-management.md b/solutions/observability/infra-and-hosts/universal-profiling-index-life-cycle-management.md index 36e75bc3d1..e6a72c8cc4 100644 --- a/solutions/observability/infra-and-hosts/universal-profiling-index-life-cycle-management.md +++ b/solutions/observability/infra-and-hosts/universal-profiling-index-life-cycle-management.md @@ -84,7 +84,7 @@ To apply a custom {{ilm-init}} policy, you must name the component template `pro If it does, click **Create component template**. - :::{image} ../../../images/observability-profiling-create-component-template.png + :::{image} /solutions/images/observability-profiling-create-component-template.png :alt: Create component template :screenshot: ::: diff --git a/solutions/observability/infra-and-hosts/universal-profiling.md b/solutions/observability/infra-and-hosts/universal-profiling.md index edf703d5a7..0337a8e98f 100644 --- a/solutions/observability/infra-and-hosts/universal-profiling.md +++ b/solutions/observability/infra-and-hosts/universal-profiling.md @@ -44,7 +44,7 @@ In the following screenshot, you can see that unsymbolized frames *do not* show Adding symbols for unsymbolized frames is currently a manual operation. See [Add symbols for native frames](add-symbols-for-native-frames.md). -:::{image} ../../../images/observability-profiling-stacktraces-unsymbolized.png +:::{image} /solutions/images/observability-profiling-stacktraces-unsymbolized.png :alt: profiling stacktraces unsymbolized :screenshot: ::: @@ -54,7 +54,7 @@ Adding symbols for unsymbolized frames is currently a manual operation. See [Add The stacktraces view shows graphs of stacktraces grouped by threads, traces, hosts, deployments, and containers: -:::{image} ../../../images/observability-profiling-stacktraces-default-view.png +:::{image} /solutions/images/observability-profiling-stacktraces-default-view.png :alt: profiling stacktraces default view :screenshot: ::: @@ -85,7 +85,7 @@ Hover and click each of the stacked bar chart sections to show details. You can Below the top graph, there are individual graphs that show the individual trend-line for each of the items: -:::{image} ../../../images/observability-profiling-stacktraces-smaller-graphs.png +:::{image} /solutions/images/observability-profiling-stacktraces-smaller-graphs.png :alt: profiling stacktraces smaller graphs :screenshot: ::: @@ -101,7 +101,7 @@ The individual graphs are ordered in decreasing order, from top to bottom, left In the **Traces** tab, clicking **Show more** at the bottom of one of the individual graphs shows the full stacktrace. -:::{image} ../../../images/observability-profiling-stacktraces-show-more.png +:::{image} /solutions/images/observability-profiling-stacktraces-show-more.png :alt: profiling stacktraces show more :screenshot: ::: @@ -111,7 +111,7 @@ In the **Traces** tab, clicking **Show more** at the bottom of one of the indivi The flamegraph view groups hierarchical data (stacktraces) into rectangles stacked onto or next to each other. The size of each rectangle represents the relative weight of a child compared to its parent. -:::{image} ../../../images/observability-profiling-flamegraph-view.png +:::{image} /solutions/images/observability-profiling-flamegraph-view.png :alt: profiling flamegraph view :screenshot: ::: @@ -143,7 +143,7 @@ The summary square in the bottom-left corner of the graph lets you shift the vis Hovering your mouse over a rectangle in the flamegraph displays the frame’s details in the window. To see more frame information, click on the **Show more information** icon after pinning the tooltip. -:::{image} ../../../images/observability-profiling-flamegraph-detailed-view.png +:::{image} /solutions/images/observability-profiling-flamegraph-detailed-view.png :alt: profiling flamegraph detailed view :screenshot: ::: @@ -155,7 +155,7 @@ Below the graph area, you can use the search bar to find specific text in the fl The functions view presents an ordered list of functions that Universal Profiling samples most often. From this view, you can spot the functions that are running the most across your entire infrastructure, applying filters to drill down into individual components. -:::{image} ../../../images/observability-profiling-functions-default-view.png +:::{image} /solutions/images/observability-profiling-functions-default-view.png :alt: profiling functions default view :screenshot: ::: @@ -184,14 +184,14 @@ Hitting refresh on each data filter triggers a frequency comparison that highlig In differential functions, the right-most column of functions has green or orange score calculator that represents the relative difference of position as the heaviest CPU hitting functions. -:::{image} ../../../images/observability-profiling-functions-differential-view.png +:::{image} /solutions/images/observability-profiling-functions-differential-view.png :alt: profiling functions differential view :screenshot: ::: In differential flamegraphs, the difference with the baseline is highlighted with color and hue. A vivid green colored rectangle indicates that a frame has been seen in *less* samples compared to the baseline, which means an improvement. A vivid red colored rectangle indicates a frame has been seen in more samples being recorded on CPU, indicating a potential performance regression. -:::{image} ../../../images/observability-profiling-flamegraph-differential-view.png +:::{image} /solutions/images/observability-profiling-flamegraph-differential-view.png :alt: profiling flamegraph differential view :screenshot: ::: diff --git a/solutions/observability/infra-and-hosts/view-infrastructure-metrics-by-resource-type.md b/solutions/observability/infra-and-hosts/view-infrastructure-metrics-by-resource-type.md index c2c15a42d0..d134ee1954 100644 --- a/solutions/observability/infra-and-hosts/view-infrastructure-metrics-by-resource-type.md +++ b/solutions/observability/infra-and-hosts/view-infrastructure-metrics-by-resource-type.md @@ -15,7 +15,7 @@ To open the **Infrastructure inventory** page in: - **Elastic Stack,** find **Infrastructure** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). - **Serverless,** go to **Infrastructure inventory** in your Observability Serverless project. -:::{image} ../../../images/observability-metrics-app.png +:::{image} /solutions/images/observability-metrics-app.png :alt: Infrastructure UI in {kib} :screenshot: ::: @@ -45,7 +45,7 @@ When you hover over each resource in the waffle map, the metrics specific to tha You can sort by resource, group the resource by specific fields related to it, and sort by either name or metric value. For example, you can filter the view to display the memory usage of your Kubernetes pods, grouped by namespace, and sorted by the memory usage value. -:::{image} ../../../images/observability-kubernetes-filter.png +:::{image} /solutions/images/observability-kubernetes-filter.png :alt: Kubernetes pod filtering :screenshot: ::: @@ -57,7 +57,7 @@ To examine the metrics for a specific time, use the time filter to select the da ## View host metrics [analyze-hosts-inventory] -By default the **Infrastructure Inventory** page displays a waffle map that shows the hosts you are monitoring and the current CPU usage for each host. Alternatively, you can click the **Table view** icon ![table view icon](../../../images/observability-table-view-icon.png "") to switch to a table view. +By default the **Infrastructure Inventory** page displays a waffle map that shows the hosts you are monitoring and the current CPU usage for each host. Alternatively, you can click the **Table view** icon ![table view icon](/solutions/images/observability-table-view-icon.png "") to switch to a table view. Without leaving the **Infrastructure Inventory** page, you can view enhanced metrics relating to each host running in your infrastructure. On the waffle map, select a host to display the host details overlay. @@ -80,7 +80,7 @@ Hover over a specific time period on a chart to compare the various metrics at t Click **Show all** to drill down into related data. -:::{image} ../../../images/observability-overview-overlay.png +:::{image} /solutions/images/observability-overview-overlay.png :alt: Host overview :screenshot: ::: @@ -93,7 +93,7 @@ The **Metadata** tab lists all the meta information relating to the host, includ This information can help when investigating events—for example, when filtering by operating system or architecture. -:::{image} ../../../images/observability-metadata-overlay.png +:::{image} /solutions/images/observability-metadata-overlay.png :alt: Host metadata :screenshot: ::: @@ -104,7 +104,7 @@ This information can help when investigating events—for example, when filterin :::::{dropdown} Metrics The **Metrics** tab shows host metrics organized by type and is more complete than the view available in the *Overview* tab. -:::{image} ../../../images/serverless-metrics-overlay.png +:::{image} /solutions/images/serverless-metrics-overlay.png :alt: Metrics :screenshot: ::: @@ -135,7 +135,7 @@ The processes listed in the **Top processes** table are based on an aggregation | **Memory** | The percentage of memory (`system.process.memory.rss.pct`) the process occupied in main memory (RAM). | | **State** | The current state of the process and the total number of processes (`system.process.state`). Expected values are: `running`, `sleeping`, `dead`, `stopped`, `idle`, `zombie`, and `unknown`. | -:::{image} ../../../images/serverless-processes-overlay.png +:::{image} /solutions/images/serverless-processes-overlay.png :alt: Host processes :screenshot: ::: @@ -154,7 +154,7 @@ The **Universal Profiling** tab shows CPU usage down to the application code lev For more on Universal Profiling, refer to the [Universal Profiling](../../../solutions/observability/infra-and-hosts/universal-profiling.md) docs. -:::{image} ../../../images/observability-universal-profiling-overlay.png +:::{image} /solutions/images/observability-universal-profiling-overlay.png :alt: Host Universal Profiling :screenshot: ::: @@ -172,7 +172,7 @@ The **Logs** tab displays logs relating to the host that you have selected. By d To view the logs in the {{logs-app}} for a detailed analysis, click **Open in Logs**. -:::{image} ../../../images/observability-logs-overlay.png +:::{image} /solutions/images/observability-logs-overlay.png :alt: Host logs :screenshot: ::: @@ -187,7 +187,7 @@ Along with the name of each anomaly job, detected anomalies with a severity scor To drill down and analyze the metric anomaly, select **Actions** → **Open in Anomaly Explorer**. You can also select **Actions** → **Show in Inventory** to view the host Inventory page, filtered by the specific metric. -:::{image} ../../../images/serverless-anomalies-overlay.png +:::{image} /solutions/images/serverless-anomalies-overlay.png :alt: Anomalies :screenshot: ::: @@ -228,7 +228,7 @@ Other options include: * Add, remove, reorder, and resize columns. * Sort field names in ascending or descending order. -:::{image} ../../../images/observability-osquery-overlay.png +:::{image} /solutions/images/observability-osquery-overlay.png :alt: Osquery :screenshot: ::: @@ -245,7 +245,7 @@ These metrics are also available when viewing hosts on the **Hosts** page. ## View container metrics [analyze-containers-inventory] -When you select **Docker containers**, the **Infrastructure inventory** page displays a waffle map that shows the containers you are monitoring and the current CPU usage for each container. Alternatively, you can click the **Table view** icon ![Table view icon](../../../images/serverless-table-view-icon.png "") to switch to a table view. +When you select **Docker containers**, the **Infrastructure inventory** page displays a waffle map that shows the containers you are monitoring and the current CPU usage for each container. Alternatively, you can click the **Table view** icon ![Table view icon](/solutions/images/serverless-table-view-icon.png "") to switch to a table view. Without leaving the **Infrastructure inventory** page, you can view enhanced metrics relating to each container running in your infrastructure. @@ -278,7 +278,7 @@ Hover over a specific time period on a chart to compare the various metrics at t Click **Show all** to drill down into related data. -:::{image} ../../../images/observability-overview-overlay-containers.png +:::{image} /solutions/images/observability-overview-overlay-containers.png :alt: Container overview :screenshot: ::: @@ -295,7 +295,7 @@ The **Metadata** tab lists all the meta information relating to the container: All of this information can help when investigating events—for example, filtering by operating system or architecture. -:::{image} ../../../images/observability-metadata-overlay-containers.png +:::{image} /solutions/images/observability-metadata-overlay-containers.png :alt: Container metadata :screenshot: ::: @@ -306,7 +306,7 @@ All of this information can help when investigating events—for example, filter :::::{dropdown} Metrics The **Metrics** tab shows container metrics organized by type. -:::{image} ../../../images/observability-metrics-overlay-containers.png +:::{image} /solutions/images/observability-metrics-overlay-containers.png :alt: Metrics :screenshot: ::: @@ -324,7 +324,7 @@ The **Logs** tab displays logs relating to the container that you have selected. To view the logs in the {{logs-app}} for a detailed analysis, click **Open in Logs**. -:::{image} ../../../images/observability-logs-overlay-containers.png +:::{image} /solutions/images/observability-logs-overlay-containers.png :alt: Container logs :screenshot: ::: @@ -337,7 +337,7 @@ To view the logs in the {{logs-app}} for a detailed analysis, click **Open in Lo When you have searched and filtered for a specific resource, you can drill down to analyze the metrics relating to it. For example, when viewing Kubernetes Pods in the high-level view, click the Pod you want to analyze and select **Kubernetes Pod metrics** to see detailed metrics: -:::{image} ../../../images/observability-pod-metrics.png +:::{image} /solutions/images/observability-pod-metrics.png :alt: Kubernetes pod metrics :screenshot: ::: @@ -349,7 +349,7 @@ If the predefined metrics displayed on the Inventory page for each resource are Select your resource, and from the **Metric** filter menu, click **Add metric**. -:::{image} ../../../images/serverless-add-custom-metric.png +:::{image} /solutions/images/serverless-add-custom-metric.png :alt: Add custom metrics :screenshot: ::: diff --git a/solutions/observability/logs/add-service-name-to-logs.md b/solutions/observability/logs/add-service-name-to-logs.md index de52885cbb..4511d37835 100644 --- a/solutions/observability/logs/add-service-name-to-logs.md +++ b/solutions/observability/logs/add-service-name-to-logs.md @@ -33,7 +33,7 @@ processors: Adding the `add_fields` processor to an integration’s settings would add `your_service_name` as the `service.name` field: -:::{image} ../../../images/serverless-add-field-processor.png +:::{image} /solutions/images/serverless-add-field-processor.png :alt: Add the add_fields processor to an integration :screenshot: ::: diff --git a/solutions/observability/logs/categorize-log-entries.md b/solutions/observability/logs/categorize-log-entries.md index cee84e433e..6d0a5593e5 100644 --- a/solutions/observability/logs/categorize-log-entries.md +++ b/solutions/observability/logs/categorize-log-entries.md @@ -31,7 +31,7 @@ Create a {{ml}} job to categorize log messages automatically. {{ml-cap}} observe The **Categories** page lists all the log categories from the selected indices. You can filter the categories by indices. The screenshot below shows the categories from the `elastic.agent` log. -:::{image} ../../../images/observability-log-categories.jpg +:::{image} /solutions/images/observability-log-categories.jpg :alt: Log categories :screenshot: ::: @@ -46,7 +46,7 @@ The category row contains the following information: To view a log message under a particular category, click the arrow at the end of the row. To further examine a message, it can be viewed in the corresponding log event on the **Stream** page or displayed in its context. -:::{image} ../../../images/observability-log-opened.png +:::{image} /solutions/images/observability-log-opened.png :alt: Opened log category :screenshot: ::: diff --git a/solutions/observability/logs/ecs-formatted-application-logs.md b/solutions/observability/logs/ecs-formatted-application-logs.md index 6e5da3722c..2d275e2f02 100644 --- a/solutions/observability/logs/ecs-formatted-application-logs.md +++ b/solutions/observability/logs/ecs-formatted-application-logs.md @@ -130,7 +130,7 @@ output.elasticsearch: api_key: "id:api_key" ``` -1. Set the `hosts` to your deployment’s {{es}} endpoint. Copy the {{es}} endpoint from **Help menu (![help icon](../../../images/observability-help-icon.png "")) → Connection details**. For example, `https://my-deployment.es.us-central1.gcp.cloud.es.io:443`. +1. Set the `hosts` to your deployment’s {{es}} endpoint. Copy the {{es}} endpoint from **Help menu (![help icon](/solutions/images/observability-help-icon.png "")) → Connection details**. For example, `https://my-deployment.es.us-central1.gcp.cloud.es.io:443`. 2. From **Developer tools**, run the following command to create an API key that grants `manage` permissions for the `cluster` and the `filebeat-*` indices using: ```console diff --git a/solutions/observability/logs/filter-aggregate-logs.md b/solutions/observability/logs/filter-aggregate-logs.md index 0536403c34..6f98b6cb6c 100644 --- a/solutions/observability/logs/filter-aggregate-logs.md +++ b/solutions/observability/logs/filter-aggregate-logs.md @@ -110,16 +110,16 @@ For this example, let’s look for logs with a `WARN` or `ERROR` log level that 2. Click the current time range, select **Absolute**, and set the **Start date** to `Sep 14, 2023 @ 00:00:00.000`. - ![Set the time range start date](../../../images/serverless-logs-start-date.png "") + ![Set the time range start date](/solutions/images/serverless-logs-start-date.png "") 3. Click the end of the current time range, select **Absolute**, and set the **End date** to `Sep 15, 2023 @ 23:59:59.999`. - ![Set the time range end date](../../../images/serverless-logs-end-date.png "") + ![Set the time range end date](/solutions/images/serverless-logs-end-date.png "") Under the **Documents** tab, you’ll see the filtered log data matching your query. -:::{image} ../../../images/serverless-logs-kql-filter.png +:::{image} /solutions/images/serverless-logs-kql-filter.png :alt: logs kql filter :screenshot: ::: diff --git a/solutions/observability/logs/get-started-with-system-logs.md b/solutions/observability/logs/get-started-with-system-logs.md index 6db4de22c3..6d10d29211 100644 --- a/solutions/observability/logs/get-started-with-system-logs.md +++ b/solutions/observability/logs/get-started-with-system-logs.md @@ -29,7 +29,7 @@ After the agent is installed and successfully streaming log data, you can view t 1. From the navigation menu, go to **Discover** and select the **Logs Explorer** tab. The view shows all log datasets. Notice you can add fields, change the view, expand a document to see details, and perform other actions to explore your data. 2. Click **All log datasets** and select **System** → **syslog** to show syslog logs. -:::{image} ../../../images/serverless-log-explorer-select-syslogs.png +:::{image} /solutions/images/serverless-log-explorer-select-syslogs.png :alt: Screen capture of the Logs Explorer showing syslog dataset selected :screenshot: ::: diff --git a/solutions/observability/logs/inspect-log-anomalies.md b/solutions/observability/logs/inspect-log-anomalies.md index ebb94d02ce..db2a031612 100644 --- a/solutions/observability/logs/inspect-log-anomalies.md +++ b/solutions/observability/logs/inspect-log-anomalies.md @@ -42,7 +42,7 @@ If you have a lot of log partitions, use the following to filter your data: * Hover over a time range to see the log rate for each partition. * Click or hover on a partition name to show, hide, or highlight the partition values. -:::{image} ../../../images/observability-anomalies-chart.png +:::{image} /solutions/images/observability-anomalies-chart.png :alt: Anomalies chart :screenshot: ::: diff --git a/solutions/observability/logs/logs-explorer.md b/solutions/observability/logs/logs-explorer.md index 5e89688916..42116a844c 100644 --- a/solutions/observability/logs/logs-explorer.md +++ b/solutions/observability/logs/logs-explorer.md @@ -18,7 +18,7 @@ With **Logs Explorer**, you can quickly search and filter your log data, get inf To open **Logs Explorer**, find `Logs Explorer` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). -:::{image} ../../../images/observability-log-explorer.png +:::{image} /solutions/images/observability-log-explorer.png :alt: Screen capture of the Logs Explorer :screenshot: ::: @@ -35,7 +35,7 @@ By default, Logs Explorer shows all of your logs, according to the index pattern If you need to focus on logs from a specific integration, select the integration from the logs menu: -:::{image} ../../../images/observability-log-menu.png +:::{image} /solutions/images/observability-log-menu.png :alt: Screen capture of log menu :screenshot: ::: @@ -54,25 +54,25 @@ Refer to the [Discover](../../../explore-analyze/discover.md) documentation for The actions column provides access to additional information about your logs. -**Expand:** ![The icon to expand log details](../../../images/observability-expand-icon.png "") Open the log details to get an in-depth look at an individual log file. +**Expand:** ![The icon to expand log details](/solutions/images/observability-expand-icon.png "") Open the log details to get an in-depth look at an individual log file. -**Degraded document indicator:** ![The icon that shows ignored fields](../../../images/observability-pagesSelect-icon.png "") Shows if any of the document’s fields were ignored when it was indexed. Ignored fields could indicate malformed fields or other issues with your document. Use this information to investigate and determine why fields are being ignored. +**Degraded document indicator:** ![The icon that shows ignored fields](/solutions/images/observability-pagesSelect-icon.png "") Shows if any of the document’s fields were ignored when it was indexed. Ignored fields could indicate malformed fields or other issues with your document. Use this information to investigate and determine why fields are being ignored. -**Stacktrace indicator:** ![The icon that shows if a document contains stack traces](../../../images/observability-apmTrace-icon.png "") Shows if the document contains stack traces. This indicator makes it easier to navigate through your documents and know if they contain additional information in the form of stack traces. +**Stacktrace indicator:** ![The icon that shows if a document contains stack traces](/solutions/images/observability-apmTrace-icon.png "") Shows if the document contains stack traces. This indicator makes it easier to navigate through your documents and know if they contain additional information in the form of stack traces. ## View log details [view-log-details] -Click the expand icon ![icon to open log details](../../../images/observability-expand-icon.png "") to get an in-depth look at an individual log file. +Click the expand icon ![icon to open log details](/solutions/images/observability-expand-icon.png "") to get an in-depth look at an individual log file. These details provide immediate feedback and context for what’s happening and where it’s happening for each log. From here, you can quickly debug errors and investigate the services where errors have occurred. The following actions help you filter and focus on specific fields in the log details: -* **Filter for value (![filter for value icon](../../../images/observability-plusInCircle.png "")):** Show logs that contain the specific field value. -* **Filter out value (![filter out value icon](../../../images/observability-minusInCircle.png "")):** Show logs that do **not** contain the specific field value. -* **Filter for field present (![filter for present icon](../../../images/observability-filter.png "")):** Show logs that contain the specific field. -* **Toggle column in table (![toggle column in table icon](../../../images/observability-listAdd.png "")):** Add or remove a column for the field to the main Logs Explorer table. +* **Filter for value (![filter for value icon](/solutions/images/observability-plusInCircle.png "")):** Show logs that contain the specific field value. +* **Filter out value (![filter out value icon](/solutions/images/observability-minusInCircle.png "")):** Show logs that do **not** contain the specific field value. +* **Filter for field present (![filter for present icon](/solutions/images/observability-filter.png "")):** Show logs that contain the specific field. +* **Toggle column in table (![toggle column in table icon](/solutions/images/observability-listAdd.png "")):** Add or remove a column for the field to the main Logs Explorer table. ## View log data set details [view-log-data-set-details] diff --git a/solutions/observability/logs/logs-stream.md b/solutions/observability/logs/logs-stream.md index 5082c4ff14..cef060272d 100644 --- a/solutions/observability/logs/logs-stream.md +++ b/solutions/observability/logs/logs-stream.md @@ -42,7 +42,7 @@ Additionally, click **Highlights** and enter a term you would like to locate wit When you have searched and filtered your logs for a specific log event, you may want to examine the metadata and the structured fields associated with that event. To view the **Log event document details** fly-out, hover over the log event, click **View actions for line**, and then select **View details**. To further enhance the workflow of monitoring logs, the icons next to each field value enable you to filter the logs per that value. -:::{image} ../../../images/observability-log-event-details.png +:::{image} /solutions/images/observability-log-event-details.png :alt: Log event details :screenshot: ::: @@ -54,7 +54,7 @@ Once your logs are filtered, and you find an interesting log line, the real cont Hover over the log event, click **View actions for line**, and then select **View in context**. The context is preserved and helps you find the root cause as soon as possible. -:::{image} ../../../images/observability-contextual-logs.png +:::{image} /solutions/images/observability-contextual-logs.png :alt: Contextual log event :screenshot: ::: diff --git a/solutions/observability/logs/plaintext-application-logs.md b/solutions/observability/logs/plaintext-application-logs.md index defa4c05ca..6705742b73 100644 --- a/solutions/observability/logs/plaintext-application-logs.md +++ b/solutions/observability/logs/plaintext-application-logs.md @@ -98,7 +98,7 @@ output.elasticsearch: api_key: "id:api_key" ``` -1. Set the `hosts` to your deployment’s {{es}} endpoint. Copy the {{es}} endpoint from **Help menu (![help icon](../../../images/observability-help-icon.png "")) → Connection details**. For example, `https://my-deployment.es.us-central1.gcp.cloud.es.io:443`. +1. Set the `hosts` to your deployment’s {{es}} endpoint. Copy the {{es}} endpoint from **Help menu (![help icon](/solutions/images/observability-help-icon.png "")) → Connection details**. For example, `https://my-deployment.es.us-central1.gcp.cloud.es.io:443`. 2. From **Developer tools**, run the following command to create an API key that grants `manage` permissions for the `cluster` and the `filebeat-*` indices using: ```console diff --git a/solutions/observability/logs/run-pattern-analysis-on-log-data.md b/solutions/observability/logs/run-pattern-analysis-on-log-data.md index 2b36fca5c3..87f9eaca2a 100644 --- a/solutions/observability/logs/run-pattern-analysis-on-log-data.md +++ b/solutions/observability/logs/run-pattern-analysis-on-log-data.md @@ -23,11 +23,11 @@ To run a log pattern analysis: 3. If you don’t see any results, expand the time range, for example, to **Last 15 days**. 4. In the **Available fields** list, select the text field you want to analyze, then click **Run pattern analysis**. - ![Run log pattern analysis](../../../images/serverless-run-log-pattern-analysis.png "") + ![Run log pattern analysis](/solutions/images/serverless-run-log-pattern-analysis.png "") The results of the analysis are shown in a table: - :::{image} ../../../images/serverless-log-pattern-analysis.png + :::{image} /solutions/images/serverless-log-pattern-analysis.png :alt: Log pattern analysis of the message field :screenshot: ::: diff --git a/solutions/observability/logs/stream-any-log-file.md b/solutions/observability/logs/stream-any-log-file.md index 593dac06fc..316a6f347b 100644 --- a/solutions/observability/logs/stream-any-log-file.md +++ b/solutions/observability/logs/stream-any-log-file.md @@ -272,7 +272,7 @@ inputs: Next, set the values for these fields: -* `hosts` – Copy the {{es}} endpoint from **Help menu (![help icon](../../../images/observability-help-icon.png "")) → Connection details**. For example, `https://my-deployment.es.us-central1.gcp.cloud.es.io:443`. +* `hosts` – Copy the {{es}} endpoint from **Help menu (![help icon](/solutions/images/observability-help-icon.png "")) → Connection details**. For example, `https://my-deployment.es.us-central1.gcp.cloud.es.io:443`. * `api-key` – Use an API key to grant the agent access to {{es}}. To create an API key for your agent, refer to the [Create API keys for standalone agents](/reference/ingestion-tools/fleet/grant-access-to-elasticsearch.md#create-api-key-standalone-agent) documentation. ::::{note} diff --git a/solutions/observability/logs/stream-application-logs.md b/solutions/observability/logs/stream-application-logs.md index ee89c477a7..f9a15a31c8 100644 --- a/solutions/observability/logs/stream-application-logs.md +++ b/solutions/observability/logs/stream-application-logs.md @@ -46,7 +46,7 @@ With {{filebeat}} or {{agent}}, you can ingest plaintext logs, including existin For plaintext logs to be useful, you need to use {{filebeat}} or {{agent}} to parse the log data. -**![documentation icon](../../../images/serverless-documentation.svg "") Learn more in [Plaintext logs](../../../solutions/observability/logs/plaintext-application-logs.md)** +**![documentation icon](/solutions/images/serverless-documentation.svg "") Learn more in [Plaintext logs](../../../solutions/observability/logs/plaintext-application-logs.md)** ### ECS formatted logs [observability-correlate-application-logs-ecs-formatted-logs] @@ -60,7 +60,7 @@ Add ECS logging plugins to your logging libraries to format your logs into ECS-c To use ECS logging, you need to modify your application and its log configuration. -**![documentation icon](../../../images/serverless-documentation.svg "") Learn more in [ECS formatted logs](../../../solutions/observability/logs/ecs-formatted-application-logs.md)** +**![documentation icon](/solutions/images/serverless-documentation.svg "") Learn more in [ECS formatted logs](../../../solutions/observability/logs/ecs-formatted-application-logs.md)** #### {{apm-agent}} log reformatting [observability-correlate-application-logs-apm-agent-log-reformatting] @@ -73,7 +73,7 @@ This feature is supported for the following {{apm-agent}}s: * [Python](apm-agent-python://reference/logs.md#log-reformatting) * [Java](apm-agent-java://reference/logs.md#log-reformatting) -**![documentation icon](../../../images/serverless-documentation.svg "") Learn more in [ECS formatted logs](../../../solutions/observability/logs/ecs-formatted-application-logs.md)** +**![documentation icon](/solutions/images/serverless-documentation.svg "") Learn more in [ECS formatted logs](../../../solutions/observability/logs/ecs-formatted-application-logs.md)** ### {{apm-agent}} log sending [observability-correlate-application-logs-apm-agent-log-sending] @@ -82,7 +82,7 @@ Automatically capture and send logs directly to the managed intake service using Log sending is supported in the Java {{apm-agent}}. -**![documentation icon](../../../images/serverless-documentation.svg "") Learn more in [{{apm-agent}} log sending](../../../solutions/observability/logs/apm-agent-log-sending.md)** +**![documentation icon](/solutions/images/serverless-documentation.svg "") Learn more in [{{apm-agent}} log sending](../../../solutions/observability/logs/apm-agent-log-sending.md)** ## Log correlation [observability-correlate-application-logs-log-correlation] diff --git a/solutions/observability/observability-ai-assistant.md b/solutions/observability/observability-ai-assistant.md index dfce8061d5..dbcbe0cf4b 100644 --- a/solutions/observability/observability-ai-assistant.md +++ b/solutions/observability/observability-ai-assistant.md @@ -15,7 +15,7 @@ The AI Assistant uses generative AI to provide: * **Contextual insights** — open prompts throughout {{observability}} that explain errors and messages and suggest remediation. * **Chat** — have conversations with the AI Assistant. Chat uses function calling to request, analyze, and visualize your data. -:::{image} ../../images/observability-obs-assistant2.gif +:::{image} /solutions/images/observability-obs-assistant2.gif :alt: Observability AI assistant preview :screenshot: ::: @@ -235,11 +235,11 @@ After every answer the LLM provides, let us know if the answer was helpful. Your ### Chat with the assistant [obs-ai-chat] -Select the **AI Assistant** icon (![AI Assistant icon](../../images/observability-ai-assistant-icon.png "")) at the upper-right corner of any {{observability}} application to start the chat. +Select the **AI Assistant** icon (![AI Assistant icon](/solutions/images/observability-ai-assistant-icon.png "")) at the upper-right corner of any {{observability}} application to start the chat. This opens the AI Assistant flyout, where you can ask the assistant questions about your instance: -:::{image} ../../images/observability-obs-ai-chat.png +:::{image} /solutions/images/observability-obs-ai-chat.png :alt: Observability AI assistant chat :screenshot: ::: @@ -312,14 +312,14 @@ AI Assistant contextual prompts throughout {{observability}} provide the followi For example, in the log details, you’ll see prompts for **What’s this message?** and **How do I find similar log messages?**: -:::{image} ../../images/observability-obs-ai-logs-prompts.png +:::{image} /solutions/images/observability-obs-ai-logs-prompts.png :alt: Observability AI assistant logs prompts :screenshot: ::: Clicking a prompt generates a message specific to that log entry: -:::{image} ../../images/observability-obs-ai-logs.gif +:::{image} /solutions/images/observability-obs-ai-logs.gif :alt: Observability AI assistant example :screenshot: ::: @@ -336,7 +336,7 @@ Use the [Observability AI Assistant connector](kibana://reference/connectors-kib 3. In the **Connector** list, select the AI connector you created when you set up the assistant. 4. In the **Message** field, specify the message to send to the assistant: - :::{image} ../../images/observability-obs-ai-assistant-action-high-cpu.png + :::{image} /solutions/images/observability-obs-ai-assistant-action-high-cpu.png :alt: Add an Observability AI assistant action while creating a rule in the Observability UI :screenshot: ::: @@ -351,7 +351,7 @@ Currently only Slack, email, Jira, PagerDuty, or webhook actions are supported. When the alert fires, contextual details about the event—such as when the alert fired, the service or host impacted, and the threshold breached—are sent to the AI Assistant, along with the message provided during configuration. The AI Assistant runs the tasks requested in the message and creates a conversation you can use to chat with the assistant: -:::{image} ../../images/observability-obs-ai-assistant-output.png +:::{image} /solutions/images/observability-obs-ai-assistant-output.png :alt: AI Assistant conversation created in response to an alert :screenshot: ::: @@ -372,7 +372,7 @@ The `server.publicBaseUrl` setting must be correctly specified under {{kib}} set :::: -:::{image} ../../images/observability-obs-ai-assistant-slack-message.png +:::{image} /solutions/images/observability-obs-ai-assistant-slack-message.png :alt: Message sent by Slack by the AI Assistant includes a link to the conversation :screenshot: ::: diff --git a/solutions/search/cross-cluster-search.md b/solutions/search/cross-cluster-search.md index db4a49a1b9..c041cfc648 100644 --- a/solutions/search/cross-cluster-search.md +++ b/solutions/search/cross-cluster-search.md @@ -1047,19 +1047,19 @@ Here’s how {{ccs}} works when you minimize network roundtrips. 1. You send a {{ccs}} request to your local cluster. A coordinating node in that cluster receives and parses the request. - ![ccs min roundtrip client request](../../images/elasticsearch-reference-ccs-min-roundtrip-client-request.svg "") + ![ccs min roundtrip client request](/solutions/images/elasticsearch-reference-ccs-min-roundtrip-client-request.svg "") 2. The coordinating node sends a single search request to each cluster, including the local cluster. Each cluster performs the search request independently, applying its own cluster-level settings to the request. - ![ccs min roundtrip cluster search](../../images/elasticsearch-reference-ccs-min-roundtrip-cluster-search.svg "") + ![ccs min roundtrip cluster search](/solutions/images/elasticsearch-reference-ccs-min-roundtrip-cluster-search.svg "") 3. Each remote cluster sends its search results back to the coordinating node. - ![ccs min roundtrip cluster results](../../images/elasticsearch-reference-ccs-min-roundtrip-cluster-results.svg "") + ![ccs min roundtrip cluster results](/solutions/images/elasticsearch-reference-ccs-min-roundtrip-cluster-results.svg "") 4. After collecting results from each cluster, the coordinating node returns the final results in the {{ccs}} response. - ![ccs min roundtrip client response](../../images/elasticsearch-reference-ccs-min-roundtrip-client-response.svg "") + ![ccs min roundtrip client response](/solutions/images/elasticsearch-reference-ccs-min-roundtrip-client-response.svg "") @@ -1069,15 +1069,15 @@ Here’s how {{ccs}} works when you don’t minimize network roundtrips. 1. You send a {{ccs}} request to your local cluster. A coordinating node in that cluster receives and parses the request. - ![ccs min roundtrip client request](../../images/elasticsearch-reference-ccs-min-roundtrip-client-request.svg "") + ![ccs min roundtrip client request](/solutions/images/elasticsearch-reference-ccs-min-roundtrip-client-request.svg "") 2. The coordinating node sends a "search shards" transport layer request to each remote cluster to have them to perform a "can match" search to determine which shards on each cluster should be searched. - ![ccs min roundtrip cluster search](../../images/elasticsearch-reference-ccs-min-roundtrip-cluster-search.svg "") + ![ccs min roundtrip cluster search](/solutions/images/elasticsearch-reference-ccs-min-roundtrip-cluster-search.svg "") 3. Each remote cluster sends its response back to the coordinating node. This response contains information about the indices and shards the {{ccs}} request will be executed on. - ![ccs min roundtrip cluster results](../../images/elasticsearch-reference-ccs-min-roundtrip-cluster-results.svg "") + ![ccs min roundtrip cluster results](/solutions/images/elasticsearch-reference-ccs-min-roundtrip-cluster-results.svg "") 4. The coordinating node sends a search request to each shard, including those in its own cluster. Each shard performs the search request independently. @@ -1087,15 +1087,15 @@ Here’s how {{ccs}} works when you don’t minimize network roundtrips. :::: - ![ccs dont min roundtrip shard search](../../images/elasticsearch-reference-ccs-dont-min-roundtrip-shard-search.svg "") + ![ccs dont min roundtrip shard search](/solutions/images/elasticsearch-reference-ccs-dont-min-roundtrip-shard-search.svg "") 5. Each shard sends its search results back to the coordinating node. - ![ccs dont min roundtrip shard results](../../images/elasticsearch-reference-ccs-dont-min-roundtrip-shard-results.svg "") + ![ccs dont min roundtrip shard results](/solutions/images/elasticsearch-reference-ccs-dont-min-roundtrip-shard-results.svg "") 6. After collecting results from each cluster, the coordinating node returns the final results in the {{ccs}} response. - ![ccs min roundtrip client response](../../images/elasticsearch-reference-ccs-min-roundtrip-client-response.svg "") + ![ccs min roundtrip client response](/solutions/images/elasticsearch-reference-ccs-min-roundtrip-client-response.svg "") diff --git a/solutions/search/full-text/how-full-text-works.md b/solutions/search/full-text/how-full-text-works.md index dc7b721bf1..8b424e12b9 100644 --- a/solutions/search/full-text/how-full-text-works.md +++ b/solutions/search/full-text/how-full-text-works.md @@ -7,7 +7,7 @@ applies_to: The following diagram illustrates the components of full-text search. -:::{image} ../../../images/elasticsearch-reference-full-text-search-overview.svg +:::{image} /solutions/images/elasticsearch-reference-full-text-search-overview.svg :alt: Components of full-text search from analysis to relevance scoring :width: 550px ::: diff --git a/solutions/search/rag.md b/solutions/search/rag.md index 47412f4003..82aa98fd96 100644 --- a/solutions/search/rag.md +++ b/solutions/search/rag.md @@ -18,7 +18,7 @@ Retrieval Augmented Generation (RAG) is a technique for improving language model RAG is a form of [in-context learning](https://arxiv.org/abs/2301.00234), where the model learns from information provided at inference time. Compared to fine-tuning or continuous pre-training, RAG can be implemented more quickly and cheaply, and offers several advantages. -:::{image} ../../images/elasticsearch-reference-rag-venn-diagram.svg +:::{image} /solutions/images/elasticsearch-reference-rag-venn-diagram.svg :alt: RAG sits at the intersection of information retrieval and generative AI :width: 600px ::: @@ -42,7 +42,7 @@ Implementing RAG with {{es}} has several advantages: The following diagram illustrates a simple RAG system using {{es}}. -:::{image} ../../images/elasticsearch-reference-rag-schema.svg +:::{image} /solutions/images/elasticsearch-reference-rag-schema.svg :alt: Components of a simple RAG system using Elasticsearch ::: diff --git a/solutions/search/rag/playground-query.md b/solutions/search/rag/playground-query.md index fadd5fc313..86218235d8 100644 --- a/solutions/search/rag/playground-query.md +++ b/solutions/search/rag/playground-query.md @@ -26,7 +26,7 @@ The `{{query}}` variable represents the user’s question, rewritten as an {{es} The following screenshot shows the query editor in the Playground UI. In this simple example, the `books` index has two fields: `author` and `name`. Selecting a field adds it to the `fields` array in the query. -:::{image} ../../../images/kibana-query-interface.png +:::{image} /solutions/images/kibana-query-interface.png :alt: View and modify queries :screenshot: ::: diff --git a/solutions/search/rag/playground.md b/solutions/search/rag/playground.md index 3bb26eb88f..e180ee2de7 100644 --- a/solutions/search/rag/playground.md +++ b/solutions/search/rag/playground.md @@ -114,7 +114,7 @@ You can also use locally hosted LLMs that are compatible with the OpenAI SDK. On ## Getting started [playground-getting-started] -:::{image} ../../../images/kibana-get-started.png +:::{image} /solutions/images/kibana-get-started.png :alt: get started :screenshot: ::: @@ -185,7 +185,7 @@ Once you’ve connected to your LLM provider, it’s time to choose the data you :::::{tip} You can always add or remove indices later by selecting the **Data** button from the main Playground UI. -:::{image} ../../../images/kibana-data-button.png +:::{image} /solutions/images/kibana-data-button.png :alt: data button :screenshot: :width: 150px @@ -204,14 +204,14 @@ Since 8.15.0 (and earlier for {{es}} Serverless), the main Playground UI has two The **chat mode** is selected when you first set up your Playground instance. -:::{image} ../../../images/kibana-chat-interface.png +:::{image} /solutions/images/kibana-chat-interface.png :alt: chat interface :screenshot: ::: To switch to **query mode**, select **Query** from the main UI. -:::{image} ../../../images/kibana-query-interface.png +:::{image} /solutions/images/kibana-query-interface.png :alt: query interface :screenshot: ::: @@ -253,7 +253,7 @@ Use the **View code** button to see the Python code that powers the chat interfa * {{es}} Python Client + LLM provider * LangChain + LLM provider -:::{image} ../../../images/kibana-view-code-button.png +:::{image} /solutions/images/kibana-view-code-button.png :alt: view code button :screenshot: :width: 150px diff --git a/solutions/search/ranking/learning-to-rank-ltr.md b/solutions/search/ranking/learning-to-rank-ltr.md index b3845dea47..211b8bedee 100644 --- a/solutions/search/ranking/learning-to-rank-ltr.md +++ b/solutions/search/ranking/learning-to-rank-ltr.md @@ -15,7 +15,7 @@ This feature was introduced in version 8.12.0 and is only available to certain s Learning To Rank (LTR) uses a trained machine learning (ML) model to build a ranking function for your search engine. Typically, the model is used as a second stage re-ranker, to improve the relevance of search results returned by a simpler, first stage retrieval algorithm. The LTR function takes a list of documents and a search context and outputs ranked documents: -:::{image} ../../../images/elasticsearch-reference-learning-to-rank-overview.png +:::{image} /solutions/images/elasticsearch-reference-learning-to-rank-overview.png :alt: Learning To Rank overview :title: Learning To Rank overview :name: learning-to-rank-overview-diagram @@ -33,7 +33,7 @@ The LTR model is usually trained on a judgment list, which is a set of queries a The judgment list is the main input used to train the model. It consists of a dataset that contains pairs of queries and documents, along with their corresponding relevance labels. The relevance judgment is typically either a binary (relevant/irrelevant) or a more granular label, such as a grade between 0 (completely irrelevant) to 4 (highly relevant). The example below uses a graded relevance judgment. -:::{image} ../../../images/elasticsearch-reference-learning-to-rank-judgment-list.png +:::{image} /solutions/images/elasticsearch-reference-learning-to-rank-judgment-list.png :alt: Judgment list example :title: Judgment list example :name: learning-to-rank-judgment-list-example @@ -62,7 +62,7 @@ These features fall into one of three main categories: To prepare the dataset for training, the features are added to the judgment list: -:::{image} ../../../images/elasticsearch-reference-learning-to-rank-feature-extraction.png +:::{image} /solutions/images/elasticsearch-reference-learning-to-rank-feature-extraction.png :alt: Judgment list with features :title: Judgment list with features :name: learning-to-rank-judgement-feature-extraction diff --git a/solutions/search/search-connection-details.md b/solutions/search/search-connection-details.md index 850417690b..177850fab7 100644 --- a/solutions/search/search-connection-details.md +++ b/solutions/search/search-connection-details.md @@ -26,14 +26,14 @@ To connect to your {{es}} deployment, you need either a Cloud ID or an {{es}} en 1. Navigate to the Elastic Cloud home page. 2. In the main menu, click **Manage this deployment**. - :::{image} ../../images/kibana-manage-deployment.png + :::{image} /solutions/images/kibana-manage-deployment.png :alt: manage deployment :screenshot: ::: 3. The Cloud ID is displayed on the right side of the page. - :::{image} ../../images/kibana-cloud-id.png + :::{image} /solutions/images/kibana-cloud-id.png :alt: cloud id :screenshot: ::: @@ -44,14 +44,14 @@ To connect to your {{es}} deployment, you need either a Cloud ID or an {{es}} en 1. To navigate to **API keys**, use the [**global search bar**](../../explore-analyze/find-and-organize/find-apps-and-objects.md). - :::{image} ../../images/kibana-api-keys-search-bar.png + :::{image} /solutions/images/kibana-api-keys-search-bar.png :alt: api keys search bar :screenshot: ::: 2. Click **Create API key**. - :::{image} ../../images/kibana-click-create-api-key.png + :::{image} /solutions/images/kibana-click-create-api-key.png :alt: click create api key :screenshot: ::: @@ -67,7 +67,7 @@ To connect to your {{es}} deployment, you need either a Cloud ID or an {{es}} en 1. Navigate to the serverless project’s home page. 2. Scroll down to the **Copy your connection details** section, and copy the **Elasticsearch endpoint**. - :::{image} ../../images/kibana-serverless-connection-details.png + :::{image} /solutions/images/kibana-serverless-connection-details.png :alt: serverless connection details :screenshot: ::: @@ -84,7 +84,7 @@ The **Cloud ID** is also displayed in the Copy your connection details section, 1. Navigate to the serverless project’s home page. 2. Scroll down to the **Add an API Key** section, and click **New**. - :::{image} ../../images/kibana-serverless-create-an-api-key.png + :::{image} /solutions/images/kibana-serverless-create-an-api-key.png :alt: serverless create an api key :screenshot: ::: diff --git a/solutions/search/search-pipelines.md b/solutions/search/search-pipelines.md index f597d41db5..6582c2519b 100644 --- a/solutions/search/search-pipelines.md +++ b/solutions/search/search-pipelines.md @@ -22,7 +22,7 @@ To find this tab in the Kibana UI: The tab is highlighted in this screenshot: -:::{image} /images/elasticsearch-reference-ingest-pipeline-ent-search-ui.png +:::{image} /solutions/images/elasticsearch-reference-ingest-pipeline-ent-search-ui.png :alt: ingest pipeline ent search ui :screenshot: ::: diff --git a/solutions/search/semantic-search.md b/solutions/search/semantic-search.md index 21de2db2c8..9075bd3689 100644 --- a/solutions/search/semantic-search.md +++ b/solutions/search/semantic-search.md @@ -27,7 +27,7 @@ You have several options for using NLP models for semantic search in the {{stack This diagram summarizes the relative complexity of each workflow: -:::{image} ../../images/elasticsearch-reference-semantic-options.svg +:::{image} /solutions/images/elasticsearch-reference-semantic-options.svg :alt: Overview of semantic search workflows in {{es}} ::: diff --git a/solutions/search/serverless-elasticsearch-get-started.md b/solutions/search/serverless-elasticsearch-get-started.md index d6f912f228..67d593a38e 100644 --- a/solutions/search/serverless-elasticsearch-get-started.md +++ b/solutions/search/serverless-elasticsearch-get-started.md @@ -68,7 +68,7 @@ Once your project is set up, you’ll be directed to a page where you can create 1. Enter a name for your index. 2. Click **Create my index**. You can also create the index by clicking on **Code** to view and run code through the command line. - :::{image} ../../images/serverless-get-started-create-an-index.png + :::{image} /solutions/images/serverless-get-started-create-an-index.png :alt: Create an index. ::: @@ -95,7 +95,7 @@ The UI provides ready-to-use code examples for ingesting data via the REST API. To get started using the in-product tutorial, navigate to the **Getting Started** page and follow the on-screen steps. -:::{image} ../../images/serverless-getting-started-page.png +:::{image} /solutions/images/serverless-getting-started-page.png :alt: Getting Started page. ::: diff --git a/solutions/security/advanced-entity-analytics/anomaly-detection.md b/solutions/security/advanced-entity-analytics/anomaly-detection.md index af00bc3404..08bdcfdaf4 100644 --- a/solutions/security/advanced-entity-analytics/anomaly-detection.md +++ b/solutions/security/advanced-entity-analytics/anomaly-detection.md @@ -20,7 +20,7 @@ You can view the details of detected anomalies within the `Anomalies` table widg If you have the appropriate role, you can use the **ML job settings** interface on the **Alerts**, **Rules**, and **Rule Exceptions** pages to view, start, and stop {{elastic-sec}} {{ml}} jobs. -:::{image} ../../../images/security-ml-ui.png +:::{image} /solutions/images/security-ml-ui.png :alt: ML job settings UI on the Alerts page :screenshot: ::: @@ -30,16 +30,16 @@ If you have the appropriate role, you can use the **ML job settings** interface You can also check the status of {{ml}} detection rules, and start or stop their associated {{ml}} jobs: -* On the **Rules** page, the **Last response** column displays the rule’s current [status](/solutions/security/detect-and-alert/manage-detection-rules.md#rule-status). An indicator icon (![Error icon from rules table](../../../images/security-rules-table-error-icon.png "title =20x20")) also appears if a required {{ml}} job isn’t running. Click the icon to list the affected jobs, then click **Visit rule details page to investigate** to open the rule’s details page. +* On the **Rules** page, the **Last response** column displays the rule’s current [status](/solutions/security/detect-and-alert/manage-detection-rules.md#rule-status). An indicator icon (![Error icon from rules table](/solutions/images/security-rules-table-error-icon.png "title =20x20")) also appears if a required {{ml}} job isn’t running. Click the icon to list the affected jobs, then click **Visit rule details page to investigate** to open the rule’s details page. - :::{image} ../../../images/security-rules-table-ml-job-error.png + :::{image} /solutions/images/security-rules-table-ml-job-error.png :alt: Rules table {{ml}} job error :screenshot: ::: * On a rule’s details page, check the **Definition** section to confirm whether the required {{ml}} jobs are running. Switch the toggles on or off to run or stop each job. - :::{image} ../../../images/security-rules-ts-ml-job-stopped.png + :::{image} /solutions/images/security-rules-ts-ml-job-stopped.png :alt: Rule details page with ML job stopped :screenshot: ::: diff --git a/solutions/security/advanced-entity-analytics/asset-criticality.md b/solutions/security/advanced-entity-analytics/asset-criticality.md index ef7851d1f0..6177d5b85f 100644 --- a/solutions/security/advanced-entity-analytics/asset-criticality.md +++ b/solutions/security/advanced-entity-analytics/asset-criticality.md @@ -43,21 +43,21 @@ You can view, assign, change, or unassign asset criticality from the following p * The [host details page](../explore/hosts-page.md#host-details-page) and [user details page](../explore/users-page.md#user-details-page): - :::{image} ../../../images/security-assign-asset-criticality-host-details.png + :::{image} /solutions/images/security-assign-asset-criticality-host-details.png :alt: Assign asset criticality from the host details page :screenshot: ::: * The [host details flyout](../explore/hosts-page.md#host-details-flyout) and [user details flyout](../explore/users-page.md#user-details-flyout): - :::{image} ../../../images/security-assign-asset-criticality-host-flyout.png + :::{image} /solutions/images/security-assign-asset-criticality-host-flyout.png :alt: Assign asset criticality from the host details flyout :screenshot: ::: * The host details flyout and user details flyout in [Timeline](../investigate/timeline.md): - :::{image} ../../../images/security-assign-asset-criticality-timeline.png + :::{image} /solutions/images/security-assign-asset-criticality-timeline.png :alt: Assign asset criticality from the host details flyout in Timeline :screenshot: ::: @@ -65,7 +65,7 @@ You can view, assign, change, or unassign asset criticality from the following p If you have enabled the [entity store](entity-store.md), you can also view asset criticality assignments in the [**Entities** section](../dashboards/entity-analytics-dashboard.md#entity-entities) of the Entity Analytics dashboard: -:::{image} ../../../images/security-entities-section.png +:::{image} /solutions/images/security-entities-section.png :alt: Entities section :screenshot: ::: @@ -138,7 +138,7 @@ To view the impact of asset criticality on an entity’s risk score, follow thes 2. Click **View risk contributions** to open the flyout’s left panel. 3. In the **Risk contributions** section, verify the entity’s criticality level from the time the alert was generated. -:::{image} ../../../images/security-asset-criticality-impact.png +:::{image} /solutions/images/security-asset-criticality-impact.png :alt: View asset criticality impact on host risk score :screenshot: ::: diff --git a/solutions/security/advanced-entity-analytics/optimizing-anomaly-results.md b/solutions/security/advanced-entity-analytics/optimizing-anomaly-results.md index 6150af03f1..8943859241 100644 --- a/solutions/security/advanced-entity-analytics/optimizing-anomaly-results.md +++ b/solutions/security/advanced-entity-analytics/optimizing-anomaly-results.md @@ -40,7 +40,7 @@ For example, to filter out results from a housekeeping process, named `maintenan 6. Click **Add item**. 7. In the **Items** textbox, enter the name of the process for which you want to filter out anomaly results (`maintenanceservice.exe` in our example). - :::{image} ../../../images/security-filter-add-item.png + :::{image} /solutions/images/security-filter-add-item.png :alt: filter add item :screenshot: ::: @@ -60,7 +60,7 @@ For example, to filter out results from a housekeeping process, named `maintenan The **Create Rule** window is displayed. - :::{image} ../../../images/security-rule-scope.png + :::{image} /solutions/images/security-rule-scope.png :alt: rule scope :screenshot: ::: @@ -105,7 +105,7 @@ Running the cloned job can take some time. Only run the job after you have compl 7. Click **Next** until the **Job details** page is displayed. 8. Enter a Job ID for the cloned job that indicates it is an iteration of the original one. For example, append a number or a username to the original job name, such as `windows-rare-network-process-2`. - :::{image} ../../../images/security-cloned-job-details.png + :::{image} /solutions/images/security-cloned-job-details.png :alt: cloned job details :screenshot: ::: @@ -115,7 +115,7 @@ Running the cloned job can take some time. Only run the job after you have compl The **Start ** window is displayed. - :::{image} ../../../images/security-start-job-window.png + :::{image} /solutions/images/security-start-job-window.png :alt: start job window :screenshot: ::: @@ -140,7 +140,7 @@ Depending on your anomaly detection results, you may want to set a minimum event The **Create Rule** window is displayed. - :::{image} ../../../images/security-ml-rule-threshold.png + :::{image} /solutions/images/security-ml-rule-threshold.png :alt: ml rule threshold :screenshot: ::: diff --git a/solutions/security/advanced-entity-analytics/turn-on-risk-scoring-engine.md b/solutions/security/advanced-entity-analytics/turn-on-risk-scoring-engine.md index 01a0c1da43..30c872e76a 100644 --- a/solutions/security/advanced-entity-analytics/turn-on-risk-scoring-engine.md +++ b/solutions/security/advanced-entity-analytics/turn-on-risk-scoring-engine.md @@ -27,7 +27,7 @@ The preview is limited to two risk scores per {{kib}} instance or serverless pro To preview risky entities, find **Entity Risk Score** in the navigation menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). -:::{image} ../../../images/security-preview-risky-entities.png +:::{image} /solutions/images/security-preview-risky-entities.png :alt: Preview of risky entities :screenshot: ::: @@ -49,7 +49,7 @@ If you’re installing the risk scoring engine for the first time: You can also choose to include `Closed` alerts in risk scoring calculations and specify a date and time range for the calculation. -:::{image} ../../../images/security-turn-on-risk-engine.png +:::{image} /solutions/images/security-turn-on-risk-engine.png :alt: Turn on entity risk scoring :screenshot: ::: @@ -68,7 +68,7 @@ If you upgraded to 8.11 from an earlier {{stack}} version, and you have the orig * The **Host risk** tab on the Hosts page * The **Host risk** tab on a host’s details page -:::{image} ../../../images/security-risk-engine-upgrade-prompt.png +:::{image} /solutions/images/security-risk-engine-upgrade-prompt.png :alt: Prompt to upgrade to the latest risk engine :screenshot: ::: @@ -76,7 +76,7 @@ If you upgraded to 8.11 from an earlier {{stack}} version, and you have the orig 1. Click **Manage** in the upgrade prompt, or find **Entity Risk Score** in the navigation menu. 2. On the Entity Risk Score page, click **Start update** next to the **Update available** label. - :::{image} ../../../images/security-risk-score-start-update.png + :::{image} /solutions/images/security-risk-score-start-update.png :alt: Start the risk engine upgrade :screenshot: ::: @@ -84,7 +84,7 @@ If you upgraded to 8.11 from an earlier {{stack}} version, and you have the orig 3. On the confirmation message, click **Yes, update now**. The old transform is removed and the latest risk engine is installed. 4. When the installation is complete, confirm that the **Entity risk score** toggle is on. - :::{image} ../../../images/security-turn-on-risk-engine.png + :::{image} /solutions/images/security-turn-on-risk-engine.png :alt: Turn on entity risk scoring :screenshot: ::: diff --git a/solutions/security/advanced-entity-analytics/view-analyze-risk-score-data.md b/solutions/security/advanced-entity-analytics/view-analyze-risk-score-data.md index 4e15a8d460..5d55a84d00 100644 --- a/solutions/security/advanced-entity-analytics/view-analyze-risk-score-data.md +++ b/solutions/security/advanced-entity-analytics/view-analyze-risk-score-data.md @@ -31,7 +31,7 @@ From the Entity Analytics dashboard, you can access entity key performance indic If you have enabled the [entity store](entity-store.md), the dashboard also displays the [**Entities** section](../dashboards/entity-analytics-dashboard.md#entity-entities), where you can view all hosts and users along with their risk and asset criticality data. -:::{image} ../../../images/security-entity-dashboard.png +:::{image} /solutions/images/security-entity-dashboard.png :alt: Entity Analytics dashboard :screenshot: ::: @@ -58,7 +58,7 @@ To display entity risk score and asset criticality data in the Alerts table, sel Learn more about [customizing the Alerts table](../detect-and-alert/manage-detection-alerts.md#customize-the-alerts-table). -:::{image} ../../../images/security-alerts-table-rs.png +:::{image} /solutions/images/security-alerts-table-rs.png :alt: Risk scores in the Alerts table :screenshot: ::: @@ -77,14 +77,14 @@ If you change the entity’s criticality level after an alert is generated, that * `user.risk.calculated_level` or `host.risk.calculated_level` for entity risk level: - :::{image} ../../../images/security-filter-by-host-risk-level.png + :::{image} /solutions/images/security-filter-by-host-risk-level.png :alt: Alerts filtered by high host risk level :screenshot: ::: * `user.asset.criticality` or `host.asset.criticality` for asset criticality level: - :::{image} ../../../images/security-filter-by-asset-criticality.png + :::{image} /solutions/images/security-filter-by-asset-criticality.png :alt: Filter alerts by asset criticality level :screenshot: ::: @@ -93,14 +93,14 @@ If you change the entity’s criticality level after an alert is generated, that * `host.risk.calculated_level` or `user.risk.calculated_level` for entity risk level: - :::{image} ../../../images/security-group-by-host-risk-level.png + :::{image} /solutions/images/security-group-by-host-risk-level.png :alt: Alerts grouped by host risk levels :screenshot: ::: * `host.asset.criticality` or `user.asset.criticality` for asset criticality level: - :::{image} ../../../images/security-group-by-asset-criticality.png + :::{image} /solutions/images/security-group-by-asset-criticality.png :alt: Alerts grouped by entity asset criticality levels :screenshot: ::: @@ -116,7 +116,7 @@ If you change the entity’s criticality level after an alert is generated, that 3. `@timestamp`: **New-Old** - :::{image} ../../../images/security-hrl-sort-by-host-risk-score.png + :::{image} /solutions/images/security-hrl-sort-by-host-risk-score.png :alt: High-risk alerts sorted by host risk score :screenshot: ::: @@ -127,7 +127,7 @@ If you change the entity’s criticality level after an alert is generated, that To access risk score data in the alert details flyout, select **Insights** → **Entities** on the **Overview** tab: -:::{image} ../../../images/security-alerts-flyout-rs.png +:::{image} /solutions/images/security-alerts-flyout-rs.png :alt: Risk scores in the Alerts flyout :screenshot: ::: @@ -139,14 +139,14 @@ On the Hosts and Users pages, you can access the risk score data: * In the **Host risk level** or **User risk level** column on the **All hosts** or **All users** tab: - :::{image} ../../../images/security-hosts-hr-level.png + :::{image} /solutions/images/security-hosts-hr-level.png :alt: Host risk level data on the All hosts tab of the Hosts page :screenshot: ::: * On the **Host risk** or **User risk** tab: - :::{image} ../../../images/security-hosts-hr-data.png + :::{image} /solutions/images/security-hosts-hr-data.png :alt: Host risk data on the Host risk tab of the Hosts page :screenshot: ::: @@ -159,14 +159,14 @@ On the host details and user details pages, you can access the risk score data: * In the Overview section: - :::{image} ../../../images/security-host-details-overview.png + :::{image} /solutions/images/security-host-details-overview.png :alt: Host risk data in the Overview section of the host details page :screenshot: ::: * On the **Host risk** or **User risk** tab: - :::{image} ../../../images/security-host-details-hr-tab.png + :::{image} /solutions/images/security-host-details-hr-tab.png :alt: Host risk data on the Host risk tab of the host details page :screenshot: ::: @@ -177,7 +177,7 @@ On the host details and user details pages, you can access the risk score data: In the host details and user details flyouts, you can access the risk score data in the risk summary section: -:::{image} ../../../images/security-risk-summary.png +:::{image} /solutions/images/security-risk-summary.png :alt: Host risk data in the Host risk summary section :screenshot: ::: diff --git a/solutions/security/ai/ai-assistant-knowledge-base.md b/solutions/security/ai/ai-assistant-knowledge-base.md index aaeb6d9a9e..8fdfbb975d 100644 --- a/solutions/security/ai/ai-assistant-knowledge-base.md +++ b/solutions/security/ai/ai-assistant-knowledge-base.md @@ -30,7 +30,7 @@ AI Assistant’s Knowledge Base feature enables AI Assistant to recall specific The `Elastic AI Assistant: All` role privilege allows you to use AI Assistant and access its settings. It has two sub-privileges, `Field Selection and Anonymization`, which allows you to customize which alert fields are sent to AI Assistant and Attack Discovery, and `Knowledge Base`, which allows you to edit and create new Knowledge Base entries. -:::{image} ../../../images/security-knowledge-base-rbac.png +:::{image} /solutions/images/security-knowledge-base-rbac.png :alt: Knowledge base's RBAC settings ::: @@ -49,13 +49,13 @@ You must individually enable Knowledge Base for each {{kib}} space where you wan Open a conversation with AI Assistant, select a large language model, then click **Setup Knowledge Base**. If the button doesn’t appear, Knowledge Base is already enabled. -:::{image} ../../../images/security-knowledge-base-assistant-setup-button.png +:::{image} /solutions/images/security-knowledge-base-assistant-setup-button.png :alt: An AI Assistant conversation showing the Setup Knowledge Base button ::: Knowledge base setup may take several minutes. It will continue in the background if you close the conversation. After setup is complete, you can access Knowledge Base settings from AI Assistant’s conversation settings menu (access the conversation settings menu by clicking the three dots button next to the model selection dropdown). -:::{image} ../../../images/security-knowledge-base-assistant-menu-dropdown.png +:::{image} /solutions/images/security-knowledge-base-assistant-menu-dropdown.png :alt: AI Assistant's dropdown menu with the Knowledge Base option highlighted ::: @@ -65,7 +65,7 @@ Knowledge base setup may take several minutes. It will continue in the backgroun 1. To open **Security AI settings**, use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md) to find "AI Assistant for Security." 2. On the **Knowledge Base** tab, click **Setup Knowledge Base**. If the button doesn’t appear, Knowledge Base is already enabled. -:::{image} ../../../images/security-knowledge-base-assistant-settings-kb-tab.png +:::{image} /solutions/images/security-knowledge-base-assistant-settings-kb-tab.png :alt: AI Assistant's settings menu open to the Knowledge Base tab ::: @@ -131,7 +131,7 @@ Indices added to Knowledge Base must have at least one field mapped as [semantic 8. Under **Query Instruction**, describe how AI Assistant should query this index to retrieve relevant information. 9. Under **Output Fields**, list the fields which should be sent to AI Assistant. If none are listed, all fields will be sent. -:::{image} ../../../images/security-knowledge-base-add-index-config.png +:::{image} /solutions/images/security-knowledge-base-add-index-config.png :alt: Knowledge base's Edit index entry menu ::: diff --git a/solutions/security/ai/ai-assistant.md b/solutions/security/ai/ai-assistant.md index 2d3013986b..5e49f96b27 100644 --- a/solutions/security/ai/ai-assistant.md +++ b/solutions/security/ai/ai-assistant.md @@ -12,7 +12,7 @@ applies_to: The Elastic AI Assistant utilizes generative AI to bolster your cybersecurity operations team. It allows users to interact with {{elastic-sec}} for tasks such as alert investigation, incident response, and query generation or conversion using natural language and much more. -:::{image} ../../../images/security-assistant-basic-view.png +:::{image} /solutions/images/security-assistant-basic-view.png :alt: Image of AI Assistant chat window :screenshot: ::: @@ -61,7 +61,7 @@ While AI Assistant is compatible with many different models, refer to the [Large To open AI Assistant, select the **AI Assistant** button in the top toolbar from anywhere in the {{security-app}}. You can also use the keyboard shortcut **Cmd + ;** (or **Ctrl + ;** on Windows). -:::{image} ../../../images/security-ai-assistant-button.png +:::{image} /solutions/images/security-ai-assistant-button.png :alt: AI Assistant button :screenshot: ::: @@ -87,24 +87,24 @@ Use these features to adjust and act on your conversations with AI Assistant: * (Optional) Select a *System Prompt* at the beginning of a conversation by using the **Select Prompt** menu. System Prompts provide context to the model, informing its response. To create a System Prompt, open the System Prompts dropdown menu and click **+ Add new System Prompt…​**. * (Optional) Select a *Quick Prompt* at the bottom of the chat window to get help writing a prompt for a specific purpose, such as summarizing an alert or converting a query from a legacy SIEM to {{elastic-sec}}. - :::{image} ../../../images/security-quick-prompts.png + :::{image} /solutions/images/security-quick-prompts.png :alt: Quick Prompts highlighted below a conversation :screenshot: ::: * System Prompts and Quick Prompts can also be configured from the corresponding tabs on the **Security AI settings** page. - :::{image} ../../../images/security-assistant-settings-system-prompts.png + :::{image} /solutions/images/security-assistant-settings-system-prompts.png :alt: The Security AI settings menu's System Prompts tab ::: * Quick Prompt availability varies based on context—for example, the **Alert summarization** Quick Prompt appears when you open AI Assistant while viewing an alert. To customize existing Quick Prompts and create new ones, click **Add Quick Prompt**. * In an active conversation, you can use the inline actions that appear on messages to incorporate AI Assistant’s responses into your workflows: - * **Add note to timeline** (![Add note icon](../../../images/security-icon-add-note.png "title =20x20")): Add the selected text to your currently active Timeline as a note. - * **Add to existing case** (![Add to case icon](../../../images/security-icon-add-to-case.png "title =20x20")): Add a comment to an existing case using the selected text. - * **Copy to clipboard** (![Copy to clipboard icon](../../../images/security-icon-copy.png "title =20x20")): Copy the text to clipboard to paste elsewhere. Also helpful for resubmitting a previous prompt. - * **Add to timeline** (![Add to timeline icon](../../../images/security-icon-add-to-timeline.png "title =20x20")): Add a filter or query to Timeline using the text. This button appears for particular queries in AI Assistant’s responses. + * **Add note to timeline** (![Add note icon](/solutions/images/security-icon-add-note.png "title =20x20")): Add the selected text to your currently active Timeline as a note. + * **Add to existing case** (![Add to case icon](/solutions/images/security-icon-add-to-case.png "title =20x20")): Add a comment to an existing case using the selected text. + * **Copy to clipboard** (![Copy to clipboard icon](/solutions/images/security-icon-copy.png "title =20x20")): Copy the text to clipboard to paste elsewhere. Also helpful for resubmitting a previous prompt. + * **Add to timeline** (![Add to timeline icon](/solutions/images/security-icon-add-to-timeline.png "title =20x20")): Add a filter or query to Timeline using the text. This button appears for particular queries in AI Assistant’s responses. Be sure to specify which language you’d like AI Assistant to use when writing a query. For example: "Can you generate an Event Query Language query to find four failed logins followed by a successful login?" @@ -140,11 +140,11 @@ To modify Anonymization settings, you need the **Elastic AI Assistant: All** pri The **Anonymization** tab of the Security AI settings menu allows you to define default data anonymization behavior for events you send to AI Assistant. Fields with **Allowed*** toggled on are included in events provided to AI Assistant. ***Allowed*** fields with ***Anonymized** set to **Yes** are included, but with their values obfuscated. ::::{note} -You can access anonymization settings directly from the **Attack Discovery** page by clicking the settings (![Settings icon](../../../images/security-icon-settings.png "title =20x20")) button next to the model selection dropdown menu. +You can access anonymization settings directly from the **Attack Discovery** page by clicking the settings (![Settings icon](/solutions/images/security-icon-settings.png "title =20x20")) button next to the model selection dropdown menu. :::: -:::{image} ../../../images/security-assistant-anonymization-menu.png +:::{image} /solutions/images/security-assistant-anonymization-menu.png :alt: AI Assistant's settings menu :screenshot: ::: diff --git a/solutions/security/ai/attack-discovery.md b/solutions/security/ai/attack-discovery.md index 21679e6259..9b4d57d86b 100644 --- a/solutions/security/ai/attack-discovery.md +++ b/solutions/security/ai/attack-discovery.md @@ -33,7 +33,7 @@ This page describes: The `Attack Discovery: All` privilege allows you to use Attack Discovery. -![attack-discovery-rbac](../../../images/security-attck-disc-rbac.png) +![attack-discovery-rbac](/solutions/images/security-attck-disc-rbac.png) ## Generate discoveries [attack-discovery-generate-discoveries] @@ -48,7 +48,7 @@ When you access Attack Discovery for the first time, you’ll need to select an ::: - :::{image} ../../../images/security-attck-disc-select-model-empty.png + :::{image} /solutions/images/security-attck-disc-select-model-empty.png :alt: attck disc select model empty ::: @@ -57,11 +57,11 @@ When you access Attack Discovery for the first time, you’ll need to select an It may take from a few seconds up to several minutes to generate discoveries, depending on the number of alerts and the model you selected. ::::{important} -By default, Attack Discovery analyzes up to 100 alerts within this timeframe, but you can expand this up to 500 by clicking the settings icon (![Settings icon](../../../images/security-icon-settings.png "title=20px")) next to the model selection menu and adjusting the **Alerts** slider. Note that sending more alerts than your chosen LLM can handle may result in an error. +By default, Attack Discovery analyzes up to 100 alerts within this timeframe, but you can expand this up to 500 by clicking the settings icon (![Settings icon](/solutions/images/security-icon-settings.png "title=20px")) next to the model selection menu and adjusting the **Alerts** slider. Note that sending more alerts than your chosen LLM can handle may result in an error. :::: -:::{image} ../../../images/security-attck-disc-alerts-number-menu.png +:::{image} /solutions/images/security-attck-disc-alerts-number-menu.png :alt: Attack Discovery's settings menu :width: 600px ::: @@ -82,7 +82,7 @@ Each discovery includes the following information describing the potential threa 2. The number of associated alerts and which parts of the [MITRE ATT&CK matrix](https://attack.mitre.org/) they correspond to. 3. The implicated entities (users and hosts), and what suspicious activity was observed for each. -:::{image} ../../../images/security-attck-disc-example-disc.png +:::{image} /solutions/images/security-attck-disc-example-disc.png :alt: Attack Discovery detail view ::: @@ -92,11 +92,11 @@ Each discovery includes the following information describing the potential threa There are several ways you can incorporate discoveries into your {{elastic-sec}} workflows: * Click an entity’s name to open the user or host details flyout and view more details that may be relevant to your investigation. -* Hover over an entity’s name to either add the entity to Timeline (![Add to timeline icon](../../../images/security-icon-add-to-timeline.png "title=70%")) or copy its field name and value to the clipboard (![Copy to clipboard icon](../../../images/security-icon-copy.png "title=70%")). +* Hover over an entity’s name to either add the entity to Timeline (![Add to timeline icon](/solutions/images/security-icon-add-to-timeline.png "title=70%")) or copy its field name and value to the clipboard (![Copy to clipboard icon](/solutions/images/security-icon-copy.png "title=70%")). * Click **Take action**, then select **Add to new case** or **Add to existing case** to add a discovery to a [case](/solutions/security/investigate/cases.md). This makes it easy to share the information with your team and other stakeholders. * Click **Investigate in timeline** to explore the discovery in [Timeline](/solutions/security/investigate/timeline.md). * Click **View in AI Assistant** to attach the discovery to a conversation with AI Assistant. You can then ask follow-up questions about the discovery or associated alerts. -:::{image} ../../../images/security-add-discovery-to-assistant.gif +:::{image} /solutions/images/security-add-discovery-to-assistant.gif :alt: Attack Discovery view in AI Assistant ::: diff --git a/solutions/security/ai/connect-to-own-local-llm.md b/solutions/security/ai/connect-to-own-local-llm.md index 945de0c45d..9718e96d19 100644 --- a/solutions/security/ai/connect-to-own-local-llm.md +++ b/solutions/security/ai/connect-to-own-local-llm.md @@ -17,7 +17,7 @@ This example uses a single server hosted in GCP to run the following components: * LM Studio with the [Mistral-Nemo-Instruct-2407](https://huggingface.co/mistralai/Mistral-Nemo-Instruct-2407) model * A reverse proxy using Nginx to authenticate to Elastic Cloud -:::{image} ../../../images/security-lms-studio-arch-diagram.png +:::{image} /solutions/images/security-lms-studio-arch-diagram.png :alt: Architecture diagram for this guide ::: @@ -124,7 +124,7 @@ For security reasons, before downloading a model, verify that it is from a trust :::: -:::{image} ../../../images/security-lms-model-select.png +:::{image} /solutions/images/security-lms-model-select.png :alt: The LM Studio model selection interface ::: @@ -152,19 +152,19 @@ Once you’ve downloaded a model, use the following commands in your CLI: 3. List all downloaded models: `lms ls` 4. Load a model: `lms load`. -:::{image} ../../../images/security-lms-cli-welcome.png +:::{image} /solutions/images/security-lms-cli-welcome.png :alt: The CLI interface during execution of initial LM Studio commands ::: After the model loads, you should see a `Model loaded successfully` message in the CLI. Select a model using the arrow and **Enter** keys. -:::{image} ../../../images/security-lms-studio-model-loaded-msg.png +:::{image} /solutions/images/security-lms-studio-model-loaded-msg.png :alt: The CLI message that appears after a model loads ::: To verify which model is loaded, use the `lms ps` command. -:::{image} ../../../images/security-lms-ps-command.png +:::{image} /solutions/images/security-lms-ps-command.png :alt: The CLI message that appears after running lms ps ::: @@ -182,7 +182,7 @@ Refer to the following video to see how to load a model using LM Studio’s GUI. You can monitor the performance of the host running LM Studio using Elastic’s [Custom Logs integration](https://docs.elastic.co/en/integrations/log). This can also help with troubleshooting. Note that the default path for LM Studio logs is `/tmp/lmstudio-server-log.txt`, as in the following screenshot: -:::{image} ../../../images/security-lms-custom-logs-config.png +:::{image} /solutions/images/security-lms-custom-logs-config.png :alt: The configuration window for the custom logs integration ::: @@ -200,7 +200,7 @@ Finally, configure the connector: 7. Under **API key**, enter the secret token specified in your Nginx configuration file. 8. Click **Save**. -:::{image} ../../../images/security-lms-edit-connector.png +:::{image} /solutions/images/security-lms-edit-connector.png :alt: The Edit connector page in the {{security-app}} ::: diff --git a/solutions/security/ai/identify-investigate-document-threats.md b/solutions/security/ai/identify-investigate-document-threats.md index aab481cd68..495609c732 100644 --- a/solutions/security/ai/identify-investigate-document-threats.md +++ b/solutions/security/ai/identify-investigate-document-threats.md @@ -24,7 +24,7 @@ In this guide, you’ll learn how to: Attack discovery can detect a wide range of threats by finding relationships among alerts that may indicate a coordinated attack. This enables you to comprehend how threats move through and affect your systems. Attack discovery generates a detailed summary of each potential threat, which can serve as the basis for further analysis. Learn how to [get started with Attack discovery](/solutions/security/ai/attack-discovery.md). -:::{image} ../../../images/security-attck-disc-11-alerts-disc.png +:::{image} /solutions/images/security-attck-disc-11-alerts-disc.png :alt: An Attack discovery card showing an attack with 11 related alerts ::: @@ -37,13 +37,13 @@ After Attack discovery outlines your threat landscape, use Elastic AI Assistant From a discovery on the Attack discovery page, click **View in AI Assistant** to start a chat that includes the discovery as context. -:::{image} ../../../images/security-attck-disc-remediate-threat.gif +:::{image} /solutions/images/security-attck-disc-remediate-threat.gif :alt: A dialogue with AI Assistant that has the attack discovery as context ::: AI Assistant can quickly compile essential data and provide suggestions to help you generate an incident report and plan an effective response. You can ask it to provide relevant data or answer questions, such as “How can I remediate this threat?” or “What {{esql}} query would isolate actions taken by this user?” -:::{image} ../../../images/security-attck-disc-esql-query-gen-example.png +:::{image} /solutions/images/security-attck-disc-esql-query-gen-example.png :alt: An AI Assistant dialogue in which the user asks for a purpose-built {{esql}} query ::: @@ -54,14 +54,14 @@ At any point in a conversation with AI Assistant, you can add data, narrative su ## Generate reports [use-case-incident-reporting-create-a-case-using-ai-assistant] -From the AI Assistant dialog window, click **Add to case** (![Add to case icon](../../../images/security-icon-add-to-case.png "title =20x20")) next to a message to add the information in that message to a [case](/solutions/security/investigate/cases.md). Cases help centralize relevant details in one place for easy sharing with stakeholders. +From the AI Assistant dialog window, click **Add to case** (![Add to case icon](/solutions/images/security-icon-add-to-case.png "title =20x20")) next to a message to add the information in that message to a [case](/solutions/security/investigate/cases.md). Cases help centralize relevant details in one place for easy sharing with stakeholders. If you add a message that contains a discovery to a case, AI Assistant automatically adds the attack summary and all associated alerts to the case. You can also add AI Assistant messages that contain remediation steps and relevant data to the case. ## Translate incident information to a different human language using AI Assistant [use-case-incident-reporting-translate] -:::{image} ../../../images/security-attck-disc-translate-japanese.png +:::{image} /solutions/images/security-attck-disc-translate-japanese.png :alt: An AI Assistant dialogue in which the assistant translates from English to Japanese ::: diff --git a/solutions/security/ai/triage-alerts.md b/solutions/security/ai/triage-alerts.md index 5a7d19be45..6e11ef847c 100644 --- a/solutions/security/ai/triage-alerts.md +++ b/solutions/security/ai/triage-alerts.md @@ -53,7 +53,7 @@ Elastic AI Assistant can streamline the documentation and report generation proc After you review the report, click **Add to existing case** at the top of AI Assistant’s response. This allows you to save a record of the report and make it available to your team. -:::{image} ../../../images/security-ai-triage-add-to-case.png +:::{image} /solutions/images/security-ai-triage-add-to-case.png :alt: An AI Assistant dialogue with the add to existing case button highlighted :screenshot: ::: diff --git a/solutions/security/cloud/benchmarks.md b/solutions/security/cloud/benchmarks.md index 065253fc46..4e8e9de300 100644 --- a/solutions/security/cloud/benchmarks.md +++ b/solutions/security/cloud/benchmarks.md @@ -21,7 +21,7 @@ applies_to: The Benchmarks page lets you view the cloud security posture (CSP) benchmark rules for the [Cloud security posture management](/solutions/security/cloud/cloud-security-posture-management.md) (CSPM) and [Kubernetes security posture management](/solutions/security/cloud/kubernetes-security-posture-management.md) (KSPM) integrations. -:::{image} ../../../images/security-benchmark-rules.png +:::{image} /solutions/images/security-benchmark-rules.png :alt: Benchmarks page :screenshot: ::: diff --git a/solutions/security/cloud/capture-environment-variables.md b/solutions/security/cloud/capture-environment-variables.md index 5f08aac94b..256907163c 100644 --- a/solutions/security/cloud/capture-environment-variables.md +++ b/solutions/security/cloud/capture-environment-variables.md @@ -38,6 +38,6 @@ To view environment variables in the **Events** table: 1. Click the **Events** tab on the **Hosts**, **Network**, or **Users** pages, then click **Fields** in the Events table. 2. Search for the `process.env_vars` field, select it, and click **Close**. A new column appears containing captured environment variable data. -:::{image} ../../../images/security-env-var-capture-detail.png +:::{image} /solutions/images/security-env-var-capture-detail.png :alt: The Events table with the "process.env_vars" column highlighted ::: diff --git a/solutions/security/cloud/findings-page-2.md b/solutions/security/cloud/findings-page-2.md index ce43902977..8f058195ee 100644 --- a/solutions/security/cloud/findings-page-2.md +++ b/solutions/security/cloud/findings-page-2.md @@ -13,7 +13,7 @@ applies_to: The **Misconfigurations** tab on the Findings page displays the configuration risks identified by the [CSPM](/solutions/security/cloud/cloud-security-posture-management.md) and [KSPM](/solutions/security/cloud/kubernetes-security-posture-management.md) integrations. -:::{image} ../../../images/security-findings-page.png +:::{image} /solutions/images/security-findings-page.png :alt: Findings page :screenshot: ::: diff --git a/solutions/security/cloud/findings-page-3.md b/solutions/security/cloud/findings-page-3.md index 3e507b21d1..16a7389d12 100644 --- a/solutions/security/cloud/findings-page-3.md +++ b/solutions/security/cloud/findings-page-3.md @@ -12,7 +12,7 @@ applies_to: The **Vulnerabilities** tab on the Findings page displays the vulnerabilities detected by the [CNVM integration](cloud-native-vulnerability-management.md), as well as those detected by [third-party integrations](ingest-third-party-cloud-security-data.md). -:::{image} ../../../images/serverless--cloud-native-security-cnvm-findings-page.png +:::{image} /solutions/images/serverless--cloud-native-security-cnvm-findings-page.png :alt: The Vulnerabilities tab of the Findings page :screenshot: ::: @@ -43,7 +43,7 @@ Multiple groupings apply to your data in the order you selected them. For exampl :::: -:::{image} ../../../images/serverless--cloud-native-security-cnvm-findings-grouped.png +:::{image} /solutions/images/serverless--cloud-native-security-cnvm-findings-grouped.png :alt: The Vulnerabilities tab of the Findings page :screenshot: ::: diff --git a/solutions/security/cloud/findings-page.md b/solutions/security/cloud/findings-page.md index 07901870de..a41038e430 100644 --- a/solutions/security/cloud/findings-page.md +++ b/solutions/security/cloud/findings-page.md @@ -16,7 +16,7 @@ $$$cspm-findings-page-filter-findings$$$ The **Misconfigurations** tab on the Findings page displays the configuration risks identified by the [CSPM](/solutions/security/cloud/cloud-security-posture-management.md) and [KSPM](/solutions/security/cloud/kubernetes-security-posture-management.md) integrations, as well as data from [third-party integrations](/solutions/security/cloud/ingest-third-party-cloud-security-data.md). -:::{image} ../../../images/security-findings-page.png +:::{image} /solutions/images/security-findings-page.png :alt: Findings page :screenshot: ::: diff --git a/solutions/security/cloud/get-started-with-cnvm.md b/solutions/security/cloud/get-started-with-cnvm.md index 1896ab1853..fcaa033fa1 100644 --- a/solutions/security/cloud/get-started-with-cnvm.md +++ b/solutions/security/cloud/get-started-with-cnvm.md @@ -45,7 +45,7 @@ Do not add the integration to an existing {{agent}} policy. It should always be 3. Click **Add Cloud Native Vulnerability Management**. 4. Give your integration a name that matches its purpose or the AWS account region you want to scan for vulnerabilities (for example, `uswest2-aws-account`.) - :::{image} ../../../images/security-cnvm-setup-1.png + :::{image} /solutions/images/security-cnvm-setup-1.png :alt: The CNVM integration setup page ::: @@ -69,7 +69,7 @@ The integration will only scan VMs in the region you select. To scan multiple re 1. Switch back to the tab where you have {{kib}} open. 2. Click **Launch CloudFormation**. The CloudFormation page appears. - :::{image} ../../../images/security-cnvm-cloudformation.png + :::{image} /solutions/images/security-cnvm-cloudformation.png :alt: The cloud formation template ::: diff --git a/solutions/security/cloud/get-started-with-cspm-for-aws.md b/solutions/security/cloud/get-started-with-cspm-for-aws.md index 7df3389fb8..0448ae43b8 100644 --- a/solutions/security/cloud/get-started-with-cspm-for-aws.md +++ b/solutions/security/cloud/get-started-with-cspm-for-aws.md @@ -84,7 +84,7 @@ For most use cases, the simplest option is to use AWS CloudFormation to automati 7. (Optional) Switch to the AWS region where you want to deploy using the controls in the upper right corner. 8. Tick the checkbox under **Capabilities** to authorize the creation of necessary resources. - :::{image} ../../../images/security-cspm-cloudformation-template.png + :::{image} /solutions/images/security-cspm-cloudformation-template.png :alt: The Add permissions screen in AWS ::: @@ -236,13 +236,13 @@ Follow AWS’s [IAM roles for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/lat 2. On the **Select trusted entity** page, under **Trusted entity type**, select **AWS service**. 3. Under **Use case**, select **EC2**. Click **Next**. - :::{image} ../../../images/security-cspm-aws-auth-1.png + :::{image} /solutions/images/security-cspm-aws-auth-1.png :alt: The Select trusted entity screen in AWS ::: 4. On the **Add permissions** page, search for and select `SecurityAudit`. Click **Next**. - :::{image} ../../../images/security-cspm-aws-auth-2.png + :::{image} /solutions/images/security-cspm-aws-auth-2.png :alt: The Add permissions screen in AWS ::: @@ -253,7 +253,7 @@ Follow AWS’s [IAM roles for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/lat 1. In AWS, select an EC2 instance. 2. Select **Actions > Security > Modify IAM role**. - :::{image} ../../../images/security-cspm-aws-auth-3.png + :::{image} /solutions/images/security-cspm-aws-auth-3.png :alt: The EC2 page in AWS ::: diff --git a/solutions/security/cloud/get-started-with-cspm-for-gcp.md b/solutions/security/cloud/get-started-with-cspm-for-gcp.md index 5889ccd20b..608e32010e 100644 --- a/solutions/security/cloud/get-started-with-cspm-for-gcp.md +++ b/solutions/security/cloud/get-started-with-cspm-for-gcp.md @@ -80,7 +80,7 @@ For most users, the simplest option is to use a Google Cloud Shell script to aut 4. Copy the command that appears, then click **Launch Google Cloud Shell**. It opens in a new window. 5. Check the box to trust Elastic’s `cloudbeat` repo, then click **Confirm** -:::{image} ../../../images/security-cspm-cloudshell-trust.png +:::{image} /solutions/images/security-cspm-cloudshell-trust.png :alt: The cloud shell confirmation popup ::: diff --git a/solutions/security/cloud/get-started-with-kspm.md b/solutions/security/cloud/get-started-with-kspm.md index d2f459d220..3c496e5e61 100644 --- a/solutions/security/cloud/get-started-with-kspm.md +++ b/solutions/security/cloud/get-started-with-kspm.md @@ -254,7 +254,7 @@ To install the integration on unmanaged clusters: 7. Select the {{agent}} policy where you want to add the integration. 8. Click **Save and continue**, then **Add agent to your hosts**. The **Add agent** wizard appears and provides a DaemonSet manifest `.yaml` file with pre-populated configuration information, such as the `Fleet ID` and `Fleet URL`. -:::{image} ../../../images/security-kspm-add-agent-wizard.png +:::{image} /solutions/images/security-kspm-add-agent-wizard.png :alt: The KSPM integration's Add agent wizard :screenshot: ::: diff --git a/solutions/security/cloud/ingest-aws-security-hub-data.md b/solutions/security/cloud/ingest-aws-security-hub-data.md index 2fc9aa41b9..a7bc0f40a4 100644 --- a/solutions/security/cloud/ingest-aws-security-hub-data.md +++ b/solutions/security/cloud/ingest-aws-security-hub-data.md @@ -17,7 +17,7 @@ In order to enrich your {{elastic-sec}} workflows with third-party cloud securit * Ensure you have `read` privileges for the `security_solution-*.misconfiguration_latest` index. * While configuring the AWS Security Hub integration, turn on **Collect AWS Security Hub Findings from AWS**. We recommend you also set the **Initial Interval** value to `2160h` (equivalent to 90 days) to ingest existing logs. -:::{image} ../../../images/security-aws-config-finding-logs.png +:::{image} /solutions/images/security-aws-config-finding-logs.png :alt: AWS Security Hub integration settings showing the findings toggle ::: diff --git a/solutions/security/cloud/ingest-wiz-data.md b/solutions/security/cloud/ingest-wiz-data.md index 5d2a4e5ce3..4691f80ac5 100644 --- a/solutions/security/cloud/ingest-wiz-data.md +++ b/solutions/security/cloud/ingest-wiz-data.md @@ -17,17 +17,17 @@ In order to enrich your {{elastic-sec}} workflows with third-party cloud securit * Ensure you have `read` privileges for the following indices: `security_solution-*.misconfiguration_latest`, `security_solution-*.vulnerability_latest`. * While configuring the Wiz integration, turn on **Cloud Configuration Finding logs** and **Vulnerability logs**. We recommend you also set the **Initial Interval** values for both settings to `2160h` (equivalent to 90 days) to ingest existing logs. -:::{image} ../../../images/security-wiz-config-finding-logs.png +:::{image} /solutions/images/security-wiz-config-finding-logs.png :alt: Wiz integration settings showing the findings toggle ::: -:::{image} ../../../images/security-wiz-config-vuln-logs.png +:::{image} /solutions/images/security-wiz-config-vuln-logs.png :alt: Wiz integration settings showing the vulnerabilities toggle ::: After you’ve completed these steps, Wiz data will appear on the [Misconfiguations](/solutions/security/cloud/findings-page.md) and [Vulnerabilities](/solutions/security/cloud/findings-page-3.md) tabs of the Findings page. -:::{image} ../../../images/security-wiz-findings.png +:::{image} /solutions/images/security-wiz-findings.png :alt: Wiz data on the Findings page ::: diff --git a/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md b/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md index 97f30d1870..f5c4592ea9 100644 --- a/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md +++ b/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md @@ -84,7 +84,7 @@ If you have the appropriate license or project feature, you can customize these :::: -:::{image} ../../../images/security-malware-protection.png +:::{image} /solutions/images/security-malware-protection.png :alt: Detail of malware protection section. :screenshot: ::: @@ -136,7 +136,7 @@ If you have the appropriate license or project feature, you can customize these :::: -:::{image} ../../../images/security-ransomware-protection.png +:::{image} /solutions/images/security-ransomware-protection.png :alt: Detail of ransomware protection section. :screenshot: ::: @@ -165,7 +165,7 @@ If you have the appropriate license or project feature, you can customize these :::: -:::{image} ../../../images/security-memory-protection.png +:::{image} /solutions/images/security-memory-protection.png :alt: Detail of memory protection section. :screenshot: ::: @@ -201,7 +201,7 @@ If you have the appropriate license or project feature, you can customize these :::: -:::{image} ../../../images/security-behavior-protection.png +:::{image} /solutions/images/security-behavior-protection.png :alt: Detail of behavior protection section. :screenshot: ::: @@ -218,7 +218,7 @@ In {{serverless-short}}, attack surface reduction requires the Endpoint Protecti **Credential hardening**: Prevents attackers from stealing credentials stored in Windows system process memory. Turn on the toggle to remove any overly permissive access rights that aren’t required for standard interaction with the Local Security Authority Subsystem Service (LSASS). This feature enforces the principle of least privilege without interfering with benign system activity that is related to LSASS. -:::{image} ../../../images/security-attack-surface-reduction.png +:::{image} /solutions/images/security-attack-surface-reduction.png :alt: Detail of attack surface reduction section. :screenshot: ::: @@ -228,7 +228,7 @@ In {{serverless-short}}, attack surface reduction requires the Endpoint Protecti In the **Settings** section, select which categories of events to collect on each operating system. Most categories are collected by default. -:::{image} ../../../images/security-event-collection.png +:::{image} /solutions/images/security-event-collection.png :alt: Detail of event collection section. :screenshot: ::: @@ -247,7 +247,7 @@ By default, the **Sync with malware protection level** is selected to automatica If you don’t want to sync antivirus registration, you can set it manually with **Enabled** or **Disabled**. -:::{image} ../../../images/security-register-as-antivirus.png +:::{image} /solutions/images/security-register-as-antivirus.png :alt: Detail of Register as antivirus option. :screenshot: ::: diff --git a/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md b/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md index 7f5ba14cd7..ea1dfbd4a8 100644 --- a/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md +++ b/solutions/security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md @@ -89,7 +89,7 @@ Set the `advanced.artifacts.global.base_url` advanced setting for each [{{elasti * `mac.advanced.artifacts.global.base_url` * `windows.advanced.artifacts.global.base_url` -:::{image} ../../../images/security-offline-adv-settings.png +:::{image} /solutions/images/security-offline-adv-settings.png :alt: Integration policy advanced settings :screenshot: ::: @@ -171,7 +171,7 @@ Set the `advanced.artifacts.global.base_url` advanced setting for each [{{elasti * `mac.advanced.artifacts.global.base_url` * `windows.advanced.artifacts.global.base_url` -:::{image} ../../../images/security-offline-adv-settings.png +:::{image} /solutions/images/security-offline-adv-settings.png :alt: Integration policy advanced settings :screenshot: ::: @@ -206,7 +206,7 @@ Replace `https://artifacts.security.elastic.co` in the command above with your l After updating the {{elastic-endpoint}} configuration to read from the mirror server, use {{kib}}'s [Discover view](../../../explore-analyze/discover.md) to search the `metrics-*` data view for `endpoint.policy` response documents, then check the installed version (`Endpoint.policy.applied.artifacts.global.version`) and compare with the output from the command above: -:::{image} ../../../images/security-offline-endpoint-version-discover.png +:::{image} /solutions/images/security-offline-endpoint-version-discover.png :alt: Searching for `endpoint.policy` in Discover :screenshot: ::: diff --git a/solutions/security/configure-elastic-defend/deploy-on-macos-with-mdm.md b/solutions/security/configure-elastic-defend/deploy-on-macos-with-mdm.md index 4cdbe72597..47185a89de 100644 --- a/solutions/security/configure-elastic-defend/deploy-on-macos-with-mdm.md +++ b/solutions/security/configure-elastic-defend/deploy-on-macos-with-mdm.md @@ -40,7 +40,7 @@ In Jamf, create a configuration profile for {{elastic-endpoint}}. Follow these s 4. Save the configuration. -:::{image} ../../../images/security-system-extension-jamf.png +:::{image} /solutions/images/security-system-extension-jamf.png :alt: system extension jamf :screenshot: ::: @@ -71,7 +71,7 @@ In Jamf, create a configuration profile for {{elastic-endpoint}}. Follow these s 6. Save the configuration. -:::{image} ../../../images/security-content-filtering-jamf.png +:::{image} /solutions/images/security-content-filtering-jamf.png :alt: content filtering jamf :screenshot: ::: @@ -94,7 +94,7 @@ In Jamf, create a configuration profile for {{elastic-endpoint}}. Follow these s 5. Save the configuration. -:::{image} ../../../images/security-notifications-jamf.png +:::{image} /solutions/images/security-notifications-jamf.png :alt: notifications jamf :screenshot: ::: @@ -141,7 +141,7 @@ In Jamf, create a configuration profile for {{elastic-endpoint}}. Follow these s 5. Save the configuration. -:::{image} ../../../images/security-fda-jamf.png +:::{image} /solutions/images/security-fda-jamf.png :alt: fda jamf :screenshot: ::: diff --git a/solutions/security/configure-elastic-defend/enable-access-for-macos-monterey.md b/solutions/security/configure-elastic-defend/enable-access-for-macos-monterey.md index 403a6e18f2..dcbfa4aed6 100644 --- a/solutions/security/configure-elastic-defend/enable-access-for-macos-monterey.md +++ b/solutions/security/configure-elastic-defend/enable-access-for-macos-monterey.md @@ -28,20 +28,20 @@ For macOS Monterey (12.x), {{elastic-endpoint}} will attempt to load a system ex The following message appears during installation: -:::{image} ../../../images/security-system-ext-blocked.png +:::{image} /solutions/images/security-system-ext-blocked.png :alt: system ext blocked ::: 1. Click **Open Security Preferences**. 2. In the lower-left corner of the **Security & Privacy** pane, click the **Lock button**, then enter your credentials to authenticate. - :::{image} ../../../images/security-lock-button.png + :::{image} /solutions/images/security-lock-button.png :alt: lock button ::: 3. Click **Allow** to allow the {{elastic-endpoint}} system extension to load. - :::{image} ../../../images/security-allow-system-ext.png + :::{image} /solutions/images/security-allow-system-ext.png :alt: allow system ext ::: @@ -50,7 +50,7 @@ The following message appears during installation: After successfully loading the {{elastic-endpoint}} system extension, an additional message appears, asking to allow {{elastic-endpoint}} to filter network content. -:::{image} ../../../images/security-filter-network-content.png +:::{image} /solutions/images/security-filter-network-content.png :alt: filter network content ::: @@ -70,7 +70,7 @@ The following instructions apply only to {{elastic-endpoint}} running version 8. 1. Open the **System Preferences** application. 2. Select **Security and Privacy**. - :::{image} ../../../images/security-sec-privacy-pane.png + :::{image} /solutions/images/security-sec-privacy-pane.png :alt: sec privacy pane :screenshot: ::: @@ -78,7 +78,7 @@ The following instructions apply only to {{elastic-endpoint}} running version 8. 3. On the **Security and Privacy** pane, select the **Privacy** tab. 4. From the left pane, select **Full Disk Access**. - :::{image} ../../../images/security-select-fda.png + :::{image} /solutions/images/security-select-fda.png :alt: Select Full Disk Access :screenshot: ::: @@ -86,7 +86,7 @@ The following instructions apply only to {{elastic-endpoint}} running version 8. 5. In the lower-left corner of the pane, click the **Lock button**, then enter your credentials to authenticate. 6. In the **Privacy** tab, confirm that `ElasticEndpoint` AND `co.elastic.systemextension` are selected to properly enable Full Disk Access. - :::{image} ../../../images/security-select-endpoint-ext.png + :::{image} /solutions/images/security-select-endpoint-ext.png :alt: role+"screenshot" ::: @@ -99,7 +99,7 @@ In {{stack}}, if the endpoint is running {{elastic-endpoint}} version 7.17.0 or 4. Click **Open**. 5. In the **Privacy** tab, confirm that `elastic-endpoint` AND `co.elastic.systemextension` are selected to properly enable Full Disk Access. -:::{image} ../../../images/security-fda-7-16.png +:::{image} /solutions/images/security-fda-7-16.png :alt: fda 7 16 ::: diff --git a/solutions/security/configure-elastic-defend/enable-access-for-macos-ventura-higher.md b/solutions/security/configure-elastic-defend/enable-access-for-macos-ventura-higher.md index 24e135e553..67b40ace99 100644 --- a/solutions/security/configure-elastic-defend/enable-access-for-macos-ventura-higher.md +++ b/solutions/security/configure-elastic-defend/enable-access-for-macos-ventura-higher.md @@ -28,7 +28,7 @@ For macOS Ventura (13.0) and later, {{elastic-endpoint}} will attempt to load a The following message appears during installation: -:::{image} ../../../images/security-system_extension_blocked_warning_ven.png +:::{image} /solutions/images/security-system_extension_blocked_warning_ven.png :alt: system extension blocked warning ven :screenshot: ::: @@ -36,21 +36,21 @@ The following message appears during installation: 1. Click **Open System Settings**. 2. In the left pane, click **Privacy & Security**. - :::{image} ../../../images/security-privacy_security_ven.png + :::{image} /solutions/images/security-privacy_security_ven.png :alt: privacy security ven :screenshot: ::: 3. On the right pane, scroll down to the Security section. Click **Allow** to allow the ElasticEndpoint system extension to load. - :::{image} ../../../images/security-allow_system_extension_ven.png + :::{image} /solutions/images/security-allow_system_extension_ven.png :alt: allow system extension ven :screenshot: ::: 4. Enter your username and password and click **Modify Settings** to save your changes. - :::{image} ../../../images/security-enter_login_details_to_confirm_ven.png + :::{image} /solutions/images/security-enter_login_details_to_confirm_ven.png :alt: enter login details to confirm ven :screenshot: ::: @@ -61,7 +61,7 @@ The following message appears during installation: After successfully loading the ElasticEndpoint system extension, an additional message appears, asking to allow {{elastic-endpoint}} to filter network content. -:::{image} ../../../images/security-allow_network_filter_ven.png +:::{image} /solutions/images/security-allow_network_filter_ven.png :alt: allow network filter ven :screenshot: ::: @@ -75,7 +75,7 @@ Click **Allow** to enable content filtering for the ElasticEndpoint system exten If you have not granted Full Disk Access, the following notification prompt will appear. -:::{image} ../../../images/security-allow_full_disk_access_notification_ven.png +:::{image} /solutions/images/security-allow_full_disk_access_notification_ven.png :alt: allow full disk access notification ven :screenshot: ::: @@ -90,21 +90,21 @@ The following instructions apply only to {{elastic-endpoint}} version 8.0.0 and 1. Open the **System Settings** application. 2. In the left pane, select **Privacy & Security**. - :::{image} ../../../images/security-privacy_security_ven.png + :::{image} /solutions/images/security-privacy_security_ven.png :alt: privacy security ven :screenshot: ::: 3. From the right pane, select **Full Disk Access**. - :::{image} ../../../images/security-select_fda_ven.png + :::{image} /solutions/images/security-select_fda_ven.png :alt: Select Full Disk Access :screenshot: ::: 4. Enable `ElasticEndpoint` and `co.elastic` to properly enable Full Disk Access. - :::{image} ../../../images/security-allow_fda_ven.png + :::{image} /solutions/images/security-allow_fda_ven.png :alt: allow fda ven :screenshot: ::: @@ -115,7 +115,7 @@ If the endpoint is running {{elastic-endpoint}} version 7.17.0 or earlier: 1. Click the **+** button to view **Finder**. 2. The system may prompt you to enter your username and password if you haven’t already. - :::{image} ../../../images/security-enter_login_details_to_confirm_ven.png + :::{image} /solutions/images/security-enter_login_details_to_confirm_ven.png :alt: enter login details to confirm ven :screenshot: ::: @@ -124,7 +124,7 @@ If the endpoint is running {{elastic-endpoint}} version 7.17.0 or earlier: 4. Click **Open**. 5. In the **Privacy** tab, confirm that `ElasticEndpoint` and `co.elastic.systemextension` are selected to properly enable Full Disk Access. - :::{image} ../../../images/security-verify_fed_granted_ven.png + :::{image} /solutions/images/security-verify_fed_granted_ven.png :alt: Select Full Disk Access :screenshot: ::: diff --git a/solutions/security/configure-elastic-defend/install-elastic-defend.md b/solutions/security/configure-elastic-defend/install-elastic-defend.md index c2b9e5baf6..e58f819da8 100644 --- a/solutions/security/configure-elastic-defend/install-elastic-defend.md +++ b/solutions/security/configure-elastic-defend/install-elastic-defend.md @@ -36,7 +36,7 @@ If you’re using macOS, some versions may require you to grant Full Disk Access 1. Find **Integrations** in the navigation menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). - :::{image} ../../../images/security-endpoint-cloud-sec-integrations-page.png + :::{image} /solutions/images/security-endpoint-cloud-sec-integrations-page.png :alt: Search result for "{{elastic-defend}}" on the Integrations page. :screenshot: ::: @@ -48,7 +48,7 @@ If you’re using macOS, some versions may require you to grant Full Disk Access :::: - :::{image} ../../../images/security-endpoint-cloud-security-configuration.png + :::{image} /solutions/images/security-endpoint-cloud-security-configuration.png :alt: Add {{elastic-defend}} integration page :screenshot: ::: @@ -99,7 +99,7 @@ If you have upgraded to an {{stack}} version that includes {{fleet-server}} 7.13 1. If you’re in the process of installing an {{agent}} integration (such as {{elastic-defend}}), the **Add agent** UI opens automatically. Otherwise, find **{{fleet}}** in the navigation menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), and select **Agents** → **Add agent**. - :::{image} ../../../images/security-endpoint-cloud-sec-add-agent.png + :::{image} /solutions/images/security-endpoint-cloud-sec-add-agent.png :alt: Add agent flyout on the Fleet page. :screenshot: ::: @@ -108,7 +108,7 @@ If you have upgraded to an {{stack}} version that includes {{fleet-server}} 7.13 The selected agent policy should include the integration you want to install on the hosts covered by the agent policy (in this example, {{elastic-defend}}). - :::{image} ../../../images/security-endpoint-cloud-sec-add-agent-detail.png + :::{image} /solutions/images/security-endpoint-cloud-sec-add-agent-detail.png :alt: Add agent flyout with {{elastic-defend}} integration highlighted. :screenshot: ::: diff --git a/solutions/security/configure-elastic-defend/prevent-elastic-agent-uninstallation.md b/solutions/security/configure-elastic-defend/prevent-elastic-agent-uninstallation.md index ac27bcf7ad..75b7fe47ad 100644 --- a/solutions/security/configure-elastic-defend/prevent-elastic-agent-uninstallation.md +++ b/solutions/security/configure-elastic-defend/prevent-elastic-agent-uninstallation.md @@ -24,7 +24,7 @@ When enabled, {{agent}} and {{elastic-endpoint}} can only be uninstalled on the :::: -:::{image} ../../../images/security-agent-tamper-protection.png +:::{image} /solutions/images/security-agent-tamper-protection.png :alt: Agent tamper protection setting highlighted on Agent policy settings page :screenshot: ::: diff --git a/solutions/security/dashboards.md b/solutions/security/dashboards.md index a2f1b9ecd5..c174461c92 100644 --- a/solutions/security/dashboards.md +++ b/solutions/security/dashboards.md @@ -20,7 +20,7 @@ To create a new custom dashboard, click **Create Dashboard**. You can control wh To create a new tag or edit existing tags, open the **Tags** menu and click **Manage tags**. -:::{image} ../../images/security-dashboards-landing-page.png +:::{image} /solutions/images/security-dashboards-landing-page.png :alt: The dashboards landing page ::: diff --git a/solutions/security/dashboards/cloud-native-vulnerability-management-dashboard.md b/solutions/security/dashboards/cloud-native-vulnerability-management-dashboard.md index 5361990638..3605be7d82 100644 --- a/solutions/security/dashboards/cloud-native-vulnerability-management-dashboard.md +++ b/solutions/security/dashboards/cloud-native-vulnerability-management-dashboard.md @@ -14,7 +14,7 @@ applies_to: The Cloud Native Vulnerability Management (CNVM) dashboard gives you an overview of vulnerabilities detected in your cloud infrastructure. -:::{image} ../../../images/security-vuln-management-dashboard.png +:::{image} /solutions/images/security-vuln-management-dashboard.png :alt: The CNVM dashboard ::: diff --git a/solutions/security/dashboards/cloud-security-posture-dashboard.md b/solutions/security/dashboards/cloud-security-posture-dashboard.md index bdb5e59371..4830bd466d 100644 --- a/solutions/security/dashboards/cloud-security-posture-dashboard.md +++ b/solutions/security/dashboards/cloud-security-posture-dashboard.md @@ -16,7 +16,7 @@ applies_to: The Cloud Security Posture dashboard summarizes your cloud infrastructure’s overall performance against [security guidelines](/solutions/security/cloud/benchmarks.md) defined by the Center for Internet Security (CIS). To start collecting this data, refer to [Get started with Cloud Security Posture Management](/solutions/security/cloud/get-started-with-cspm-for-aws.md) or [Get started with Kubernetes Security Posture Management](/solutions/security/cloud/get-started-with-kspm.md). -:::{image} ../../../images/security-cloud-sec-dashboard.png +:::{image} /solutions/images/security-cloud-sec-dashboard.png :alt: The cloud Security dashboard :screenshot: ::: @@ -44,7 +44,7 @@ The remaining summary cards show your overall compliance score, and your complia Below the summary section, each row shows the CSP for a benchmark that applies to your monitored cloud resources. For example, if you are monitoring GCP and Azure cloud accounts, a row appears for CIS GCP and another appears for CIS Azure. Each row shows the CIS benchmark, the number of cloud accounts it applies to, its overall compliance score, and its compliance score grouped by CIS section. -:::{image} ../../../images/security-cloud-sec-dashboard-individual-row.png +:::{image} /solutions/images/security-cloud-sec-dashboard-individual-row.png :alt: A row representing a single cluster in the Cloud Security Posture dashboard :screenshot: ::: diff --git a/solutions/security/dashboards/data-quality-dashboard.md b/solutions/security/dashboards/data-quality-dashboard.md index 836415dd9c..97b3fc6d7c 100644 --- a/solutions/security/dashboards/data-quality-dashboard.md +++ b/solutions/security/dashboards/data-quality-dashboard.md @@ -12,7 +12,7 @@ applies_to: The Data Quality dashboard shows you whether your data is correctly mapped to the [Elastic Common Schema](ecs://reference/index.md) (ECS). Successful [mapping](/manage-data/data-store/mapping.md) enables you to search, visualize, and interact with your data throughout {{elastic-sec}} and {{kib}}. -:::{image} ../../../images/security-data-qual-dash.png +:::{image} /solutions/images/security-data-qual-dash.png :alt: The Data Quality dashboard :screenshot: ::: @@ -79,7 +79,7 @@ Click a node in the treemap to expand the corresponding index. After an index is checked, a **Pass** or **Fail** status appears. **Fail** indicates mapping problems in an index. To view index check details, including which fields weren’t successfully mapped, click the **Check now** button under **Actions**. -:::{image} ../../../images/security-data-qual-dash-detail.png +:::{image} /solutions/images/security-data-qual-dash-detail.png :alt: An expanded index with some failed results in the Data Quality dashboard :screenshot: ::: @@ -96,7 +96,7 @@ Fields in the **Same family** category have the correct search behavior, but mig You can review an index’s data quality history by clicking **View history** under **Actions**, or by clicking the **History** tab in the details flyout. You can filter the results by time and **Pass** / **Fail** status. Click a historical check to expand it and view more details. -:::{image} ../../../images/security-data-qual-dash-history.png +:::{image} /solutions/images/security-data-qual-dash-history.png :alt: The Data Quality dashboard ::: diff --git a/solutions/security/dashboards/detection-response-dashboard.md b/solutions/security/dashboards/detection-response-dashboard.md index c331e5432a..e1c34912d4 100644 --- a/solutions/security/dashboards/detection-response-dashboard.md +++ b/solutions/security/dashboards/detection-response-dashboard.md @@ -12,7 +12,7 @@ applies_to: The Detection & Response dashboard provides focused visibility into the day-to-day operations of your security environment. It helps security operations managers and analysts quickly monitor recent and high priority detection alerts and cases, and identify the hosts and users associated with alerts. -:::{image} ../../../images/security-detection-response-dashboard.png +:::{image} /solutions/images/security-detection-response-dashboard.png :alt: Overview of Detection & Response dashboard :screenshot: ::: @@ -20,7 +20,7 @@ The Detection & Response dashboard provides focused visibility into the day-to-d Interact with various dashboard elements: * Use the date and time picker in the upper-right to specify a time range for displaying information on the dashboard. -* In sections that list alert counts, click a number to view the alerts on the Alerts page. Hover over the number and select **Investigate in timeline** (![Investigate in timeline icon](../../../images/security-timeline-button-osquery.png "title =20x20")) to open the alerts in Timeline. +* In sections that list alert counts, click a number to view the alerts on the Alerts page. Hover over the number and select **Investigate in timeline** (![Investigate in timeline icon](/solutions/images/security-timeline-button-osquery.png "title =20x20")) to open the alerts in Timeline. * Click the name of a detection rule, case, host, or user to open its details page. The following sections are included: diff --git a/solutions/security/dashboards/detection-rule-monitoring-dashboard.md b/solutions/security/dashboards/detection-rule-monitoring-dashboard.md index dfc452fea5..34afad7a7f 100644 --- a/solutions/security/dashboards/detection-rule-monitoring-dashboard.md +++ b/solutions/security/dashboards/detection-rule-monitoring-dashboard.md @@ -12,7 +12,7 @@ applies_to: The Detection rule monitoring dashboard provides visualizations to help you monitor the overall health and performance of {{elastic-sec}}'s detection rules. Consult this dashboard for a high-level view of whether your rules are running successfully and how long they’re taking to run, search data, and create alerts. -:::{image} ../../../images/security-rule-monitoring-overview.png +:::{image} /solutions/images/security-rule-monitoring-overview.png :alt: Overview of Detection rule monitoring dashboard :screenshot: ::: @@ -47,7 +47,7 @@ The following visualizations are included: ## Visualization panel actions [rule-visualization-actions] -Open a panel’s options menu (![Options menu](../../../images/security-three-dot-icon.png "title =20x20")) customize the panel or use its data for further analysis and investigation: +Open a panel’s options menu (![Options menu](/solutions/images/security-three-dot-icon.png "title =20x20")) customize the panel or use its data for further analysis and investigation: * **Edit panel settings**: Customize the panel’s display settings. Options vary by visualization type. * **Inspect**: Examine the panel’s underlying data and queries. diff --git a/solutions/security/dashboards/entity-analytics-dashboard.md b/solutions/security/dashboards/entity-analytics-dashboard.md index 50779fb0ca..c7d4c846a1 100644 --- a/solutions/security/dashboards/entity-analytics-dashboard.md +++ b/solutions/security/dashboards/entity-analytics-dashboard.md @@ -26,7 +26,7 @@ The dashboard includes the following sections: * [Entities](/solutions/security/dashboards/entity-analytics-dashboard.md#entity-entities) * [Anomalies](/solutions/security/dashboards/entity-analytics-dashboard.md#entity-anomalies) -:::{image} ../../../images/security-entity-dashboard.png +:::{image} /solutions/images/security-entity-dashboard.png :alt: Entity dashboard :screenshot: ::: @@ -47,7 +47,7 @@ To display user risk scores, you must [turn on the risk scoring engine](/solutio Displays user risk score data for your environment, including the total number of users, and the five most recently recorded user risk scores, with their associated user names, risk data, and number of detection alerts. Like host risk scores, user risk scores are calculated using a weighted sum on a scale of 0 (lowest) to 100 (highest). -:::{image} ../../../images/security-user-score-data.png +:::{image} /solutions/images/security-user-score-data.png :alt: User risk table :screenshot: ::: @@ -58,7 +58,7 @@ Interact with the table to filter data, view more details, and take action: * Click a user name link to open the user details flyout. * Hover over a user name link to display inline actions: **Add to timeline**, which adds the selected value to Timeline, and **Copy to Clipboard**, which copies the user name value for you to paste later. * Click **View all** in the upper-right to display all user risk information on the Users page. -* Click the number link in the **Alerts** column to view the alerts on the Alerts page. Hover over the number and select **Investigate in timeline** (![Investigate in timeline icon](../../../images/security-timeline-button-osquery.png "title =20x20")) to launch Timeline with a query that includes the associated user name value. +* Click the number link in the **Alerts** column to view the alerts on the Alerts page. Hover over the number and select **Investigate in timeline** (![Investigate in timeline icon](/solutions/images/security-timeline-button-osquery.png "title =20x20")) to launch Timeline with a query that includes the associated user name value. For more information about user risk scores, refer to [Entity risk scoring](/solutions/security/advanced-entity-analytics/entity-risk-scoring.md). @@ -72,7 +72,7 @@ To display host risk scores, you must [turn on the risk scoring engine](/solutio Displays host risk score data for your environment, including the total number of hosts, and the five most recently recorded host risk scores, with their associated host names, risk data, and number of detection alerts. Host risk scores are calculated using a weighted sum on a scale of 0 (lowest) to 100 (highest). -:::{image} ../../../images/security-host-score-data.png +:::{image} /solutions/images/security-host-score-data.png :alt: Host risk scores table :screenshot: ::: @@ -83,7 +83,7 @@ Interact with the table to filter data, view more details, and take action: * Click a host name link to open the host details flyout. * Hover over a host name link to display inline actions: **Add to timeline**, which adds the selected value to Timeline, and **Copy to Clipboard**, which copies the host name value for you to paste later. * Click **View all** in the upper-right to display all host risk information on the Hosts page. -* Click the number link in the **Alerts** column to view the alerts on the Alerts page. Hover over the number and select **Investigate in timeline** (![Investigate in timeline icon](../../../images/security-timeline-button-osquery.png "title =20x20")) to launch Timeline with a query that includes the associated host name value. +* Click the number link in the **Alerts** column to view the alerts on the Alerts page. Hover over the number and select **Investigate in timeline** (![Investigate in timeline icon](/solutions/images/security-timeline-button-osquery.png "title =20x20")) to launch Timeline with a query that includes the associated host name value. For more information about host risk scores, refer to [Entity risk scoring](/solutions/security/advanced-entity-analytics/entity-risk-scoring.md). @@ -107,7 +107,7 @@ The **Entities** table only shows a subset of the data available for each entity :::: -:::{image} ../../../images/security-entities-section.png +:::{image} /solutions/images/security-entities-section.png :alt: Entities section :screenshot: ::: @@ -124,7 +124,7 @@ Interact with the table to filter data and view more details: * Select the **Risk level** dropdown to filter the table by the selected user or host risk level. * Select the **Criticality** dropdown to filter the table by the selected asset criticality level. * Select the **Source** dropdown to filter the table by the data source. -* Click the **View details** icon (![View details icon](../../../images/security-view-details-icon.png "title =20x20")) to open the entity details flyout. +* Click the **View details** icon (![View details icon](/solutions/images/security-view-details-icon.png "title =20x20")) to open the entity details flyout. ## Anomalies [entity-anomalies] @@ -136,7 +136,7 @@ To display anomaly results, you must [install and run](/explore-analyze/machine- :::: -:::{image} ../../../images/security-anomalies-table.png +:::{image} /solutions/images/security-anomalies-table.png :alt: Anomalies table :screenshot: ::: diff --git a/solutions/security/dashboards/overview-dashboard.md b/solutions/security/dashboards/overview-dashboard.md index ca1abca8a8..c681f67f00 100644 --- a/solutions/security/dashboards/overview-dashboard.md +++ b/solutions/security/dashboards/overview-dashboard.md @@ -12,7 +12,7 @@ applies_to: The Overview dashboard provides a high-level snapshot of alerts and events. It helps you assess overall system health and find anomalies that may require further investigation. -:::{image} ../../../images/security-overview-pg.png +:::{image} /solutions/images/security-overview-pg.png :alt: Overview dashboard ::: @@ -26,7 +26,7 @@ The **Security news** section provides the latest {{elastic-sec}} news to help y :::: -:::{image} ../../../images/security-live-feed-ov-page.png +:::{image} /solutions/images/security-live-feed-ov-page.png :alt: Overview dashboard with live feed section highlighted ::: @@ -35,14 +35,14 @@ The **Security news** section provides the latest {{elastic-sec}} news to help y Time-based histograms show the number of detections, alerts, and events that have occurred within the selected time range. To focus on a particular time, click and drag to select a time range, or choose a preset value. The **Stack by** menu lets you select which field is used to organize the data. For example, in the Alert trend histogram, stack by `kibana.alert.rule.name` to display alert counts by rule name within the specified time frame. -Hover over histograms, graphs, and tables to display an **Inspect** button (![Inspect icon](../../../images/security-inspect-icon.png "title =20x20")) or options menu (![Three-dot menu icon](../../../images/security-three-dot-icon.png "title =20x20")). Click to inspect the visualization’s {{es}} queries, add it to a new or existing case, or open it in Lens for customization. +Hover over histograms, graphs, and tables to display an **Inspect** button (![Inspect icon](/solutions/images/security-inspect-icon.png "title =20x20")) or options menu (![Three-dot menu icon](/solutions/images/security-three-dot-icon.png "title =20x20")). Click to inspect the visualization’s {{es}} queries, add it to a new or existing case, or open it in Lens for customization. ## Host and network events [_host_and_network_events] View event and host counts grouped by data source, such as **Auditbeat** or **{{elastic-defend}}**. Expand a category to view specific counts of host or network events from the selected source. -:::{image} ../../../images/security-events-count.png +:::{image} /solutions/images/security-events-count.png :alt: Host and network events on the Overview dashboard :screenshot: ::: @@ -59,7 +59,7 @@ For more information about connecting to threat intelligence sources, visit [Ena :::: -:::{image} ../../../images/security-threat-intelligence-view.png +:::{image} /solutions/images/security-threat-intelligence-view.png :alt: threat intelligence view :screenshot: ::: diff --git a/solutions/security/detect-and-alert.md b/solutions/security/detect-and-alert.md index 201c94e8b5..ecfeea2ee4 100644 --- a/solutions/security/detect-and-alert.md +++ b/solutions/security/detect-and-alert.md @@ -12,7 +12,7 @@ applies_to: Use the detection engine to create and manage rules and view the alerts these rules create. Rules periodically search indices (such as `logs-*` and `filebeat-*`) for suspicious source events and create alerts when a rule’s conditions are met. When an alert is created, its status is `Open`. To help track investigations, an alert’s [status](/solutions/security/detect-and-alert/manage-detection-alerts.md#detection-alert-status) can be set as `Open`, `Acknowledged`, or `Closed`. -:::{image} ../../images/security-alert-page.png +:::{image} /solutions/images/security-alert-page.png :alt: Alerts page :screenshot: ::: diff --git a/solutions/security/detect-and-alert/about-building-block-rules.md b/solutions/security/detect-and-alert/about-building-block-rules.md index bd3fd4cd97..11120db0bd 100644 --- a/solutions/security/detect-and-alert/about-building-block-rules.md +++ b/solutions/security/detect-and-alert/about-building-block-rules.md @@ -20,7 +20,7 @@ Create building block rules when you do not want to see their generated alerts i To create a rule that searches alert indices, select **Index Patterns** as the rule’s **Source** and enter the index pattern for alert indices (`.alerts-security.alerts-*`): -:::{image} ../../../images/security-alert-indices-ui.png +:::{image} /solutions/images/security-alert-indices-ui.png :alt: alert indices ui :screenshot: ::: diff --git a/solutions/security/detect-and-alert/about-detection-rules.md b/solutions/security/detect-and-alert/about-detection-rules.md index cade3f9ea0..496f498c85 100644 --- a/solutions/security/detect-and-alert/about-detection-rules.md +++ b/solutions/security/detect-and-alert/about-detection-rules.md @@ -44,7 +44,7 @@ You can create the following types of rules: :::: -:::{image} ../../../images/security-all-rules.png +:::{image} /solutions/images/security-all-rules.png :alt: Shows the Rules page :screenshot: ::: diff --git a/solutions/security/detect-and-alert/add-detection-alerts-to-cases.md b/solutions/security/detect-and-alert/add-detection-alerts-to-cases.md index e5133eea1f..985578ac69 100644 --- a/solutions/security/detect-and-alert/add-detection-alerts-to-cases.md +++ b/solutions/security/detect-and-alert/add-detection-alerts-to-cases.md @@ -19,7 +19,7 @@ From the Alerts table, you can attach one or more alerts to a [new case](/soluti :::: -:::{image} ../../../images/security-add-alert-to-case.gif +:::{image} /solutions/images/security-add-alert-to-case.gif :alt: add alert to case :screenshot: ::: @@ -45,7 +45,7 @@ To add alerts to a new case: 5. Select a connector. If you’ve previously added one, that connector displays as the default selection. Otherwise, the default setting is `No connector selected`. 6. Click **Create case** after you’ve completed all of the required fields. A confirmation message is displayed with an option to view the new case. Click the link in the notification or go to the Cases page to view the case. -:::{image} ../../../images/security-add-alert-to-new-case.png +:::{image} /solutions/images/security-add-alert-to-new-case.png :alt: add alert to new case :screenshot: ::: @@ -67,7 +67,7 @@ To add alerts to an existing case: :::: -:::{image} ../../../images/security-add-alert-to-existing-case.png +:::{image} /solutions/images/security-add-alert-to-existing-case.png :alt: Select case dialog listing existing cases :screenshot: ::: diff --git a/solutions/security/detect-and-alert/add-manage-exceptions.md b/solutions/security/detect-and-alert/add-manage-exceptions.md index 01bfb9fca3..12bd97fda9 100644 --- a/solutions/security/detect-and-alert/add-manage-exceptions.md +++ b/solutions/security/detect-and-alert/add-manage-exceptions.md @@ -42,7 +42,7 @@ You can add exceptions to a rule from the rule details page, the Alerts table, t 2. In the Rules table, search for the rule that you want to add an exception to, then click its name to open the rule details. 3. Scroll down the rule details page, select the **Rule exceptions** tab, then click **Add rule exception**. - :::{image} ../../../images/security-rule-exception-tab.png + :::{image} /solutions/images/security-rule-exception-tab.png :alt: Detail of rule exceptions tab :screenshot: ::: @@ -117,7 +117,7 @@ You can add exceptions to a rule from the rule details page, the Alerts table, t In the following example, the exception was created from the Rules page and prevents the rule from generating alerts when the `svchost.exe` process runs on hostname `siem-kibana`. - :::{image} ../../../images/security-add-exception-ui.png + :::{image} /solutions/images/security-add-exception-ui.png :alt: add exception ui :screenshot: ::: @@ -190,7 +190,7 @@ Additionally, to add an Endpoint exception to an endpoint protection rule, there The **Add Endpoint Exception** flyout opens. - :::{image} ../../../images/security-endpoint-add-exp.png + :::{image} /solutions/images/security-endpoint-add-exp.png :alt: endpoint add exp :screenshot: ::: @@ -203,7 +203,7 @@ Additionally, to add an Endpoint exception to an endpoint protection rule, there ::::{note} - * Fields with conflicts are marked with a warning icon (![Field conflict warning icon](../../../images/security-field-warning-icon.png "title =20x20")). Using these fields might cause unexpected exceptions behavior. For more information, refer to [Troubleshooting type conflicts and unmapped fields](../../../troubleshoot/security/detection-rules.md#rule-exceptions-field-conflicts). + * Fields with conflicts are marked with a warning icon (![Field conflict warning icon](/solutions/images/security-field-warning-icon.png "title =20x20")). Using these fields might cause unexpected exceptions behavior. For more information, refer to [Troubleshooting type conflicts and unmapped fields](../../../troubleshoot/security/detection-rules.md#rule-exceptions-field-conflicts). * The `is one of` and `is not one of` operators support identical, case-sensitive values. For example, if you want to match the values `Windows` and `windows`, add both values to the **Value** field. :::: @@ -272,7 +272,7 @@ Only these objects require nested conditions to ensure the exception functions c Creates an exception that excludes all LFC-signed trusted processes: -:::{image} ../../../images/security-nested-exp.png +:::{image} /solutions/images/security-nested-exp.png :alt: nested exp :screenshot: ::: @@ -287,7 +287,7 @@ To view a rule’s exceptions: From the list, you can filter, edit, and delete exceptions. You can also toggle between **Active exceptions** and **Expired exceptions**. - :::{image} ../../../images/security-manage-default-rule-list.png + :::{image} /solutions/images/security-manage-default-rule-list.png :alt: A default rule list :screenshot: ::: @@ -303,7 +303,7 @@ Changes that you make to the exception also apply to other rules that use the ex :::: -:::{image} ../../../images/security-exception-affects-multiple-rules.png +:::{image} /solutions/images/security-exception-affects-multiple-rules.png :alt: Exception that affects multiple rules :screenshot: ::: diff --git a/solutions/security/detect-and-alert/create-detection-rule.md b/solutions/security/detect-and-alert/create-detection-rule.md index aa14ef7353..787cbd61d9 100644 --- a/solutions/security/detect-and-alert/create-detection-rule.md +++ b/solutions/security/detect-and-alert/create-detection-rule.md @@ -57,12 +57,12 @@ Additional configuration is required for detection rules using cross-cluster sea Searches the `winlogbeat-*` indices for `vssadmin.exe` executions with the `delete` and `shadow` arguments, which are used to delete a volume’s shadow copies. - :::{image} ../../../images/security-rule-query-example.png + :::{image} /solutions/images/security-rule-query-example.png :alt: Rule query example :screenshot: ::: - 3. You can use {{kib}} saved queries (![Saved query menu](../../../images/security-saved-query-menu.png "title =20x20")) and queries from saved Timelines (**Import query from saved Timeline**) as rule conditions. + 3. You can use {{kib}} saved queries (![Saved query menu](/solutions/images/security-saved-query-menu.png "title =20x20")) and queries from saved Timelines (**Import query from saved Timeline**) as rule conditions. When you use a saved query, the **Load saved query "*query name*" dynamically on each rule execution** check box appears: @@ -127,7 +127,7 @@ To create or edit {{ml}} rules, you need: 2. Use the filter and query fields to create the criteria used for detecting alerts. ::::{note} - You can use {{kib}} saved queries (![Saved query menu](../../../images/security-saved-query-menu.png "title =20x20")) and queries from saved Timelines (**Import query from saved Timeline**) as rule conditions. + You can use {{kib}} saved queries (![Saved query menu](/solutions/images/security-saved-query-menu.png "title =20x20")) and queries from saved Timelines (**Import query from saved Timeline**) as rule conditions. :::: 3. Use the **Group by** and **Threshold** fields to determine which source event field is used as a threshold and the threshold’s value. @@ -194,7 +194,7 @@ To create or edit {{ml}} rules, you need: Searches the `winlogbeat-*` indices for sequences of a `msxsl.exe` process start event followed by an outbound network connection event that was started by the `msxsl.exe` process. - :::{image} ../../../images/security-eql-rule-query-example.png + :::{image} /solutions/images/security-eql-rule-query-example.png :alt: eql rule query example :screenshot: ::: @@ -203,7 +203,7 @@ To create or edit {{ml}} rules, you need: For sequence events, the {{security-app}} generates a single alert when all events listed in the sequence are detected. To see the matched sequence events in more detail, you can view the alert in the Timeline, and, if all events came from the same process, open the alert in Analyze Event view. :::: -3. (Optional) Click the EQL settings icon (![EQL settings icon](../../../images/security-eql-settings-icon.png "title =20x20")) to configure additional fields used by [EQL search](/explore-analyze/query-filter/languages/eql.md#specify-a-timestamp-or-event-category-field): +3. (Optional) Click the EQL settings icon (![EQL settings icon](/solutions/images/security-eql-settings-icon.png "title =20x20")) to configure additional fields used by [EQL search](/explore-analyze/query-filter/languages/eql.md#specify-a-timestamp-or-event-category-field): * **Event category field**: Contains the event classification, such as `process`, `file`, or `network`. This field is typically mapped as a field type in the [keyword family](elasticsearch://reference/elasticsearch/mapping-reference/keyword.md). Defaults to the `event.category` ECS field. * **Tiebreaker field**: Sets a secondary field for sorting events (in ascending, lexicographic order) if they have the same timestamp. @@ -268,7 +268,7 @@ To create or edit {{ml}} rules, you need: For example, to create a rule that generates alerts when `host.name` **and** `destination.ip` field values in the `logs-*` or `packetbeat-*` {{elastic-sec}} indices are identical to the corresponding field values in the `mock-threat-list` indicator index, enter the rule parameters seen in the following image: - :::{image} ../../../images/security-indicator-rule-example.png + :::{image} /solutions/images/security-indicator-rule-example.png :alt: Indicator match rule settings :screenshot: ::: @@ -314,7 +314,7 @@ You uploaded a value list of known ransomware domains, and you want to be notifi :::: -:::{image} ../../../images/security-indicator_value_list.png +:::{image} /solutions/images/security-indicator_value_list.png :alt: indicator value list :screenshot: ::: @@ -371,7 +371,7 @@ To create an {{esql}} rule: ::::{tip} - Click the help icon (![Click the ES|QL help icon](../../../images/security-esql-help-ref-button.png "title =20x20")) to open the in-product reference documentation for all {{esql}} commands and functions. + Click the help icon (![Click the ES|QL help icon](/solutions/images/security-esql-help-ref-button.png "title =20x20")) to open the in-product reference documentation for all {{esql}} commands and functions. :::: 3. (Optional) Use **Suppress alerts by** to reduce the number of repeated or duplicate alerts created by the rule. Refer to [Suppress detection alerts](/solutions/security/detect-and-alert/suppress-detection-alerts.md) for more information. @@ -514,7 +514,7 @@ When configuring an {{esql}} rule’s **[Custom highlighted fields](/solutions/s 4. **Severity override** (optional): Select to use source event values to override the **Default severity** in generated alerts. When selected, a UI component is displayed where you can map the source event field values to severity levels. The following example shows how to map severity levels to `host.name` values: - :::{image} ../../../images/security-severity-mapping-ui.png + :::{image} /solutions/images/security-severity-mapping-ui.png :alt: severity mapping ui :screenshot: ::: @@ -532,7 +532,7 @@ When configuring an {{esql}} rule’s **[Custom highlighted fields](/solutions/s 6. **Risk score override** (optional): Select to use a source event value to override the **Default risk score** in generated alerts. When selected, a UI component is displayed to select the source field used for the risk score. For example, if you want to use the source event’s risk score in alerts: - :::{image} ../../../images/security-risk-source-field-ui.png + :::{image} /solutions/images/security-risk-source-field-ui.png :alt: risk source field ui :screenshot: ::: @@ -600,7 +600,7 @@ When configuring an {{esql}} rule’s **[Custom highlighted fields](/solutions/s 2. Click **Continue**. The **Schedule rule** pane is displayed. - :::{image} ../../../images/security-schedule-rule.png + :::{image} /solutions/images/security-schedule-rule.png :alt: schedule rule :screenshot: ::: @@ -665,7 +665,7 @@ To use actions for alert notifications, you need the [appropriate license](https 4. Complete the required connector type fields. Here is an example with {{jira}}: - :::{image} ../../../images/security-selected-action-type.png + :::{image} /solutions/images/security-selected-action-type.png :alt: selected action type :screenshot: ::: @@ -801,7 +801,7 @@ To preview rules, you must have the appropriate user role. Refer to [Detections Click the **Rule preview** button while creating or editing a rule. The preview opens in a side panel, showing a histogram and table with the alerts you can expect, based on the defined rule settings and past events in your indices. -:::{image} ../../../images/security-preview-rule.png +:::{image} /solutions/images/security-preview-rule.png :alt: Rule preview :screenshot: ::: @@ -818,11 +818,11 @@ To interact with the rule preview: * Click **Refresh** to update the preview. - * When you edit the rule’s settings or the preview’s time range, the button changes from blue (![Blue circular refresh icon](../../../images/security-rule-preview-refresh-circle.png "title =20x20")) to green (![Green right-pointing arrow refresh icon](../../../images/security-rule-preview-refresh-arrow.png "title =20x20")) to indicate that the rule has been edited since the last preview. + * When you edit the rule’s settings or the preview’s time range, the button changes from blue (![Blue circular refresh icon](/solutions/images/security-rule-preview-refresh-circle.png "title =20x20")) to green (![Green right-pointing arrow refresh icon](/solutions/images/security-rule-preview-refresh-arrow.png "title =20x20")) to indicate that the rule has been edited since the last preview. * For a relative time range (such as `Last 1 hour`), refresh the preview to check for the latest results. (Previews don’t automatically refresh with new incoming data.) -* Click the **View details** icon (![View details icon](../../../images/security-view-details-icon.png "title =20x20")) in the alerts table to view the details of a particular alert. -* To resize the preview, hover between the rule settings and preview, then click and drag the border. You can also click the border, then the collapse icon (![Collapse icon](../../../images/security-collapse-right-icon.png "title =20x20")) to collapse and expand the preview. +* Click the **View details** icon (![View details icon](/solutions/images/security-view-details-icon.png "title =20x20")) in the alerts table to view the details of a particular alert. +* To resize the preview, hover between the rule settings and preview, then click and drag the border. You can also click the border, then the collapse icon (![Collapse icon](/solutions/images/security-collapse-right-icon.png "title =20x20")) to collapse and expand the preview. * To close the preview, click the **Rule preview** button again. diff --git a/solutions/security/detect-and-alert/create-manage-shared-exception-lists.md b/solutions/security/detect-and-alert/create-manage-shared-exception-lists.md index f0e707b065..224f53c33d 100644 --- a/solutions/security/detect-and-alert/create-manage-shared-exception-lists.md +++ b/solutions/security/detect-and-alert/create-manage-shared-exception-lists.md @@ -19,7 +19,7 @@ Shared exception lists allow you to group exceptions together and then apply the % :::: -:::{image} ../../../images/security-rule-exceptions-page.png +:::{image} /solutions/images/security-rule-exceptions-page.png :alt: Shared Exception Lists page :screenshot: ::: @@ -109,7 +109,7 @@ Apply shared exception lists to rules: 2. Scroll down the page, and then select the **Rule exceptions** tab. 3. Navigate to the exception items that are included in the shared exception list. Click the **Affects shared list** link to view the associated shared exception lists. - :::{image} ../../../images/security-associated-shared-exception-list.png + :::{image} /solutions/images/security-associated-shared-exception-list.png :alt: Associated shared exceptions :screenshot: ::: @@ -128,7 +128,7 @@ The Shared Exception Lists page displays each shared exception list on an indivi To view the details of an exception item within a shared exception list, expand a row. -:::{image} ../../../images/security-view-filter-shared-exception.png +:::{image} /solutions/images/security-view-filter-shared-exception.png :alt: Associated shared exceptions :screenshot: ::: @@ -160,7 +160,7 @@ To export or delete an exception list, select the required action button on the * If an exception list is linked to any rules, you’ll get a warning asking you to confirm the deletion. * If an exception list contains expired exceptions, you can choose whether to include them in the exported file. -:::{image} ../../../images/security-actions-exception-list.png +:::{image} /solutions/images/security-actions-exception-list.png :alt: Detail of Exception lists table with export and delete buttons highlighted :screenshot: ::: diff --git a/solutions/security/detect-and-alert/create-manage-value-lists.md b/solutions/security/detect-and-alert/create-manage-value-lists.md index fce45c7552..a18d0b0cb9 100644 --- a/solutions/security/detect-and-alert/create-manage-value-lists.md +++ b/solutions/security/detect-and-alert/create-manage-value-lists.md @@ -48,7 +48,7 @@ To create a value list: 2. Find **Detection rules (SIEM)** in the navigation menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). 3. Click **Manage value lists**. The **Manage value lists** window opens. - :::{image} ../../../images/security-upload-lists-ui.png + :::{image} /solutions/images/security-upload-lists-ui.png :alt: Manage value lists flyout :screenshot: ::: @@ -78,11 +78,11 @@ You can edit, remove, or export existing value lists. * **Add individual items to the list**: Click **Create list item**, enter a value, then click **Add list item**. * **Bulk upload list items**: Drag or select the `csv` or `txt` file that contains the values that you want to add, then click **Upload**. - * **Edit a value**: In the Value column, go to the value you want to edit and click the **Edit** button (![Edit button from Manage value lists window](../../../images/security-edit-value-list-item.png "title =20x20")). When you’re done editing, click the **Save** button (![Save button from Manage value lists window](../../../images/security-save-value-list-item-changes.png "title =30x30")) to save your changes. Click the **Cancel** button (![Cancel button from Manage value lists window](../../../images/security-cancel-value-list-item-changes.png "title =30x30")) to revert your changes. - * **Remove a value**: Click the **Remove value** button (![Remove value list button from Manage value lists window](../../../images/security-remove-value-list-item.png "title =20x20")) to delete a value from the list. + * **Edit a value**: In the Value column, go to the value you want to edit and click the **Edit** button (![Edit button from Manage value lists window](/solutions/images/security-edit-value-list-item.png "title =20x20")). When you’re done editing, click the **Save** button (![Save button from Manage value lists window](/solutions/images/security-save-value-list-item-changes.png "title =30x30")) to save your changes. Click the **Cancel** button (![Cancel button from Manage value lists window](/solutions/images/security-cancel-value-list-item-changes.png "title =30x30")) to revert your changes. + * **Remove a value**: Click the **Remove value** button (![Remove value list button from Manage value lists window](/solutions/images/security-remove-value-list-item.png "title =20x20")) to delete a value from the list. -:::{image} ../../../images/security-edit-value-lists.png +:::{image} /solutions/images/security-edit-value-lists.png :alt: Manage items in a value lists :screenshot: ::: @@ -97,10 +97,10 @@ You can also edit value lists while creating and managing exceptions that use va 2. Click **Manage value lists**. The **Manage value lists** window opens. 3. From the **Value lists** table, you can: - 1. Click the **Export value list** button (![Export button from Manage value lists window](../../../images/security-export-value-list.png "title =20x20")) to export the value list. - 2. Click the **Remove value list** button (![Remove button from Manage value lists window](../../../images/security-remove-value-list.png "title =20x20")) to delete the value list. + 1. Click the **Export value list** button (![Export button from Manage value lists window](/solutions/images/security-export-value-list.png "title =20x20")) to export the value list. + 2. Click the **Remove value list** button (![Remove button from Manage value lists window](/solutions/images/security-remove-value-list.png "title =20x20")) to delete the value list. - :::{image} ../../../images/security-manage-value-list.png + :::{image} /solutions/images/security-manage-value-list.png :alt: Import value list flyout with action buttons highlighted :screenshot: ::: diff --git a/solutions/security/detect-and-alert/cross-cluster-search-detection-rules.md b/solutions/security/detect-and-alert/cross-cluster-search-detection-rules.md index 9b44670efb..f0dc1c5e56 100644 --- a/solutions/security/detect-and-alert/cross-cluster-search-detection-rules.md +++ b/solutions/security/detect-and-alert/cross-cluster-search-detection-rules.md @@ -30,14 +30,14 @@ This section explains the general process for setting up cross-cluster search in For example, if the remote cluster’s name is `remote-security-data` and you want to query the `logs-*` indices, include both the `logs-*` and `remote-security-data:logs-*` index patterns and assign them the `read` privilege. - :::{image} ../../../images/security-ccs-local-role.png + :::{image} /solutions/images/security-ccs-local-role.png :alt: Local cluster role configuration :screenshot: ::: 2. **Remote cluster role**: Assign the `read` and `read_cross_cluster` privileges to the indices you want to search. You don’t need to include the remote cluster’s name here. - :::{image} ../../../images/security-ccs-remote-role.png + :::{image} /solutions/images/security-ccs-remote-role.png :alt: Remote cluster role configuration :screenshot: ::: @@ -54,7 +54,7 @@ This section explains the general process for setting up cross-cluster search in 2. As this user, [configure a rule](create-detection-rule.md) that searches the remote indices: create or edit a rule, then enter the `:` pattern in the **Source** section. - :::{image} ../../../images/security-ccs-rule-source.png + :::{image} /solutions/images/security-ccs-rule-source.png :alt: Rule source configuration :screenshot: ::: diff --git a/solutions/security/detect-and-alert/install-manage-elastic-prebuilt-rules.md b/solutions/security/detect-and-alert/install-manage-elastic-prebuilt-rules.md index 5aa1a4786b..299f669e7f 100644 --- a/solutions/security/detect-and-alert/install-manage-elastic-prebuilt-rules.md +++ b/solutions/security/detect-and-alert/install-manage-elastic-prebuilt-rules.md @@ -35,7 +35,7 @@ Follow these guidelines to start using the {{security-app}}'s [prebuilt rules](s The badge next to **Add Elastic rules** shows the number of prebuilt rules available for installation. - :::{image} ../../../images/security-prebuilt-rules-add-badge.png + :::{image} /solutions/images/security-prebuilt-rules-add-badge.png :alt: The Add Elastic Rules page :screenshot: ::: @@ -49,15 +49,15 @@ Follow these guidelines to start using the {{security-app}}'s [prebuilt rules](s 3. Do one of the following: * Install all available rules: Click **Install all** at the top of the page. (This doesn’t enable the rules; you still need to do that manually.) - * Install a single rule: In the rules table, either click **Install** to install a rule without enabling it, or click ![Vertical boxes button](../../../images/security-boxesVertical.svg "") → **Install and enable** to start running the rule once it’s installed. - * Install multiple rules: Select the rules, and then at the top of the page either click **Install *x* selected rule(s)** to install without enabling the rules, or click ![Vertical boxes button](../../../images/serverless-boxesVertical.svg "") → **Install and enable** to install and start running the rules. + * Install a single rule: In the rules table, either click **Install** to install a rule without enabling it, or click ![Vertical boxes button](/solutions/images/security-boxesVertical.svg "") → **Install and enable** to start running the rule once it’s installed. + * Install multiple rules: Select the rules, and then at the top of the page either click **Install *x* selected rule(s)** to install without enabling the rules, or click ![Vertical boxes button](/solutions/images/serverless-boxesVertical.svg "") → **Install and enable** to install and start running the rules. ::::{tip} Use the search bar and **Tags** filter to find the rules you want to install. For example, filter by `OS: Windows` if your environment only includes Windows endpoints. For more on tag categories, refer to [Prebuilt rule tags](/solutions/security/detect-and-alert/install-manage-elastic-prebuilt-rules.md#prebuilt-rule-tags). :::: - :::{image} ../../../images/security-prebuilt-rules-add.png + :::{image} /solutions/images/security-prebuilt-rules-add.png :alt: The Add Elastic Rules page :screenshot: ::: @@ -119,7 +119,7 @@ Elastic regularly updates prebuilt rules to optimize their performance and ensur :::: - :::{image} ../../../images/security-prebuilt-rules-update.png + :::{image} /solutions/images/security-prebuilt-rules-update.png :alt: The Rule Updates tab on the Rules page :screenshot: ::: @@ -130,7 +130,7 @@ Elastic regularly updates prebuilt rules to optimize their performance and ensur To accept the changes and install the updated version, select **Update**. - :::{image} ../../../images/security-prebuilt-rules-update-diff.png + :::{image} /solutions/images/security-prebuilt-rules-update-diff.png :alt: Prebuilt rule comparison :screenshot: ::: diff --git a/solutions/security/detect-and-alert/launch-timeline-from-investigation-guides.md b/solutions/security/detect-and-alert/launch-timeline-from-investigation-guides.md index 635ba79ff0..40ee36dbe0 100644 --- a/solutions/security/detect-and-alert/launch-timeline-from-investigation-guides.md +++ b/solutions/security/detect-and-alert/launch-timeline-from-investigation-guides.md @@ -12,21 +12,21 @@ applies_to: Detection rule investigation guides suggest steps for triaging, analyzing, and responding to potential security issues. For custom rules, you can create an interactive investigation guide that includes buttons for launching runtime queries in [Timeline](/solutions/security/investigate/timeline.md), using alert data and hard-coded literal values. This allows you to start detailed Timeline investigations directly from an alert using relevant data. -:::{image} ../../../images/security-ig-alert-flyout.png +:::{image} /solutions/images/security-ig-alert-flyout.png :alt: Alert details flyout with interactive investigation guide :screenshot: ::: Under the Investigation section, click **Show investigation guide** to open the **Investigation** tab in the left panel of the alert details flyout. -:::{image} ../../../images/security-ig-alert-flyout-invest-tab.png +:::{image} /solutions/images/security-ig-alert-flyout-invest-tab.png :alt: Alert details flyout with interactive investigation guide :screenshot: ::: The **Investigation** tab displays query buttons, and each query button displays the number of event documents found. Click the query button to automatically load the query in Timeline, based on configuration settings in the investigation guide. -:::{image} ../../../images/security-ig-timeline.png +:::{image} /solutions/images/security-ig-timeline.png :alt: Timeline with query pre-loaded from investigation guide action :screenshot: ::: @@ -43,14 +43,14 @@ You can configure an interactive investigation guide when you [create a new rule 1. When configuring the rule’s settings (the **About rule** step for a new rule, or the **About** tab for an existing rule), expand the **Advanced settings**, then scroll down to the **Investigation guide** Markdown editor. - :::{image} ../../../images/security-ig-investigation-guide-editor.png + :::{image} /solutions/images/security-ig-investigation-guide-editor.png :alt: Investigation guide editor field :screenshot: ::: -2. Place the editor cursor where you want to add the query button in the investigation guide, then select the Investigate icon (![Investigate icon](../../../images/security-ig-investigate-icon.png "title =20x20")) in the toolbar. The **Add investigation query** builder form appears. +2. Place the editor cursor where you want to add the query button in the investigation guide, then select the Investigate icon (![Investigate icon](/solutions/images/security-ig-investigate-icon.png "title =20x20")) in the toolbar. The **Add investigation query** builder form appears. - :::{image} ../../../images/security-ig-investigation-query-builder.png + :::{image} /solutions/images/security-ig-investigation-query-builder.png :alt: Add investigation guide UI :screenshot: ::: @@ -63,7 +63,7 @@ You can configure an interactive investigation guide when you [create a new rule To use a field value from the alert as a query parameter, enter the field name surrounded by double curly brackets — such as `{{kibana.alert.example}}` — as a custom option for the filter value. - :::{image} ../../../images/security-ig-filters-field-custom-value.png + :::{image} /solutions/images/security-ig-filters-field-custom-value.png :alt: Add investigation guide UI :screenshot: ::: @@ -92,7 +92,7 @@ The following syntax defines a query button in an interactive investigation guid | `relativeFrom`, `relativeTo` | (Optional) The start and end, respectively, of the relative time range for the query. Times are relative to the alert’s creation time, represented as `now` in [date math](elasticsearch://reference/elasticsearch/rest-apis/common-options.md#date-math) format. For example, selecting **Last 15 minutes** in the query builder form creates the syntax `"relativeFrom": "now-15m", "relativeTo": "now"`. | ::::{note} -Some characters must be escaped with a backslash, such as `\"` for a quotation mark and `\\` for a literal backslash. Divide Windows paths with double backslashes (for example, `C:\\Windows\\explorer.exe`), and paths that already include double backslashes might require four backslashes for each divider. A clickable error icon (![Error icon](../../../images/security-ig-error-icon.png "title =20x20")) displays below the Markdown editor if there are any syntax errors. +Some characters must be escaped with a backslash, such as `\"` for a quotation mark and `\\` for a literal backslash. Divide Windows paths with double backslashes (for example, `C:\\Windows\\explorer.exe`), and paths that already include double backslashes might require four backslashes for each divider. A clickable error icon (![Error icon](/solutions/images/security-ig-error-icon.png "title =20x20")) displays below the Markdown editor if there are any syntax errors. :::: @@ -121,7 +121,7 @@ This example creates the following Timeline query, as illustrated below: `(event.id : )`
`OR (event.action : "rename" AND process.pid : )` -:::{image} ../../../images/security-ig-timeline-query.png +:::{image} /solutions/images/security-ig-timeline-query.png :alt: Timeline query :screenshot: ::: @@ -131,7 +131,7 @@ This example creates the following Timeline query, as illustrated below: When viewing an interactive investigation guide in contexts unconnected to a specific alert (such a rule’s details page), queries open as [Timeline templates](/solutions/security/investigate/timeline-templates.md), and `parameter` fields are treated as Timeline template fields. -:::{image} ../../../images/security-ig-timeline-template-fields.png +:::{image} /solutions/images/security-ig-timeline-template-fields.png :alt: Timeline template :screenshot: ::: diff --git a/solutions/security/detect-and-alert/manage-detection-alerts.md b/solutions/security/detect-and-alert/manage-detection-alerts.md index 2af767d9fd..46810b7be6 100644 --- a/solutions/security/detect-and-alert/manage-detection-alerts.md +++ b/solutions/security/detect-and-alert/manage-detection-alerts.md @@ -12,7 +12,7 @@ applies_to: The Alerts page displays all detection alerts. From the Alerts page, you can filter alerts, view alerting trends, change the status of alerts, add alerts to cases, and start investigating and analyzing alerts. -:::{image} ../../../images/security-alert-page.png +:::{image} /solutions/images/security-alert-page.png :alt: Alerts page overview :screenshot: ::: @@ -24,7 +24,7 @@ The Alerts page offers various ways for you to organize and triage detection ale * View an alert’s details. Click the **View details** button from the Alerts table to open the alert details flyout. Learn more at [View detection alert details](/solutions/security/detect-and-alert/view-detection-alert-details.md). - :::{image} ../../../images/security-view-alert-details.png + :::{image} /solutions/images/security-view-alert-details.png :alt: View details button :screenshot: ::: @@ -37,7 +37,7 @@ The Alerts page offers various ways for you to organize and triage detection ale * Visualize and group alerts by specific fields in the visualization section. Use the buttons on the left to select a view type (**Summary**, **Trend**, **Counts**, or **Treemap**), and use the menus on the right to select the ECS fields used for grouping alerts. Refer to [Visualize detection alerts](/solutions/security/detect-and-alert/visualize-detection-alerts.md) for more on each view type. * Hover over a value to display available [inline actions](/solutions/security/get-started/elastic-security-ui.md#inline-actions), such as **Filter In**, **Filter Out**, and **Add to timeline**. Click the expand icon for more options, including **Show top *x*** and **Copy to Clipboard**. The available options vary based on the type of data. - :::{image} ../../../images/security-inline-actions-menu.png + :::{image} /solutions/images/security-inline-actions-menu.png :alt: Inline additional actions menu :screenshot: ::: @@ -49,7 +49,7 @@ The Alerts page offers various ways for you to organize and triage detection ale :::: - :::{image} ../../../images/security-additional-filters.png + :::{image} /solutions/images/security-additional-filters.png :alt: Alerts table with Additional filters menu highlighted :screenshot: ::: @@ -61,7 +61,7 @@ The Alerts page offers various ways for you to organize and triage detection ale By default, the drop-down controls on the Alerts page filter alerts by **Status**, **Severity**, **User**, and **Host**. You can edit them to filter by different fields, as well as remove, add, and reorder them if you prefer a different order. -:::{image} ../../../images/security-alert-page-dropdown-controls.png +:::{image} /solutions/images/security-alert-page-dropdown-controls.png :alt: Alerts page with drop-down controls highlighted :screenshot: ::: @@ -75,13 +75,13 @@ By default, the drop-down controls on the Alerts page filter alerts by **Status* :::: -1. Click the three-dot icon next to the controls (![More actions](../../../images/security-three-dot-icon-blue.png "title =20x20")), then select **Edit Controls**. +1. Click the three-dot icon next to the controls (![More actions](/solutions/images/security-three-dot-icon-blue.png "title =20x20")), then select **Edit Controls**. 2. Do any of the following: - * To reorder controls, click and drag a control by its handle (![Reorder](../../../images/security-handle-icon.png "title =20x20")). - * To remove a control, hover over it and select **Remove control** (![Remove](../../../images/security-red-x-icon.png "title =20x20")). - * To edit a control, hover over it and select **Edit control** (![Edit](../../../images/security-pencil-icon.png "title =20x20")). - * To add a new control, click **Add Controls** (![Add](../../../images/security-add-icon-blue.png "title =20x20")). If you already have four controls, you must first remove one to make room for the new one. + * To reorder controls, click and drag a control by its handle (![Reorder](/solutions/images/security-handle-icon.png "title =20x20")). + * To remove a control, hover over it and select **Remove control** (![Remove](/solutions/images/security-red-x-icon.png "title =20x20")). + * To edit a control, hover over it and select **Edit control** (![Edit](/solutions/images/security-pencil-icon.png "title =20x20")). + * To add a new control, click **Add Controls** (![Add](/solutions/images/security-add-icon-blue.png "title =20x20")). If you already have four controls, you must first remove one to make room for the new one. 3. If you’re editing or adding a control, do the following in the configuration flyout that opens: @@ -89,7 +89,7 @@ By default, the drop-down controls on the Alerts page filter alerts by **Status* 2. Enter a **Label** to identify the control. 3. Click **Save and close**. -4. Click **Save pending changes** (![Save](../../../images/security-save-icon-blue.png "title =20x20")). +4. Click **Save pending changes** (![Save](/solutions/images/security-save-icon-blue.png "title =20x20")). ## Group alerts [group-alerts] @@ -98,7 +98,7 @@ You can group alerts by rule name, user name, host name, source IP address, or a Select up to three fields for grouping alerts. The groups will nest in the order you selected them, and the nesting order is displayed above the table next to **Group alerts by**. -:::{image} ../../../images/security-group-alerts.png +:::{image} /solutions/images/security-group-alerts.png :alt: Alerts table with Group alerts by drop-down :screenshot: ::: @@ -108,9 +108,9 @@ Each group displays information such as the alerts' severity and how many users, To interact with grouped alerts: * Select the **Take actions** menu to perform a bulk action on all alerts in a group, such as [changing their status](/solutions/security/detect-and-alert/manage-detection-alerts.md#detection-alert-status). -* Click a group’s name or the expand icon (![Grouped alerts expand](../../../images/security-expand-icon-vertical-right.png "title =20x20")) to display alerts within that group. You can filter and customize this view like any other alerts table. +* Click a group’s name or the expand icon (![Grouped alerts expand](/solutions/images/security-expand-icon-vertical-right.png "title =20x20")) to display alerts within that group. You can filter and customize this view like any other alerts table. - :::{image} ../../../images/security-group-alerts-expand.png + :::{image} /solutions/images/security-group-alerts-expand.png :alt: Expanded alert group with alerts table :screenshot: ::: @@ -127,7 +127,7 @@ Use the toolbar buttons in the upper-left of the Alerts table to customize the c Click the **Full screen** button in the upper-right to view the table in full-screen mode. -:::{image} ../../../images/security-alert-table-toolbar-buttons.png +:::{image} /solutions/images/security-alert-table-toolbar-buttons.png :alt: Alerts table with toolbar buttons highlighted :screenshot: ::: @@ -137,7 +137,7 @@ Use the view options drop-down in the upper-right of the Alerts table to control * **Grid view**: Displays alerts in a traditional table view with columns for each field * **Event rendered view**: Display alerts in a descriptive event flow that includes relevant details and context about the event. -:::{image} ../../../images/security-event-rendered-view.png +:::{image} /solutions/images/security-event-rendered-view.png :alt: Alerts table with the Event rendered view enabled :screenshot: ::: @@ -176,7 +176,7 @@ To change an alert’s status, do one of the following: * In the Alerts table, click **More actions** (**…​**) in the alert’s row, then select a status. * In the Alerts table, select the alerts you want to change, click **Selected *x* alerts** at the upper-left above the table, and then select a status. - :::{image} ../../../images/security-alert-change-status.png + :::{image} /solutions/images/security-alert-change-status.png :alt: Bulk action menu with multiple alerts selected :screenshot: ::: @@ -210,7 +210,7 @@ To apply or remove alert tags on individual alerts, do one of the following: To apply or remove alert tags on multiple alerts, select the alerts you want to change, then click **Selected *x* alerts** at the upper-left above the table. Click **Apply alert tags**, select or unselect tags, then click **Apply tags**. -:::{image} ../../../images/security-bulk-apply-alert-tag.png +:::{image} /solutions/images/security-bulk-apply-alert-tag.png :alt: Bulk action menu with multiple alerts selected :screenshot: ::: @@ -234,14 +234,14 @@ Users are not notified when they’ve been assigned to, or unassigned from, aler Show users that have been assigned to alerts by adding the **Assignees** column to the Alerts table (**Fields** → `kibana.alert.workflow_assignee_ids`). Up to four assigned users can appear in the **Assignees** column. If an alert is assigned to five or more users, a number appears instead. -:::{image} ../../../images/security-alert-assigned-alerts.png +:::{image} /solutions/images/security-alert-assigned-alerts.png :alt: Alert assignees in the Alerts table :screenshot: ::: Assigned users are automatically displayed in the alert details flyout. Up to two assigned users can be shown in the flyout. If an alert is assigned to three or more users, a numbered badge displays instead. -:::{image} ../../../images/security-alert-flyout-assignees.png +:::{image} /solutions/images/security-alert-flyout-assignees.png :alt: Alert assignees in the alert details flyout :screenshot: ::: @@ -251,7 +251,7 @@ Assigned users are automatically displayed in the alert details flyout. Up to tw Click the **Assignees** filter above the Alerts table, then select the users you want to filter by. -:::{image} ../../../images/security-alert-filter-assigned-alerts.png +:::{image} /solutions/images/security-alert-filter-assigned-alerts.png :alt: Filtering assigned alerts :screenshot: ::: @@ -270,14 +270,14 @@ For information about exceptions and how to use them, refer to [Add and manage e * To view a single alert in Timeline, click the **Investigate in timeline** button in the Alerts table. Alternatively, select **Take action** → **Investigate in timeline** in the alert details flyout. - :::{image} ../../../images/security-timeline-button.png + :::{image} /solutions/images/security-timeline-button.png :alt: Investigate in timeline button :screenshot: ::: * To view multiple alerts in Timeline (up to 2,000), select the checkboxes next to the alerts, then click **Selected *x* alerts** → **Investigate in timeline**. - :::{image} ../../../images/security-bulk-add-alerts-to-timeline.png + :::{image} /solutions/images/security-bulk-add-alerts-to-timeline.png :alt: Bulk add alerts to timeline button ::: diff --git a/solutions/security/detect-and-alert/manage-detection-rules.md b/solutions/security/detect-and-alert/manage-detection-rules.md index 99bd9c5639..fde092f3f7 100644 --- a/solutions/security/detect-and-alert/manage-detection-rules.md +++ b/solutions/security/detect-and-alert/manage-detection-rules.md @@ -12,7 +12,7 @@ applies_to: The Rules page allows you to view and manage all prebuilt and custom detection rules. -:::{image} ../../../images/security-all-rules.png +:::{image} /solutions/images/security-all-rules.png :alt: The Rules page :screenshot: ::: @@ -58,7 +58,7 @@ The **Last response** column displays the current status of each rule, based on * **Failed**: The rule encountered an error that prevented it from running. For example, a {{ml}} rule whose corresponding {{ml}} job wasn’t running. * **Warning**: Nothing prevented the rule from running, but it might have returned unexpected results. For example, a custom query rule tried to search an index pattern that couldn’t be found in {{es}}. -For {{ml}} rules, an indicator icon (![Error icon from rules table](../../../images/security-rules-table-error-icon.png "title =20x20")) also appears in this column if a required {{ml}} job isn’t running. Click the icon to list the affected jobs, then click **Visit rule details page to investigate** to open the rule’s details page, where you can start the {{ml}} job. +For {{ml}} rules, an indicator icon (![Error icon from rules table](/solutions/images/security-rules-table-error-icon.png "title =20x20")) also appears in this column if a required {{ml}} job isn’t running. Click the icon to list the affected jobs, then click **Visit rule details page to investigate** to open the rule’s details page, where you can start the {{ml}} job. ## Modify existing rules settings [edit-rules-settings] @@ -175,7 +175,7 @@ You can snooze notifications temporarily or indefinitely. When actions are snooz You can snooze rule notifications from the **Installed Rules** tab, the rule details page, or the **Actions** tab when editing a rule. -:::{image} ../../../images/security-rule-snoozing.png +:::{image} /solutions/images/security-rule-snoozing.png :alt: Rules snooze options :screenshot: ::: @@ -243,14 +243,14 @@ Many detection rules are designed to work with specific [Elastic integrations](h Additionally, the **Setup guide** section provides guidance on setting up the rule’s requirements. -:::{image} ../../../images/security-rule-details-prerequisites.png +:::{image} /solutions/images/security-rule-details-prerequisites.png :alt: Rule details page with Related integrations :screenshot: ::: You can also check rules' related integrations in the **Installed Rules** and **Rule Monitoring** tables. Click the **integrations** badge to display the related integrations in a popup. -:::{image} ../../../images/security-rules-table-related-integrations.png +:::{image} /solutions/images/security-rules-table-related-integrations.png :alt: Rules table with related integrations popup :screenshot: ::: diff --git a/solutions/security/detect-and-alert/mitre-attandckr-coverage.md b/solutions/security/detect-and-alert/mitre-attandckr-coverage.md index 909dfbf23e..c7b3b78a97 100644 --- a/solutions/security/detect-and-alert/mitre-attandckr-coverage.md +++ b/solutions/security/detect-and-alert/mitre-attandckr-coverage.md @@ -24,7 +24,7 @@ You can map custom rules to tactics in **Advanced settings** when creating or ed :::: -:::{image} ../../../images/security-rules-coverage.png +:::{image} /solutions/images/security-rules-coverage.png :alt: MITRE ATT&CK® coverage page :screenshot: ::: diff --git a/solutions/security/detect-and-alert/monitor-rule-executions.md b/solutions/security/detect-and-alert/monitor-rule-executions.md index fdb121a494..07f0cc4052 100644 --- a/solutions/security/detect-and-alert/monitor-rule-executions.md +++ b/solutions/security/detect-and-alert/monitor-rule-executions.md @@ -23,7 +23,7 @@ Refer to the [Troubleshoot missing alerts](../../../troubleshoot/security/detect To view a summary of all rule executions, including the most recent failures and execution times, select the **Rule Monitoring** tab on the **Rules** page. To access the tab, find **Detection rules (SIEM)** in the navigation menu or look for “Detection rules (SIEM)” using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then go to the **Rule Monitoring** tab. -:::{image} ../../../images/security-monitor-table.png +:::{image} /solutions/images/security-monitor-table.png :alt: monitor table :screenshot: ::: @@ -44,7 +44,7 @@ Each detection rule execution is logged, including the execution type, the execu To access a rule’s execution log, click the rule’s name to open its details, then scroll down and select the **Execution results** tab. Within the Execution log table, you can click the arrow at the end of a row to expand a long warning or error message. -:::{image} ../../../images/security-rule-execution-logs.png +:::{image} /solutions/images/security-rule-execution-logs.png :alt: Execution log table on the rule execution results tab :screenshot: ::: @@ -67,7 +67,7 @@ Use these controls to filter what’s included in the logs table: * The date and time picker sets the time range of rule executions included in the table. This is separate from the global date and time picker at the top of the rule details page. * The **Source event time range** button toggles the display of data pertaining to the time range of manual runs. * The **Show metrics columns** toggle includes more or less data in the table, pertaining to the timing of each rule execution. -* The **Actions** column allows you to show alerts generated from a given rule execution. Click the filter icon (![Filter icon](../../../images/security-filter-icon.png "title =20x20")) to create a global search filter based on the rule execution’s ID value. This replaces any previously applied filters, changes the global date and time range to 24 hours before and after the rule execution, and displays a confirmation notification. You can revert this action by clicking **Restore previous filters** in the notification. +* The **Actions** column allows you to show alerts generated from a given rule execution. Click the filter icon (![Filter icon](/solutions/images/security-filter-icon.png "title =20x20")) to create a global search filter based on the rule execution’s ID value. This replaces any previously applied filters, changes the global date and time range to 24 hours before and after the rule execution, and displays a confirmation notification. You can revert this action by clicking **Restore previous filters** in the notification. ### Manual runs table [manual-runs-table] @@ -83,7 +83,7 @@ To access the table, navigate to the detection rules page, click the rule’s na To stop an active run, go to the appropriate row and click **Stop run** in the **Actions** column. Completed rule executions for each manual run are logged in the Execution log table. -:::{image} ../../../images/security-manual-rule-run-table.png +:::{image} /solutions/images/security-manual-rule-run-table.png :alt: Manual rule runs table on the rule execution results tab :screenshot: ::: diff --git a/solutions/security/detect-and-alert/rule-exceptions.md b/solutions/security/detect-and-alert/rule-exceptions.md index cd6c411ed3..24b9c265d0 100644 --- a/solutions/security/detect-and-alert/rule-exceptions.md +++ b/solutions/security/detect-and-alert/rule-exceptions.md @@ -21,7 +21,7 @@ Exceptions, also referred to as *exception items*, contain the source event cond You can create exceptions that apply exclusively to a single rule. These types of exceptions can’t be used by other rules, and you must manage them from the rule’s details page. To learn more about creating and managing single-rule exceptions, refer to [Add and manage exceptions](add-manage-exceptions.md). -:::{image} ../../../images/security-exception-item-example.png +:::{image} /solutions/images/security-exception-item-example.png :alt: An exception item :screenshot: ::: @@ -36,7 +36,7 @@ You can also use [value lists](create-manage-value-lists.md) to define exception If you want an exception to apply to multiple rules, you can add an exception to a shared exception list. Shared exception lists allow you to group exceptions together and then associate them with multiple rules. Refer to [Create and manage shared exception lists](create-manage-shared-exception-lists.md) to learn more. -:::{image} ../../../images/security-rule-exceptions-page.png +:::{image} /solutions/images/security-rule-exceptions-page.png :alt: Shared Exception Lists page :screenshot: ::: diff --git a/solutions/security/detect-and-alert/suppress-detection-alerts.md b/solutions/security/detect-and-alert/suppress-detection-alerts.md index c4d36dce5b..83da6e29fb 100644 --- a/solutions/security/detect-and-alert/suppress-detection-alerts.md +++ b/solutions/security/detect-and-alert/suppress-detection-alerts.md @@ -67,7 +67,7 @@ You can configure alert suppression when you create or edit a supported rule typ For example, if a rule runs every 5 minutes but you don’t need alerts that frequently, you can set the suppression time period to a longer time, such as 1 hour. If the rule meets its criteria, it creates an alert at that time, and for the next hour, it’ll suppress any subsequent qualifying events. - :::{image} ../../../images/security-alert-suppression-options.png + :::{image} /solutions/images/security-alert-suppression-options.png :alt: Alert suppression options ::: @@ -102,21 +102,21 @@ After an alert is moved to the `Closed` status, it will no longer suppress new a * **Alerts** table — Icon in the **Rule** column. Hover to display the number of suppressed alerts: - :::{image} ../../../images/security-suppressed-alerts-table.png + :::{image} /solutions/images/security-suppressed-alerts-table.png :alt: Suppressed alerts icon and tooltip in Alerts table :screenshot: ::: * **Alerts** table — Column for suppressed alerts count. Select **Fields** to open the fields browser, then add `kibana.alert.suppression.docs_count` to the table. - :::{image} ../../../images/security-suppressed-alerts-table-column.png + :::{image} /solutions/images/security-suppressed-alerts-table-column.png :alt: Suppressed alerts count field column in Alerts table :screenshot: ::: * Alert details flyout — **Insights** → **Correlations** section: - :::{image} ../../../images/security-suppressed-alerts-details.png + :::{image} /solutions/images/security-suppressed-alerts-details.png :alt: Suppressed alerts in the Correlations section within the alert details flyout :screenshot: ::: @@ -129,7 +129,7 @@ With alert suppression, detection alerts aren’t created for the grouped source * **Alerts** table — Select **Investigate in timeline** in the **Actions** column. - :::{image} ../../../images/security-timeline-button.png + :::{image} /solutions/images/security-timeline-button.png :alt: Investigate in timeline button :screenshot: ::: diff --git a/solutions/security/detect-and-alert/tune-detection-rules.md b/solutions/security/detect-and-alert/tune-detection-rules.md index 91b537e4f0..56352c8e9c 100644 --- a/solutions/security/detect-and-alert/tune-detection-rules.md +++ b/solutions/security/detect-and-alert/tune-detection-rules.md @@ -42,7 +42,7 @@ For example, to prevent the [Unusual Process Execution Path - Alternate Data Str The **Unusual Process Execution Path - Alternate Data Stream** rule details page is displayed. - :::{image} ../../../images/security-rule-details-page.png + :::{image} /solutions/images/security-rule-details-page.png :alt: Rule details page :screenshot: ::: @@ -54,7 +54,7 @@ For example, to prevent the [Unusual Process Execution Path - Alternate Data Str * **Operator**: `is` * **Value**: `myautomatedbuild` - :::{image} ../../../images/security-process-exception.png + :::{image} /solutions/images/security-process-exception.png :alt: Add Rule Exception UI :screenshot: ::: @@ -87,7 +87,7 @@ Another useful technique is to assign lower risk scores to rules triggered by au * Lower the `Risk score` (**Edit rule settings** → **About** tab). * Add an exception so the rule only matches the user or process name excluded in original prebuilt rules. (`user.name is not ` or `process.name is not `). - :::{image} ../../../images/security-process-specific-exception.png + :::{image} /solutions/images/security-process-specific-exception.png :alt: Example of `is not` exception in the Add Rule Exception UI :screenshot: ::: diff --git a/solutions/security/detect-and-alert/view-detection-alert-details.md b/solutions/security/detect-and-alert/view-detection-alert-details.md index abbda8d2a6..22e6f563c5 100644 --- a/solutions/security/detect-and-alert/view-detection-alert-details.md +++ b/solutions/security/detect-and-alert/view-detection-alert-details.md @@ -12,7 +12,7 @@ applies_to: To learn more about an alert, click the **View details** button from the Alerts table. This opens the alert details flyout, which helps you understand and manage the alert. -:::{image} ../../../images/security-open-alert-details-flyout.gif +:::{image} /solutions/images/security-open-alert-details-flyout.gif :alt: Expandable flyout :screenshot: ::: @@ -29,7 +29,7 @@ The alert details flyout has a right panel, a preview panel, and a left panel. E The right panel provides an overview of the alert. Expand any of the collapsed sections to learn more about the alert. You can also hover over fields on the **Overview** and **Table** tabs to display available [inline actions](/solutions/security/get-started/elastic-security-ui.md#inline-actions). -:::{image} ../../../images/security-alert-details-flyout-right-panel.png +:::{image} /solutions/images/security-alert-details-flyout-right-panel.png :alt: Right panel of the alert details flyout :screenshot: ::: @@ -37,8 +37,8 @@ The right panel provides an overview of the alert. Expand any of the collapsed s From the right panel, you can also: * Click **Expand details** to open the [left panel](/solutions/security/detect-and-alert/view-detection-alert-details.md#left-panel), which shows more information about sections in the right panel. -* Click the **Chat** icon (![AI assistant chat icon](../../../images/security-ai-assistant-chat.png "title =20x20")) to access the [AI Assistant](/solutions/security/ai/ai-assistant.md). -* Click the **Share alert** icon (![Share alert icon](../../../images/security-share-alert.png "title =20x20")) to get a shareable alert URL. We *do not* recommend copying the URL from your browser’s address bar, which can lead to inconsistent results if you’ve set up filters or relative time ranges for the Alerts page. +* Click the **Chat** icon (![AI assistant chat icon](/solutions/images/security-ai-assistant-chat.png "title =20x20")) to access the [AI Assistant](/solutions/security/ai/ai-assistant.md). +* Click the **Share alert** icon (![Share alert icon](/solutions/images/security-share-alert.png "title =20x20")) to get a shareable alert URL. We *do not* recommend copying the URL from your browser’s address bar, which can lead to inconsistent results if you’ve set up filters or relative time ranges for the Alerts page. ::::{note} For {{stack}} users only: @@ -50,14 +50,14 @@ From the right panel, you can also: If you’ve enabled grouping on the Alerts page, the alert details flyout won’t open until you expand a collapsed group and select an individual alert. :::: -* Click the **Flyout settings** icon (![Flyout settings icon](../../../images/security-flyout-settings.png "title =20x20")) to access options for displaying the alert details flyout. The **Overlay** option (which displays the flyout over the Alerts table) is selected by default. Select **Push** to display the flyout to the side of the table instead. In either display, you can resize the flyout panels to your liking. Clicking **Reset size** reverts the flyout to its default dimensions. +* Click the **Flyout settings** icon (![Flyout settings icon](/solutions/images/security-flyout-settings.png "title =20x20")) to access options for displaying the alert details flyout. The **Overlay** option (which displays the flyout over the Alerts table) is selected by default. Select **Push** to display the flyout to the side of the table instead. In either display, you can resize the flyout panels to your liking. Clicking **Reset size** reverts the flyout to its default dimensions. * Find basic details about the alert, such as the: * Associated rule * Alert status and when the alert was created * Alert severity and risk score (these are inherited from rule that generated the alert) - * Users assigned to the alert (click the **Assign alert** ![Assign alert](../../../images/security-assign-alert.png "title =20x20") icon to assign more users) - * Notes attached to the alert (click the **Add note** ![Add note](../../../images/security-add-note-icon.png "title =20x20") icon to create a new note) + * Users assigned to the alert (click the **Assign alert** ![Assign alert](/solutions/images/security-assign-alert.png "title =20x20") icon to assign more users) + * Notes attached to the alert (click the **Add note** ![Add note](/solutions/images/security-add-note-icon.png "title =20x20") icon to create a new note) * Click the **Table** or **JSON** tabs to display the alert details in table or JSON format. In table format, alert details are displayed as field-value pairs. @@ -66,7 +66,7 @@ From the right panel, you can also: Some areas in the flyout provide previews when you click on them. For example, clicking **Show rule summary** in the rule description displays a preview of the rule’s details. To close the preview, click **Back** or **x**. -:::{image} ../../../images/security-alert-details-flyout-preview-panel.gif +:::{image} /solutions/images/security-alert-details-flyout-preview-panel.gif :alt: Preview panel of the alert details flyout :screenshot: ::: @@ -78,14 +78,14 @@ The left panel provides an expanded view of what’s shown in the right panel. T * Click **Expand details** at the top of the right panel. - :::{image} ../../../images/security-expand-details-button.png + :::{image} /solutions/images/security-expand-details-button.png :alt: Expand details button at the top of the alert details flyout :screenshot: ::: * Click one of the section titles on the **Overview** tab within the right panel. - :::{image} ../../../images/security-alert-details-flyout-left-panel.png + :::{image} /solutions/images/security-alert-details-flyout-left-panel.png :alt: Left panel of the alert details flyout :screenshot: ::: @@ -96,7 +96,7 @@ The left panel provides an expanded view of what’s shown in the right panel. T The About section is located on the **Overview** tab in the right panel. It provides a brief description of the rule that’s related to the alert and an explanation of what generated the alert. -:::{image} ../../../images/security-about-section-rp.png +:::{image} /solutions/images/security-about-section-rp.png :alt: About section of the Overview tab :screenshot: ::: @@ -117,7 +117,7 @@ The About section has the following information: The Investigation section is located on the **Overview** tab in the right panel. It offers a couple of ways to begin investigating the alert. -:::{image} ../../../images/security-investigation-section-rp.png +:::{image} /solutions/images/security-investigation-section-rp.png :alt: Investigation section of the Overview tab :screenshot: ::: @@ -137,7 +137,7 @@ The Investigation section provides the following information: The Visualizations section is located on the **Overview** tab in the right panel. It offers a glimpse of the processes that led up to the alert and occurred after it. -:::{image} ../../../images/security-visualizations-section-rp.png +:::{image} /solutions/images/security-visualizations-section-rp.png :alt: Visualizations section of the Overview tab :screenshot: ::: @@ -163,14 +163,14 @@ To use the **Visualize** tab, you must turn on the `securitySolution:enableVisua The **Visualize** tab allows you to maintain the context of the Alerts table, while providing a more detailed view of alerts that you’re investigating in the event analyzer or Session View. To open the tab, click **Session viewer preview** or **Analyzer preview** from the right panel. -:::{image} ../../../images/security-visualize-tab-lp.png +:::{image} /solutions/images/security-visualize-tab-lp.png :alt: Expanded view of visualization details :screenshot: ::: As you examine the alert’s related processes, you can also preview the alerts and events which are associated with those processes. Then, if you want to learn more about a particular alert or event, you can click **Show full alert details** to open the full details flyout. -:::{image} ../../../images/security-visualize-tab-lp-alert-details.gif +:::{image} /solutions/images/security-visualize-tab-lp-alert-details.gif :alt: Examine alert details from event analyzer :screenshot: ::: @@ -180,7 +180,7 @@ As you examine the alert’s related processes, you can also preview the alerts The Insights section is located on the **Overview** tab in the right panel. It offers different perspectives from which you can assess the alert. Click **Insights** to display overviews for [related entities](/solutions/security/detect-and-alert/view-detection-alert-details.md#entities-overview), [threat intelligence](/solutions/security/detect-and-alert/view-detection-alert-details.md#threat-intelligence-overview), [correlated data](/solutions/security/detect-and-alert/view-detection-alert-details.md#correlations-overview), and [host and user prevalence](/solutions/security/detect-and-alert/view-detection-alert-details.md#prevalence-overview). -:::{image} ../../../images/security-insights-section-rp.png +:::{image} /solutions/images/security-insights-section-rp.png :alt: Insights section of the Overview tab :screenshot: ::: @@ -190,7 +190,7 @@ The Insights section is located on the **Overview** tab in the right panel. It o The Entities overview provides high-level details about the user and host that are related to the alert. Host and user risk classifications are also available with a [Platinum subscription](https://www.elastic.co/pricing) or higher in {{stack}} or the Security Analytics Complete [project feature](../../../deploy-manage/deploy/elastic-cloud/project-settings.md) in {{serverless-short}}. -:::{image} ../../../images/security-entities-overview.png +:::{image} /solutions/images/security-entities-overview.png :alt: Overview of the entity details section in the right panel :screenshot: ::: @@ -200,7 +200,7 @@ The Entities overview provides high-level details about the user and host that a From the right panel, click **Entities** to open a detailed view of the host and user associated with the alert. The expanded view also includes risk scores and classifications and activity on related hosts and users. Access to these features requires a [Platinum subscription](https://www.elastic.co/pricing) or higher in {{stack}} or the Security Analytics Complete [project feature](../../../deploy-manage/deploy/elastic-cloud/project-settings.md) in {{serverless-short}} -:::{image} ../../../images/security-expanded-entities-view.png +:::{image} /solutions/images/security-expanded-entities-view.png :alt: Expanded view of entity details :screenshot: ::: @@ -210,7 +210,7 @@ From the right panel, click **Entities** to open a detailed view of the host and The Threat intelligence overview shows matched indicators, which provide threat intelligence relevant to the alert. -:::{image} ../../../images/security-threat-intelligence-overview.png +:::{image} /solutions/images/security-threat-intelligence-overview.png :alt: Overview of threat intelligence on the alert :screenshot: ::: @@ -230,7 +230,7 @@ The expanded threat intelligence view queries indices specified in the `security :::: -:::{image} ../../../images/security-expanded-threat-intelligence-view.png +:::{image} /solutions/images/security-expanded-threat-intelligence-view.png :alt: Expanded view of threat intelligence on the alert :screenshot: ::: @@ -270,7 +270,7 @@ When searching for threat intelligence, {{elastic-sec}} queries the alert docume The Correlations overview shows how an alert is related to other alerts and offers ways to investigate related alerts. Use this information to quickly find patterns between alerts and then take action. -:::{image} ../../../images/security-correlations-overview.png +:::{image} /solutions/images/security-correlations-overview.png :alt: Overview of available correlation data :screenshot: ::: @@ -293,7 +293,7 @@ The Correlations overview provides the following information: From the right panel, click **Correlations** to open the expanded Correlations view within the left panel. -:::{image} ../../../images/security-expanded-correlations-view.png +:::{image} /solutions/images/security-expanded-correlations-view.png :alt: Expanded view of correlation data :screenshot: ::: @@ -321,7 +321,7 @@ Update the date time picker for the table to show data from a different time ran :::: -:::{image} ../../../images/security-expanded-prevalence-view.png +:::{image} /solutions/images/security-expanded-prevalence-view.png :alt: Expanded view of prevalence data :screenshot: ::: @@ -343,7 +343,7 @@ The following features require a [Platinum subscription](https://www.elastic.co/ The **Response** section is located on the **Overview** tab in the right panel. It shows [response actions](/solutions/security/detect-and-alert/create-detection-rule.md) that were added to the rule associated with the alert. Click **Response** to display the response action’s results in the left panel. -:::{image} ../../../images/security-response-action-rp.png +:::{image} /solutions/images/security-response-action-rp.png :alt: Response section of the Overview tab :screenshot: ::: @@ -358,7 +358,7 @@ Go to the **Notes** [page](/solutions/security/investigate/notes.md#manage-notes :::: -:::{image} ../../../images/security-notes-tab-lp.png +:::{image} /solutions/images/security-notes-tab-lp.png :alt: Notes tab in the left panel :screenshot: ::: diff --git a/solutions/security/detect-and-alert/visualize-detection-alerts.md b/solutions/security/detect-and-alert/visualize-detection-alerts.md index 537286b308..57f8950096 100644 --- a/solutions/security/detect-and-alert/visualize-detection-alerts.md +++ b/solutions/security/detect-and-alert/visualize-detection-alerts.md @@ -12,7 +12,7 @@ applies_to: Visualize and group detection alerts by specific parameters in the visualization section of the Alerts page. -:::{image} ../../../images/security-alert-page-visualizations.png +:::{image} /solutions/images/security-alert-page-visualizations.png :alt: Alerts page with visualizations section highlighted :screenshot: ::: @@ -29,16 +29,16 @@ Some view types don’t have the **Group by top** option. You can also leave **G :::: -To reset a view to default settings, hover over it and click the options menu (![More actions](../../../images/security-three-dot-icon.png "title =20x20")) that appears, then select **Reset group by fields**. +To reset a view to default settings, hover over it and click the options menu (![More actions](/solutions/images/security-three-dot-icon.png "title =20x20")) that appears, then select **Reset group by fields**. ::::{tip} The options menu also lets you inspect the visualization’s queries. For the trend and counts views, you can add the visualization to a new or existing case, or open it in Lens. :::: -Click the collapse icon (![Collapse icon](../../../images/security-collapse-icon-horiz-down.png "title =20x20")) to minimize the visualization section and display a summary of key information instead. +Click the collapse icon (![Collapse icon](/solutions/images/security-collapse-icon-horiz-down.png "title =20x20")) to minimize the visualization section and display a summary of key information instead. -:::{image} ../../../images/security-alert-page-viz-collapsed.png +:::{image} /solutions/images/security-alert-page-viz-collapsed.png :alt: Alerts page with visualizations section collapsed :screenshot: ::: @@ -54,7 +54,7 @@ On the Alerts page, the summary visualization displays by default and shows how You can hover and click on elements within the summary — such as severity levels, rule names, and host names — to add filters with those values to the Alerts page. -:::{image} ../../../images/security-alerts-viz-summary.png +:::{image} /solutions/images/security-alerts-viz-summary.png :alt: Summary visualization for alerts :screenshot: ::: @@ -69,7 +69,7 @@ The **Group by top** menu is unavailable for the trend view. :::: -:::{image} ../../../images/security-alerts-viz-trend.png +:::{image} /solutions/images/security-alerts-viz-trend.png :alt: Trend visualization for alerts :screenshot: ::: @@ -79,7 +79,7 @@ The **Group by top** menu is unavailable for the trend view. The counts view shows the count of alerts in each group. By default, it groups alerts first by detection rule name (`kibana.alert.rule.name`), then by host name (`host.name`). -:::{image} ../../../images/security-alerts-viz-counts.png +:::{image} /solutions/images/security-alerts-viz-counts.png :alt: Counts visualization for alerts :screenshot: ::: @@ -89,7 +89,7 @@ The counts view shows the count of alerts in each group. By default, it groups a The treemap view shows the distribution of alerts as nested, proportionally-sized tiles. This view can help you quickly pinpoint the most prevalent and critical alerts. -:::{image} ../../../images/security-alerts-viz-treemap.png +:::{image} /solutions/images/security-alerts-viz-treemap.png :alt: Treemap visualization for alerts :screenshot: ::: @@ -110,7 +110,7 @@ Depending on the amount of alerts, some tiles and text might be very small. Hove You can click on the treemap to narrow down the alerts displayed in both the treemap and the alerts table below. Click the label above a group to display the alerts in that group, or click an individual tile to display the alerts related to that tile. This adds filters under the KQL search bar, which you can edit or remove to further customize the view. -:::{image} ../../../images/security-treemap-click.gif +:::{image} /solutions/images/security-treemap-click.gif :alt: Animation of clicking the treemap :screenshot: ::: diff --git a/solutions/security/endpoint-response-actions.md b/solutions/security/endpoint-response-actions.md index 1749b431f0..26666e626a 100644 --- a/solutions/security/endpoint-response-actions.md +++ b/solutions/security/endpoint-response-actions.md @@ -26,7 +26,7 @@ Response actions are supported on all endpoint platforms (Linux, macOS, and Wind :::: -:::{image} ../../images/security-response-console.png +:::{image} /solutions/images/security-response-console.png :alt: Response console UI :width: 90% :screenshot: @@ -296,24 +296,24 @@ You can also get a list of commands in the [Help panel](/solutions/security/endp ## Help panel [help-panel] -Click ![Help icon](../../images/security-help-icon.png "title =20x20") **Help** in the upper-right to open the **Help** panel, which lists available response action commands and parameters as a reference. +Click ![Help icon](/solutions/images/security-help-icon.png "title =20x20") **Help** in the upper-right to open the **Help** panel, which lists available response action commands and parameters as a reference. ::::{note} This panel displays only the response actions that you have the user role or privileges to perform. :::: -:::{image} ../../images/security-response-console-help-panel.png +:::{image} /solutions/images/security-response-console-help-panel.png :alt: Help panel :width: 65% :screenshot: ::: -You can use this panel to build commands with less typing. Click the add icon (![Add icon](../../images/security-add-command-icon.png "title =20x20")) to add a command to the input area, enter any additional parameters or a comment, then press **Return** to run the command. +You can use this panel to build commands with less typing. Click the add icon (![Add icon](/solutions/images/security-add-command-icon.png "title =20x20")) to add a command to the input area, enter any additional parameters or a comment, then press **Return** to run the command. If the endpoint is running an older version of {{agent}}, some response actions may not be supported, as indicated by an informational icon and tooltip. [Upgrade {{agent}}](/reference/ingestion-tools/fleet/upgrade-elastic-agent.md) on the endpoint to be able to use the latest response actions. -:::{image} ../../images/security-response-console-unsupported-command.png +:::{image} /solutions/images/security-response-console-unsupported-command.png :alt: Unsupported response action with tooltip :width: 65% :screenshot: @@ -324,7 +324,7 @@ If the endpoint is running an older version of {{agent}}, some response actions Click **Response actions history** to display a log of the response actions performed on the endpoint, such as isolating a host or terminating a process. You can filter the information displayed in this view. Refer to [](/solutions/security/endpoint-response-actions/response-actions-history.md) for more details. -:::{image} ../../images/security-response-actions-history-console.png +:::{image} /solutions/images/security-response-actions-history-console.png :alt: Response actions history with a few past actions :width: 85% :screenshot: diff --git a/solutions/security/endpoint-response-actions/isolate-host.md b/solutions/security/endpoint-response-actions/isolate-host.md index 48a171281d..9ac7937c8e 100644 --- a/solutions/security/endpoint-response-actions/isolate-host.md +++ b/solutions/security/endpoint-response-actions/isolate-host.md @@ -29,7 +29,7 @@ Isolated hosts, however, can still send data to {{elastic-sec}}. You can also cr :::: -:::{image} ../../../images/security-isolated-host.png +:::{image} /solutions/images/security-isolated-host.png :alt: Endpoint page highlighting a host that's been isolated :screenshot: ::: @@ -49,7 +49,7 @@ All actions executed on a host are tracked in the host’s response actions hist ::::{dropdown} Isolate a host from a detection alert 1. Open a detection alert: - * From the Alerts table or Timeline: Click **View details** (![View details icon](../../../images/security-view-details-icon.png "title =20x20")). + * From the Alerts table or Timeline: Click **View details** (![View details icon](/solutions/images/security-view-details-icon.png "title =20x20")). * From a case with an attached alert: Click **Show alert details** (**>**). 2. Click **Take action → Isolate host**. @@ -108,7 +108,7 @@ Be aware that automatic host isolation can result in unintended consequences, su After the host is successfully isolated, an **Isolated** status is added to the endpoint. Active end users receive a notification that the computer has been isolated from the network: -:::{image} ../../../images/security-host-isolated-notif.png +:::{image} /solutions/images/security-host-isolated-notif.png :alt: Host isolated notification message :width: 50% :screenshot: @@ -120,7 +120,7 @@ After the host is successfully isolated, an **Isolated** status is added to the ::::{dropdown} Release a host from a detection alert 1. Open a detection alert: - * From the Alerts table or Timeline: Click **View details** (![View details icon](../../../images/security-view-details-icon.png "title =20x20")). + * From the Alerts table or Timeline: Click **View details** (![View details icon](/solutions/images/security-view-details-icon.png "title =20x20")). * From a case with an attached alert: Click **Show alert details** (**>**). 2. From the alert details flyout, click **Take action → Release host**. @@ -157,7 +157,7 @@ The response console requires the appropriate [subscription](https://www.elastic After the host is successfully released, the **Isolated** status is removed from the endpoint. Active end users receive a notification that the computer has been reconnected to the network: -:::{image} ../../../images/security-host-released-notif.png +:::{image} /solutions/images/security-host-released-notif.png :alt: Host released notification message :width: 50% :screenshot: @@ -170,7 +170,7 @@ To confirm if a host has been successfully isolated or released, check the respo Go to the **Endpoints** page, click an endpoint’s name, then click the **Response action history** tab. You can filter the information displayed in this view. Refer to [](/solutions/security/endpoint-response-actions/response-actions-history.md) for more details. -:::{image} ../../../images/security-response-actions-history-endpoint-details.png +:::{image} /solutions/images/security-response-actions-history-endpoint-details.png :alt: Response actions history page UI :width: 90% :screenshot: diff --git a/solutions/security/endpoint-response-actions/response-actions-history.md b/solutions/security/endpoint-response-actions/response-actions-history.md index c87858c695..a4688b0c2d 100644 --- a/solutions/security/endpoint-response-actions/response-actions-history.md +++ b/solutions/security/endpoint-response-actions/response-actions-history.md @@ -25,7 +25,7 @@ To access the response actions history for all endpoints, find **Response action All of these contexts contain the same information and features. The following image shows the **Response actions history** page for all endpoints: -:::{image} ../../../images/security-response-actions-history-page.png +:::{image} /solutions/images/security-response-actions-history-page.png :alt: Response actions history page UI :screenshot: ::: diff --git a/solutions/security/explore/hosts-page.md b/solutions/security/explore/hosts-page.md index 0d2dc4d27a..8aea5bb79f 100644 --- a/solutions/security/explore/hosts-page.md +++ b/solutions/security/explore/hosts-page.md @@ -12,7 +12,7 @@ applies_to: The Hosts page provides a comprehensive overview of all hosts and host-related security events. Key performance indicator (KPI) charts, data tables, and interactive widgets let you view specific data, drill down for deeper insights, and interact with Timeline for further investigation. -:::{image} ../../../images/security-hosts-ov-pg.png +:::{image} /solutions/images/security-hosts-ov-pg.png :alt: Hosts page :screenshot: ::: @@ -43,7 +43,7 @@ Beneath the KPI charts are data tables, categorized by individual tabs, which ar The tables within the **Events** and **Sessions** tabs include inline actions and several customization options. To learn more about what you can do with the data in these tables, refer to [*Manage detection alerts*](/solutions/security/detect-and-alert/manage-detection-alerts.md). -:::{image} ../../../images/security-events-table.png +:::{image} /solutions/images/security-events-table.png :alt: Events table :screenshot: ::: @@ -60,7 +60,7 @@ The host details page includes the following sections: * **Alert metrics**: The total number of alerts by severity, rule, and status (`Open`, `Acknowledged`, or `Closed`). * **Data tables**: The same data tables as on the main Hosts page, except with values for the selected host instead of all hosts. -:::{image} ../../../images/security-hosts-detail-pg.png +:::{image} /solutions/images/security-hosts-detail-pg.png :alt: Host's details page :screenshot: ::: @@ -84,7 +84,7 @@ The host details flyout includes the following sections: * [Insights](/solutions/security/explore/hosts-page.md#host-details-insights), which displays vulnerabilities findings for the host. * [Observed data](/solutions/security/explore/hosts-page.md#host-observed-data), which displays host details. -:::{image} ../../../images/security-host-details-flyout.png +:::{image} /solutions/images/security-host-details-flyout.png :alt: Host details flyout :screenshot: ::: @@ -111,7 +111,7 @@ To expand the **Host risk summary** section, click **View risk contributions**. If more than 10 alerts contributed to the risk scoring calculation, the remaining alerts' aggregate contribution score is displayed below the **Alerts** table. -:::{image} ../../../images/security-host-risk-inputs.png +:::{image} /solutions/images/security-host-risk-inputs.png :alt: Host risk inputs :screenshot: ::: @@ -121,7 +121,7 @@ If more than 10 alerts contributed to the risk scoring calculation, the remainin The **Asset Criticality** section displays the selected host’s [asset criticality level](/solutions/security/advanced-entity-analytics/asset-criticality.md). Asset criticality contributes to the overall [host risk score](/solutions/security/advanced-entity-analytics/entity-risk-scoring.md). The criticality level defines how impactful the host is when calculating the risk score. -:::{image} ../../../images/security-host-asset-criticality.png +:::{image} /solutions/images/security-host-asset-criticality.png :alt: Asset criticality :screenshot: ::: @@ -133,7 +133,7 @@ Click **Assign** to assign a criticality level to the selected host, or **Change The **Insights** section displays [Vulnerabilities Findings](/solutions/security/cloud/findings-page-3.md) for the host. Click **Vulnerabilities** to expand the flyout and view this data. -:::{image} ../../../images/security--host-details-insights-expanded.png +:::{image} /solutions/images/security--host-details-insights-expanded.png :alt: Host details flyout with the Vulnerabilities section expanded ::: @@ -142,7 +142,7 @@ The **Insights** section displays [Vulnerabilities Findings](/solutions/security This section displays details such as the host ID, when the host was first and last seen, the associated IP addresses and operating system, and the relevant Endpoint integration policy information. -:::{image} ../../../images/security-host-observed-data.png +:::{image} /solutions/images/security-host-observed-data.png :alt: Host observed data :screenshot: ::: diff --git a/solutions/security/explore/network-page.md b/solutions/security/explore/network-page.md index c77658d9d3..93931be197 100644 --- a/solutions/security/explore/network-page.md +++ b/solutions/security/explore/network-page.md @@ -12,7 +12,7 @@ applies_to: The Network page provides key network activity metrics in an interactive map, and network event tables that enable interaction with Timeline. You can drag and drop items of interest from the Network view to Timeline for further investigation. -:::{image} ../../../images/security-network-ui.png +:::{image} /solutions/images/security-network-ui.png :alt: network ui :screenshot: ::: @@ -81,7 +81,7 @@ The IP’s details page includes the following sections: * **Alert metrics**: The total number of alerts by severity, rule, and status (`Open`, `Acknowledged`, or `Closed`). * **Data tables**: The same data tables as on the main Network page, except with values for the selected IP address instead of all IP addresses. -:::{image} ../../../images/security-IP-detail-pg.png +:::{image} /solutions/images/security-IP-detail-pg.png :alt: IP details page :screenshot: ::: diff --git a/solutions/security/explore/users-page.md b/solutions/security/explore/users-page.md index 7fb6d838ac..2f98aefe95 100644 --- a/solutions/security/explore/users-page.md +++ b/solutions/security/explore/users-page.md @@ -12,7 +12,7 @@ applies_to: The Users page provides a comprehensive overview of user data to help you understand authentication and user behavior within your environment. Key performance indicator (KPI) charts, data tables, and interactive widgets let you view specific data and drill down for deeper insights. -:::{image} ../../../images/security-users-page.png +:::{image} /solutions/images/security-users-page.png :alt: User's page :screenshot: ::: @@ -54,7 +54,7 @@ The user details page includes the following sections: * **Alert metrics**: The total number of alerts by severity, rule, and status (`Open`, `Acknowledged`, or `Closed`). * **Data tables**: The same data tables as on the main Users page, except with values for the selected user instead of for all users. -:::{image} ../../../images/security-user-details-pg.png +:::{image} /solutions/images/security-user-details-pg.png :alt: User details page :screenshot: ::: @@ -78,7 +78,7 @@ The user details flyout includes the following sections: * [Insights](/solutions/security/explore/users-page.md#user-insights), which displays misconfiguration findings for the user. * [Observed data](/solutions/security/explore/users-page.md#user-observed-data), which displays user details. -:::{image} ../../../images/security-user-details-flyout.png +:::{image} /solutions/images/security-user-details-flyout.png :alt: User details flyout :screenshot: ::: @@ -105,7 +105,7 @@ To expand the **User risk summary** section, click **View risk contributions**. If more than 10 alerts contributed to the risk scoring calculation, the remaining alerts' aggregate contribution score is displayed below the **Alerts** table. -:::{image} ../../../images/security-user-risk-inputs.png +:::{image} /solutions/images/security-user-risk-inputs.png :alt: User risk inputs :screenshot: ::: @@ -115,7 +115,7 @@ If more than 10 alerts contributed to the risk scoring calculation, the remainin The **Asset Criticality** section displays the selected user’s [asset criticality level](/solutions/security/advanced-entity-analytics/asset-criticality.md). Asset criticality contributes to the overall [user risk score](/solutions/security/advanced-entity-analytics/entity-risk-scoring.md). The criticality level defines how impactful the user is when calculating the risk score. -:::{image} ../../../images/security-user-asset-criticality.png +:::{image} /solutions/images/security-user-asset-criticality.png :alt: Asset criticality :screenshot: ::: @@ -132,7 +132,7 @@ The **Insights** section displays [Misconfiguration Findings](/solutions/securit This section displays details such as the user ID, when the user was first and last seen, and the associated IP addresses and operating system. -:::{image} ../../../images/security-user-observed-data.png +:::{image} /solutions/images/security-user-observed-data.png :alt: User observed data :screenshot: ::: diff --git a/solutions/security/get-started/automatic-import.md b/solutions/security/get-started/automatic-import.md index 6f000ccae1..3045daf8f3 100644 --- a/solutions/security/get-started/automatic-import.md +++ b/solutions/security/get-started/automatic-import.md @@ -52,7 +52,7 @@ Using Automatic Import allows users to create new third-party data integrations 1. In {{elastic-sec}}, click **Add integrations**. 2. Under **Can’t find an integration?** click **Create new integration**. - :::{image} ../../../images/security-auto-import-create-new-integration-button.png + :::{image} /solutions/images/security-auto-import-create-new-integration-button.png :alt: The Integrations page with the Create new integration button highlighted ::: @@ -79,7 +79,7 @@ Using Automatic Import allows users to create new third-party data integrations 10. Click **Analyze logs**, then wait for processing to complete. This may take several minutes. 11. After processing is complete, the pipeline’s field mappings appear, including ECS and custom fields. - :::{image} ../../../images/security-auto-import-review-integration-page.png + :::{image} /solutions/images/security-auto-import-review-integration-page.png :alt: The Automatic Import Review page showing proposed field mappings ::: @@ -93,13 +93,13 @@ Using Automatic Import allows users to create new third-party data integrations :::: - :::{image} ../../../images/security-auto-import-edit-pipeline.gif + :::{image} /solutions/images/security-auto-import-edit-pipeline.gif :alt: A gif showing the user clicking the edit pipeline button and viewing the ingest pipeline flyout ::: 13. Click **Add to Elastic**. After the **Success** message appears, your new integration will be available on the Integrations page. - :::{image} ../../../images/security-auto-import-success-message.png + :::{image} /solutions/images/security-auto-import-success-message.png :alt: The automatic import success message ::: diff --git a/solutions/security/get-started/configure-advanced-settings.md b/solutions/security/get-started/configure-advanced-settings.md index 2dc8aed23e..d5bb2be110 100644 --- a/solutions/security/get-started/configure-advanced-settings.md +++ b/solutions/security/get-started/configure-advanced-settings.md @@ -40,7 +40,7 @@ Modifying advanced settings can affect Kibana performance and cause problems tha To access advanced settings, go to **Stack Management** → **Advanced Settings**, then scroll down to **Security Solution** settings. -:::{image} ../../../images/security-solution-advanced-settings.png +:::{image} /solutions/images/security-solution-advanced-settings.png :alt: solution advanced settings :screenshot: ::: diff --git a/solutions/security/get-started/create-runtime-fields-in-elastic-security.md b/solutions/security/get-started/create-runtime-fields-in-elastic-security.md index 6e10ea77d5..86c1e8cb2a 100644 --- a/solutions/security/get-started/create-runtime-fields-in-elastic-security.md +++ b/solutions/security/get-started/create-runtime-fields-in-elastic-security.md @@ -26,14 +26,14 @@ To create a runtime field: * In the Alerts table, click the **Fields** toolbar button in the table’s upper-left. From the **Fields** browser, click **Create field**. The **Create field** flyout opens. - :::{image} ../../../images/security-fields-browser.png + :::{image} /solutions/images/security-fields-browser.png :alt: Fields browser :screenshot: ::: * In Timeline, go to the bottom of the sidebar, then click **Add a field**. The **Create field** flyout opens. - :::{image} ../../../images/security-create-runtime-fields-timeline.png + :::{image} /solutions/images/security-create-runtime-fields-timeline.png :alt: Create runtime fields button in Timeline :screenshot: ::: diff --git a/solutions/security/get-started/data-views-elastic-security.md b/solutions/security/get-started/data-views-elastic-security.md index 69bcb782ef..7b43b8dd71 100644 --- a/solutions/security/get-started/data-views-elastic-security.md +++ b/solutions/security/get-started/data-views-elastic-security.md @@ -22,7 +22,7 @@ Custom indices are not included in the [default {{data-source}}](/solutions/secu You can tell which {{data-source}} is active by clicking the **{{data-source-cap}}** menu at the upper right of {{elastic-sec}} pages that display event or alert data, such as Overview, Alerts, Timelines, or Hosts. To switch to another {{data-source}}, click **Choose {{data-source}}**, select one of the options, and click **Save**. -:::{image} ../../../images/security-dataview-button-highlighted.png +:::{image} /solutions/images/security-dataview-button-highlighted.png :alt: image highlighting how to open the data view selection menu ::: @@ -35,7 +35,7 @@ To learn how to modify, create, or delete another {{data-source}} refer to [{{ki You can also temporarily modify the active {{data-source}} from the **{{data-source-cap}}** menu by clicking **Advanced options**, then adding or removing index patterns. -:::{image} ../../../images/security-dataview-filter-example.gif +:::{image} /solutions/images/security-dataview-filter-example.gif :alt: video showing how to filter the active data view ::: diff --git a/solutions/security/get-started/elastic-security-ui.md b/solutions/security/get-started/elastic-security-ui.md index 357091daa7..9e762b5828 100644 --- a/solutions/security/get-started/elastic-security-ui.md +++ b/solutions/security/get-started/elastic-security-ui.md @@ -18,37 +18,37 @@ The {{security-app}} is a highly interactive workspace designed for security ana Filter for alerts, events, processes, and other important security data by entering [{{kib}} Query Language (KQL)](/explore-analyze/query-filter/languages/kql.md) queries in the search bar, which appears at the top of each page throughout the app. A date/time filter set to `Today` is enabled by default, but can be changed to any time range. -:::{image} ../../../images/security-search-bar.png +:::{image} /solutions/images/security-search-bar.png :alt: search bar :screenshot: ::: -* To refine your search results, select **Add Filter** (![Add filter icon](../../../images/security-add-filter-icon.png "title =20x20")), then enter the field, operator (such as `is not` or `is between`), and value for your filter. -* To save the current KQL query and any applied filters, select **Saved query menu** (![Saved query menu icon](../../../images/security-saved-query-menu-icon.png "title =20x20")), enter a name for the saved query, and select **Save saved query**. +* To refine your search results, select **Add Filter** (![Add filter icon](/solutions/images/security-add-filter-icon.png "title =20x20")), then enter the field, operator (such as `is not` or `is between`), and value for your filter. +* To save the current KQL query and any applied filters, select **Saved query menu** (![Saved query menu icon](/solutions/images/security-saved-query-menu-icon.png "title =20x20")), enter a name for the saved query, and select **Save saved query**. ## Navigation menu [navigation-menu-overview] -The navigation menu contains direct links and expandable groups, identified by the group icon (![Group icon](../../../images/security-group-icon.png "title =20x20")). +The navigation menu contains direct links and expandable groups, identified by the group icon (![Group icon](/solutions/images/security-group-icon.png "title =20x20")). * Click a top-level link to go directly to its landing page, which contains links and information for related pages. -* Click a group’s icon (![Group icon](../../../images/security-group-icon.png "title =20x20")) to open its flyout menu, which displays links to related pages within that group. Click a link in the flyout to navigate to its landing page. -* Click the **Collapse side navigation** icon (![Side menu collapse icon](../../../images/security-side-button.png "title =20x20")) to collapse and expand the main navigation menu. +* Click a group’s icon (![Group icon](/solutions/images/security-group-icon.png "title =20x20")) to open its flyout menu, which displays links to related pages within that group. Click a link in the flyout to navigate to its landing page. +* Click the **Collapse side navigation** icon (![Side menu collapse icon](/solutions/images/security-side-button.png "title =20x20")) to collapse and expand the main navigation menu. ## Visualization actions [visualization-actions] -Many {{elastic-sec}} histograms, graphs, and tables display an **Inspect** button (![Inspect icon](../../../images/security-inspect-icon.png "title =20x20")) when you hover over them. Click to examine the {{es}} queries used to retrieve data throughout the app. +Many {{elastic-sec}} histograms, graphs, and tables display an **Inspect** button (![Inspect icon](/solutions/images/security-inspect-icon.png "title =20x20")) when you hover over them. Click to examine the {{es}} queries used to retrieve data throughout the app. -:::{image} ../../../images/security-inspect-icon-context.png +:::{image} /solutions/images/security-inspect-icon-context.png :alt: Inspect icon :width: 400px :screenshot: ::: -Other visualizations display an options menu (![Three-dot menu icon](../../../images/security-three-dot-icon.png "title =20x20")), which allows you to inspect the visualization’s queries, add it to a new or existing case, or open it in Lens for customization. +Other visualizations display an options menu (![Three-dot menu icon](/solutions/images/security-three-dot-icon.png "title =20x20")), which allows you to inspect the visualization’s queries, add it to a new or existing case, or open it in Lens for customization. -:::{image} ../../../images/security-viz-options-menu-open.png +:::{image} /solutions/images/security-viz-options-menu-open.png :alt: Options menu opened :width: 500px :screenshot: @@ -59,15 +59,15 @@ Other visualizations display an options menu (![Three-dot menu icon](../../../im Throughout the {{security-app}}, you can hover over many data fields and values to display inline actions, which allow you to customize your view or investigate further based on that field or value. -:::{image} ../../../images/security-inline-actions-menu.png +:::{image} /solutions/images/security-inline-actions-menu.png :alt: Inline additional actions menu :width: 500px :screenshot: ::: -In some visualizations, these actions are available in the legend by clicking a value’s options icon (![Vertical three-dot icon](../../../images/security-three-dot-icon-vertical.png "title =20x20")). +In some visualizations, these actions are available in the legend by clicking a value’s options icon (![Vertical three-dot icon](/solutions/images/security-three-dot-icon-vertical.png "title =20x20")). -:::{image} ../../../images/security-inline-actions-legend.png +:::{image} /solutions/images/security-inline-actions-legend.png :alt: Actions in a visualization legend :width: 650px :screenshot: @@ -227,7 +227,7 @@ Use your keyboard to interact with draggable elements in the Elastic Security UI * Press the `Tab` key to apply keyboard focus to an element within a table. Or, use your mouse to click on an element and apply keyboard focus to it. -:::{image} ../../../images/security-timeline-accessiblity-keyboard-focus.gif +:::{image} /solutions/images/security-timeline-accessiblity-keyboard-focus.gif :alt: timeline accessiblity keyboard focus :width: 650px :screenshot: @@ -235,7 +235,7 @@ Use your keyboard to interact with draggable elements in the Elastic Security UI * Press `Enter` on an element with keyboard focus to display its menu and press `Tab` to apply focus sequentially to menu options. The `f`, `o`, `a`, `t`, `c` hotkeys are automatically enabled during this process and offer an alternative way to interact with menu options. -:::{image} ../../../images/security-timeline-accessiblity-keyboard-focus-hotkeys.gif +:::{image} /solutions/images/security-timeline-accessiblity-keyboard-focus-hotkeys.gif :alt: timeline accessiblity keyboard focus hotkeys :width: 500px :screenshot: @@ -243,14 +243,14 @@ Use your keyboard to interact with draggable elements in the Elastic Security UI * Press the spacebar once to begin dragging an element to a different location and press it a second time to drop it. Use the directional arrows to move the element around the UI. -:::{image} ../../../images/security-timeline-ui-accessiblity-drag-n-drop.gif +:::{image} /solutions/images/security-timeline-ui-accessiblity-drag-n-drop.gif :alt: timeline ui accessiblity drag n drop :screenshot: ::: * If an event has an event renderer, press the `Shift` key and the down directional arrow to apply keyboard focus to the event renderer and `Tab` or `Shift` + `Tab` to navigate between fields. To return to the cells in the current row, press the up directional arrow. To move to the next row, press the down directional arrow. -:::{image} ../../../images/security-timeline-accessiblity-event-renderers.gif +:::{image} /solutions/images/security-timeline-accessiblity-event-renderers.gif :alt: timeline accessiblity event renderers :screenshot: ::: @@ -262,7 +262,7 @@ Use your keyboard to navigate through rows, columns, and menu options in the Ela * Use the directional arrows to move keyboard focus right, left, up, and down in a table. -:::{image} ../../../images/security-timeline-accessiblity-directional-arrows.gif +:::{image} /solutions/images/security-timeline-accessiblity-directional-arrows.gif :alt: timeline accessiblity directional arrows :width: 500px :screenshot: @@ -270,7 +270,7 @@ Use your keyboard to navigate through rows, columns, and menu options in the Ela * Press the `Tab` key to navigate through a table cell with multiple elements, such as buttons, field names, and menus. Pressing the `Tab` key will sequentially apply keyboard focus to each element in the table cell. -:::{image} ../../../images/security-timeline-accessiblity-tab-keys.gif +:::{image} /solutions/images/security-timeline-accessiblity-tab-keys.gif :alt: timeline accessiblity tab keys :width: 400px :screenshot: @@ -278,14 +278,14 @@ Use your keyboard to navigate through rows, columns, and menu options in the Ela * Use `CTRL + Home` to shift keyboard focus to the first cell in a row. Likewise, use `CTRL + End` to move keyboard focus to the last cell in the row. -:::{image} ../../../images/security-timeline-accessiblity-shifting-keyboard-focus.gif +:::{image} /solutions/images/security-timeline-accessiblity-shifting-keyboard-focus.gif :alt: timeline accessiblity shifting keyboard focus :screenshot: ::: * Use the `Page Up` and `Page Down` keys to scroll through the page. -:::{image} ../../../images/security-timeline-accessiblity-page-up-n-down.gif +:::{image} /solutions/images/security-timeline-accessiblity-page-up-n-down.gif :alt: timeline accessiblity page up n down :screenshot: ::: diff --git a/solutions/security/get-started/enable-threat-intelligence-integrations.md b/solutions/security/get-started/enable-threat-intelligence-integrations.md index 2062062e79..b015bb1f9e 100644 --- a/solutions/security/get-started/enable-threat-intelligence-integrations.md +++ b/solutions/security/get-started/enable-threat-intelligence-integrations.md @@ -22,7 +22,7 @@ To learn more about alerts with threat intelligence, visit [View alert details]( You can connect to threat intelligence sources using an [{{agent}} integration](#agent-ti-integration), the [Threat Intel module](#ti-mod-integration), or a [custom integration](#custom-ti-integration). -:::{image} ../../../images/getting-started-threat-intelligence-view.png +:::{image} /solutions/images/getting-started-threat-intelligence-view.png :alt: The Threat Intelligence view on the Overview dashboard :screenshot: ::: diff --git a/solutions/security/get-started/ingest-data-to-elastic-security.md b/solutions/security/get-started/ingest-data-to-elastic-security.md index afc3db09d5..6d9130f0f7 100644 --- a/solutions/security/get-started/ingest-data-to-elastic-security.md +++ b/solutions/security/get-started/ingest-data-to-elastic-security.md @@ -58,7 +58,7 @@ On the Integrations page, you can select the **Beats only** filter to only view :::: -:::{image} ../../../images/security-add-integrations.png +:::{image} /solutions/images/security-add-integrations.png :alt: Shows button to add integrations :screenshot: ::: diff --git a/solutions/security/investigate/add-osquery-response-actions.md b/solutions/security/investigate/add-osquery-response-actions.md index 7e2ef2f033..032e3da158 100644 --- a/solutions/security/investigate/add-osquery-response-actions.md +++ b/solutions/security/investigate/add-osquery-response-actions.md @@ -27,7 +27,7 @@ Osquery Response Actions allow you to add live queries to custom query rules so :::: -:::{image} ../../../images/security-available-response-actions-osquery.png +:::{image} /solutions/images/security-available-response-actions-osquery.png :alt: The Osquery response action :screenshot: ::: @@ -66,7 +66,7 @@ You can add Osquery Response Actions to new or existing custom query rules. Quer :::: - :::{image} ../../../images/security-setup-single-query.png + :::{image} /solutions/images/security-setup-single-query.png :alt: Shows how to set up a single query :screenshot: ::: @@ -98,7 +98,7 @@ Refer to [Examine Osquery results](/solutions/security/investigate/examine-osque :::: -:::{image} ../../../images/security-osquery-results-tab.png +:::{image} /solutions/images/security-osquery-results-tab.png :alt: Shows how to set up a single query :screenshot: ::: diff --git a/solutions/security/investigate/cases.md b/solutions/security/investigate/cases.md index 6b8fe59add..bf6f9de286 100644 --- a/solutions/security/investigate/cases.md +++ b/solutions/security/investigate/cases.md @@ -21,7 +21,7 @@ You can also send cases to these external systems by [configuring external conne * {{swimlane}} * {{webhook-cm}} -:::{image} ../../../images/security-cases-home-page.png +:::{image} /solutions/images/security-cases-home-page.png :alt: Case UI Home :screenshot: ::: diff --git a/solutions/security/investigate/configure-case-settings.md b/solutions/security/investigate/configure-case-settings.md index 4f18b0bfd7..ee4e791c6e 100644 --- a/solutions/security/investigate/configure-case-settings.md +++ b/solutions/security/investigate/configure-case-settings.md @@ -13,7 +13,7 @@ applies_to: This page explains how to change case closure options, add custom fields, templates, and connectors for external incident management systems, and create custom observable types. First, find **Cases** in the navigation menu or search for `Security/Cases` by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then click **Settings**. In {{serverless-short}}, you can access case settings in an {{elastic-sec}} project, go to **Cases** → **Settings**. -:::{image} ../../../images/security-cases-settings.png +:::{image} /solutions/images/security-cases-settings.png :alt: Shows the case settings page :screenshot: ::: @@ -91,7 +91,7 @@ You can add optional and required fields for customized case collaboration. 1. In the **Custom fields** section, click **Add field**. - :::{image} ../../../images/security-cases-add-custom-field.png + :::{image} /solutions/images/security-cases-add-custom-field.png :alt: Add a custom field in case settings :screenshot: ::: @@ -116,7 +116,7 @@ To create a template: 1. In the **Templates** section, click **Add template**. - :::{image} ../../../images/security-cases-add-template.png + :::{image} /solutions/images/security-cases-add-template.png :alt: Add a template in case settings :screenshot: ::: @@ -156,7 +156,7 @@ Deleting a custom observable type deletes all instances of it. :::: -:::{image} ../../../images/security-cases-observable-types.png +:::{image} /solutions/images/security-cases-observable-types.png :alt: Add an observable type in case settings :screenshot: ::: diff --git a/solutions/security/investigate/examine-osquery-results.md b/solutions/security/investigate/examine-osquery-results.md index 702d2f5bf5..622cf27fad 100644 --- a/solutions/security/investigate/examine-osquery-results.md +++ b/solutions/security/investigate/examine-osquery-results.md @@ -22,7 +22,7 @@ The Results table displays results from single queries and query packs. Results for single queries appear on the **Results** tab. When you run a query, the number of agents queried and query status temporarily display in a status bar above the results table. Agent responses can be `Successful`, `Not yet responded` (pending), and `Failed`. -:::{image} ../../../images/security-single-query-results.png +:::{image} /solutions/images/security-single-query-results.png :alt: Shows query results :screenshot: ::: @@ -30,9 +30,9 @@ Results for single queries appear on the **Results** tab. When you run a query, ### Query pack results [review-pack-osquery-results] -Results for each query in the pack appear in the **Results** tab. Click the expand icon (![Click markdown icon](../../../images/security-pack-expand-button-osquery.png "title =20x20")) at the far right of each query row to display query results. The number of agents that were queried and their responses are shown for each query. Agent responses are color-coded. Green is `Successful`, `Not yet responded` (pending) is gray, and `Failed` is red. +Results for each query in the pack appear in the **Results** tab. Click the expand icon (![Click markdown icon](/solutions/images/security-pack-expand-button-osquery.png "title =20x20")) at the far right of each query row to display query results. The number of agents that were queried and their responses are shown for each query. Agent responses are color-coded. Green is `Successful`, `Not yet responded` (pending) is gray, and `Failed` is red. -:::{image} ../../../images/security-pack-query-results.png +:::{image} /solutions/images/security-pack-query-results.png :alt: Shows query results :screenshot: ::: @@ -42,13 +42,13 @@ Results for each query in the pack appear in the **Results** tab. Click the expa From the results table, you can: -* Click **View in Discover** (![View in Discover button](../../../images/security-discover-button-osquery.png "title =20x20")) to explore the results in Discover. -* Click **View in Lens** (![View in Lens button](../../../images/security-lens-button-osquery.png "title =20x20")) to navigate to Lens, where you can use the drag-and-drop **Lens** editor to create visualizations. -* Click **Timeline** (![Timeline button](../../../images/security-timeline-button-osquery.png "title =20x20")) to investigate a single query result in Timeline or **Add to timeline investigation** to investigate all results. This option is only available for single query results. +* Click **View in Discover** (![View in Discover button](/solutions/images/security-discover-button-osquery.png "title =20x20")) to explore the results in Discover. +* Click **View in Lens** (![View in Lens button](/solutions/images/security-lens-button-osquery.png "title =20x20")) to navigate to Lens, where you can use the drag-and-drop **Lens** editor to create visualizations. +* Click **Timeline** (![Timeline button](/solutions/images/security-timeline-button-osquery.png "title =20x20")) to investigate a single query result in Timeline or **Add to timeline investigation** to investigate all results. This option is only available for single query results. When you open all results in Timeline, the events in Timeline are filtered based on the `action_ID` generated by the Osquery query. -* Click **Add to Case** (![Add to Case button](../../../images/security-case-button-osquery.png "title =20x20")) to add the query results to a new or existing case. If you ran a live query from an alert, the alert and query results are added to the case as comments. +* Click **Add to Case** (![Add to Case button](/solutions/images/security-case-button-osquery.png "title =20x20")) to add the query results to a new or existing case. If you ran a live query from an alert, the alert and query results are added to the case as comments. ::::{note} If you add the results to a *new* case, you are prompted to specify the solution that you want the create the case within. Ensure you select the correct solution. From {{elastic-sec}}, you cannot access cases created in {{observability}} or Stack Management. @@ -57,6 +57,6 @@ From the results table, you can: :::: -* Click the view details icon (![View details icon](../../../images/security-view-osquery-details.png "title =20x20")) to examine the query ID and statement. +* Click the view details icon (![View details icon](/solutions/images/security-view-osquery-details.png "title =20x20")) to examine the query ID and statement. * View more information about the request, such as failures, by opening the **Status** tab. diff --git a/solutions/security/investigate/indicators-of-compromise.md b/solutions/security/investigate/indicators-of-compromise.md index 050782a18b..538c016ff6 100644 --- a/solutions/security/investigate/indicators-of-compromise.md +++ b/solutions/security/investigate/indicators-of-compromise.md @@ -24,7 +24,7 @@ The Indicators page collects data from enabled threat intelligence feeds and pro :::: -:::{image} ../../../images/security-indicators-table.png +:::{image} /solutions/images/security-indicators-table.png :alt: Shows the Indicators page :screenshot: ::: @@ -56,7 +56,7 @@ Install a threat intelligence integration to add indicators to the Indicators pa After you add indicators to the Indicators page, you can [examine](#examine-indicator-details), search, filter, and take action on indicator data. Indicators also appear in the Trend view, which shows the total values in the legend. -:::{image} ../../../images/security-interact-with-indicators-table.gif +:::{image} /solutions/images/security-interact-with-indicators-table.gif :alt: interact with indicators table :screenshot: ::: @@ -75,7 +75,7 @@ Learn more about an indicator by clicking **View details**, then opening the Ind * **Table**: The indicator data in table format. * **JSON**: The indicator data in JSON format. - :::{image} ../../../images/security-indicator-details-flyout.png + :::{image} /solutions/images/security-indicator-details-flyout.png :alt: Shows the Indicator details flyout :screenshot: ::: @@ -86,7 +86,7 @@ Learn more about an indicator by clicking **View details**, then opening the Ind Investigate an indicator in [Timeline](/solutions/security/investigate/timeline.md) to identify and predict related events in your environment. You can add an indicator to Timeline from the Indicators table or the Indicator details flyout. -:::{image} ../../../images/security-indicator-query-timeline.png +:::{image} /solutions/images/security-indicator-query-timeline.png :alt: Shows the results of an indicator being investigated in Timeline :screenshot: ::: @@ -100,7 +100,7 @@ The following image shows a file hash indictor being investigated in Timeline. T `threat.indicator.file.hash.sha256 : 116dd9071887611c19c24aedde270285a4cf97157b846e6343407cf3bcec115a` -:::{image} ../../../images/security-indicator-in-timeline.png +:::{image} /solutions/images/security-indicator-in-timeline.png :alt: Shows the results of an indicator being investigated in Timeline :screenshot: ::: @@ -127,7 +127,7 @@ To add indicators to cases: The indicator is added to the case as a new comment. -:::{image} ../../../images/security-indicator-added-to-case.png +:::{image} /solutions/images/security-indicator-added-to-case.png :alt: An indicator attached to a case :screenshot: ::: @@ -156,7 +156,7 @@ When you attach an indicator to a case, the indicator is added as a new comment To remove an indicator attached to a case, click the **More actions** (**…​​**) menu → **Delete attachment** in the case comment. -:::{image} ../../../images/security-remove-indicator.png +:::{image} /solutions/images/security-remove-indicator.png :alt: Removing an indicator from a case :screenshot: ::: diff --git a/solutions/security/investigate/notes.md b/solutions/security/investigate/notes.md index e149bf2137..8ef6452b8a 100644 --- a/solutions/security/investigate/notes.md +++ b/solutions/security/investigate/notes.md @@ -22,11 +22,11 @@ You can control access to notes by setting the [{{kib}} privileges](../../../dep ## View and add notes to alerts and events [notes-alerts-events] -Open the alert or event details flyout to access the **Notes** tab, where you can view existing notes and add new ones. To quickly open the tab, click the **Add note** action (![Add note action](../../../images/security-create-note-icon.png "title =20x20")) in the Alerts or Events table. Then, enter a note into the text box, and click **Add note** to create it. +Open the alert or event details flyout to access the **Notes** tab, where you can view existing notes and add new ones. To quickly open the tab, click the **Add note** action (![Add note action](/solutions/images/security-create-note-icon.png "title =20x20")) in the Alerts or Events table. Then, enter a note into the text box, and click **Add note** to create it. After notes are created, the **Add note** icon displays a notification dot. In the details flyout for alerts, the alert summary in the right panel also shows how many notes are attached to the alert. -:::{image} ../../../images/security-new-note-alert-event.png +:::{image} /solutions/images/security-new-note-alert-event.png :alt: New note added to an alert :screenshot: ::: @@ -43,7 +43,7 @@ Open the **Notes** Timeline tab, where you can view existing notes for the Timel After notes are created, the **Notes** Timeline tab displays the total number of notes attached to the Timeline. -:::{image} ../../../images/security-new-note-timeline-tab.png +:::{image} /solutions/images/security-new-note-timeline-tab.png :alt: New note added to a Timeline :screenshot: ::: @@ -57,10 +57,10 @@ Use the **Notes** page to view and interact with all existing notes. To access t * Filter notes by the user who created them or by the object they’re attached to (notes can be attached to alerts, events, or Timelines) * Examine the contents of a note (click the text in the **Note content** column) * Delete one or more notes -* Examine the alert or event that a note is attached to (click the **Expand alert/event details** ![Preview alert or event action](../../../images/security-notes-page-document-details.png "title =20x20") icon) -* Open the Timeline that the note is attached to (click the **Open saved timeline** ![Open Timeline action](../../../images/security-notes-page-timeline-details.png "title =20x20") icon) +* Examine the alert or event that a note is attached to (click the **Expand alert/event details** ![Preview alert or event action](/solutions/images/security-notes-page-document-details.png "title =20x20") icon) +* Open the Timeline that the note is attached to (click the **Open saved timeline** ![Open Timeline action](/solutions/images/security-notes-page-timeline-details.png "title =20x20") icon) -:::{image} ../../../images/security-notes-management-page.png +:::{image} /solutions/images/security-notes-management-page.png :alt: Notes management page :screenshot: ::: diff --git a/solutions/security/investigate/open-manage-cases.md b/solutions/security/investigate/open-manage-cases.md index 08385eba61..71d11aca21 100644 --- a/solutions/security/investigate/open-manage-cases.md +++ b/solutions/security/investigate/open-manage-cases.md @@ -27,7 +27,7 @@ Open a new case to keep track of security issues and share their details with co ::::{tip} - You can insert a Timeline link in the case description by clicking the Timeline icon (![Timeline icon](../../../images/security-add-timeline-button.png "title =20x20")). + You can insert a Timeline link in the case description by clicking the Timeline icon (![Timeline icon](/solutions/images/security-add-timeline-button.png "title =20x20")). :::: 4. Optionally, add a category, assignees and relevant tags. You can add users only if they meet the necessary [prerequisites](/solutions/security/investigate/cases-requirements.md). @@ -41,7 +41,7 @@ Open a new case to keep track of security issues and share their details with co :::: -:::{image} ../../../images/security-cases-ui-open.png +:::{image} /solutions/images/security-cases-ui-open.png :alt: Shows an open case :screenshot: ::: @@ -77,7 +77,7 @@ When you subsequently add assignees to cases, they receive an email. From the Cases page, you can search existing cases and filter them by attributes such as assignees, categories, severity, status, and tags. You can also select multiple cases and use bulk actions to delete cases or change their attributes. General case metrics, including how long it takes to close cases, are provided above the table. -:::{image} ../../../images/security-cases-home-page.png +:::{image} /solutions/images/security-cases-home-page.png :alt: Case UI Home :screenshot: ::: @@ -88,7 +88,7 @@ To explore a case, click on its name. You can then: * [Add and manage comments](/solutions/security/investigate/open-manage-cases.md#cases-manage-comments) ::::{tip} - Comments can contain Markdown. For syntax help, click the Markdown icon (![Click markdown icon](../../../images/security-markdown-icon.png "title =20x20")) in the bottom right of the comment. + Comments can contain Markdown. For syntax help, click the Markdown icon (![Click markdown icon](/solutions/images/security-markdown-icon.png "title =20x20")) in the bottom right of the comment. :::: * Examine [alerts](/solutions/security/investigate/open-manage-cases.md#cases-examine-alerts) and [indicators](/solutions/security/investigate/indicators-of-compromise.md#review-indicator-in-case) attached to the case @@ -114,7 +114,7 @@ Click on an existing case to access its summary. The case summary, located under * **In progress duration**: How long the case has been in the `In progress` state * **Duration from creation to close**: Time elapsed from when the case was created to when it was closed -:::{image} ../../../images/security-cases-summary.png +:::{image} /solutions/images/security-cases-summary.png :alt: Shows you a summary of the case :screenshot: ::: @@ -124,7 +124,7 @@ Click on an existing case to access its summary. The case summary, located under To edit, delete, or quote a comment, select the appropriate option from the **More actions** menu (**…​**). -:::{image} ../../../images/security-cases-manage-comments.png +:::{image} /solutions/images/security-cases-manage-comments.png :alt: Shows you a summary of the case :screenshot: ::: @@ -134,7 +134,7 @@ To edit, delete, or quote a comment, select the appropriate option from the **Mo To explore the alerts attached to a case, click the **Alerts** tab. In the table, alerts are organized from oldest to newest. To [view alert details](/solutions/security/detect-and-alert/view-detection-alert-details.md), click the **View details** button. -:::{image} ../../../images/security-cases-alert-tab.png +:::{image} /solutions/images/security-cases-alert-tab.png :alt: Shows you the Alerts tab :screenshot: ::: @@ -149,7 +149,7 @@ Each case can have a maximum of 1,000 alerts. To upload files to a case, click the **Files** tab: -:::{image} ../../../images/security-cases-files.png +:::{image} /solutions/images/security-cases-files.png :alt: A list of files attached to a case :screenshot: ::: @@ -177,7 +177,7 @@ This functionality is in beta and is subject to change. The design and code is l Add a Lens visualization to your case to portray event and alert data through charts and graphs. -:::{image} ../../../images/security-add-vis-to-case.gif +:::{image} /solutions/images/security-add-vis-to-case.gif :alt: Shows how to add a visualization to a case :screenshot: ::: @@ -204,7 +204,7 @@ Alternatively, while viewing a [dashboard](/solutions/security/dashboards.md) yo After a visualization has been added to a case, you can modify or interact with it by clicking the **Open Visualization** option in the case’s comment menu. -:::{image} ../../../images/security-cases-open-vis.png +:::{image} /solutions/images/security-cases-open-vis.png :alt: Shows where the Open Visualization option is :screenshot: ::: @@ -243,7 +243,7 @@ Go to the **Similar cases** tab to access other cases with the same observables. :::: -:::{image} ../../../images/security-cases-add-observables.png +:::{image} /solutions/images/security-cases-add-observables.png :alt: Shows you where to add observables :screenshot: ::: @@ -253,7 +253,7 @@ Go to the **Similar cases** tab to access other cases with the same observables. Each case has a universally unique identifier (UUID) that you can copy and share. To copy a case’s UUID to a clipboard, go to the Cases page and select **Actions** → **Copy Case ID** for the case you want to share. Alternatively, go to a case’s details page, then from the **More actions** menu (…​), select **Copy Case ID**. -:::{image} ../../../images/security-cases-copy-case-id.png +:::{image} /solutions/images/security-cases-copy-case-id.png :alt: Copy Case ID option in More actions menu 30% :screenshot: ::: @@ -300,7 +300,7 @@ To export a case: :::: -:::{image} ../../../images/security-cases-export-button.png +:::{image} /solutions/images/security-cases-export-button.png :alt: Shows the export saved objects workflow :screenshot: ::: diff --git a/solutions/security/investigate/osquery.md b/solutions/security/investigate/osquery.md index 8a76aa5693..9aa1f79a86 100644 --- a/solutions/security/investigate/osquery.md +++ b/solutions/security/investigate/osquery.md @@ -59,7 +59,7 @@ To inspect hosts, run a query against one or more agents or policies, then view :::: - :::{image} ../../../images/kibana-enter-query.png + :::{image} /solutions/images/kibana-enter-query.png :alt: Select saved query dropdown name showing query name and description :screenshot: ::: @@ -72,10 +72,10 @@ To inspect hosts, run a query against one or more agents or policies, then view 7. Review the results and do any of the following: - * Click **View in Discover** (![View in Discover icon](../../../images/kibana-discover-button-osquery.png "title =20x20")) to explore the results in **Discover**. - * Click **View in Lens** (![View in Lens icon](../../../images/kibana-lens-button-osquery.png "title =20x20")) to navigate to **Lens**, where you can use the drag-and-drop **Lens** editor to create visualizations. - * Click **Add to Case** (![Add to Case icon](../../../images/kibana-case-button-osquery.png "title =20x20")) to add the query results to a new or existing case. - * Click the view details icon (![View details icon](../../../images/kibana-view-osquery-details.png "title =20x20")) to examine the query ID and statement. + * Click **View in Discover** (![View in Discover icon](/solutions/images/kibana-discover-button-osquery.png "title =20x20")) to explore the results in **Discover**. + * Click **View in Lens** (![View in Lens icon](/solutions/images/kibana-lens-button-osquery.png "title =20x20")) to navigate to **Lens**, where you can use the drag-and-drop **Lens** editor to create visualizations. + * Click **Add to Case** (![Add to Case icon](/solutions/images/kibana-case-button-osquery.png "title =20x20")) to add the query results to a new or existing case. + * Click the view details icon (![View details icon](/solutions/images/kibana-view-osquery-details.png "title =20x20")) to examine the query ID and statement. 8. To view more information about the request, such as failures, open the **Status** tab. @@ -84,10 +84,10 @@ To inspect hosts, run a query against one or more agents or policies, then view The **Live queries history** section on the **Live queries** tab shows a log of queries run over the last 30 days. From the Live queries table, you can: -* Click the run icon (![Right-pointing triangle](../../../images/kibana-play-icon.png "")) to rerun a single query or a query pack. -* Click the table icon (![Table icon](../../../images/kibana-table-icon.png "")) to examine the [results](#osquery-results) for a single query or a query pack. From the results table, you can also find the query [status](#osquery-status). +* Click the run icon (![Right-pointing triangle](/solutions/images/kibana-play-icon.png "")) to rerun a single query or a query pack. +* Click the table icon (![Table icon](/solutions/images/kibana-table-icon.png "")) to examine the [results](#osquery-results) for a single query or a query pack. From the results table, you can also find the query [status](#osquery-status). - :::{image} ../../../images/kibana-live-query-check-results.png + :::{image} /solutions/images/kibana-live-query-check-results.png :alt: Results of OSquery :screenshot: ::: @@ -142,7 +142,7 @@ You can run packs as live queries or schedule packs to run for one or more agent Details include the last time each query ran, how many results were returned, and the number of agents the query ran against. If there are errors, expand the row to view the details, including an option to view more information in the Logs. - :::{image} ../../../images/kibana-scheduled-pack.png + :::{image} /solutions/images/kibana-scheduled-pack.png :alt: Shows queries in the pack and details about each query :screenshot: ::: @@ -175,7 +175,7 @@ Once you save a query, you can only edit it from the **Saved queries** tab: 3. Click **Test configuration** to test the query and any mapped fields: - * From the **Test query** panel, select agents or groups to test the query, then click **Submit** to run a live query. Result columns with the ![mapping](../../../images/kibana-mapped-icon.png "") icon are mapped. Hover over the icon to see the mapped ECS field. + * From the **Test query** panel, select agents or groups to test the query, then click **Submit** to run a live query. Result columns with the ![mapping](/solutions/images/kibana-mapped-icon.png "") icon are mapped. Hover over the icon to see the mapped ECS field. 4. Click **Save** or **Update**. diff --git a/solutions/security/investigate/run-osquery-from-alerts.md b/solutions/security/investigate/run-osquery-from-alerts.md index 17f82228e9..194fd74aae 100644 --- a/solutions/security/investigate/run-osquery-from-alerts.md +++ b/solutions/security/investigate/run-osquery-from-alerts.md @@ -54,7 +54,7 @@ To run Osquery from an alert: :::: - :::{image} ../../../images/security-setup-query.png + :::{image} /solutions/images/security-setup-query.png :alt: Shows how to set up a single query :screenshot: ::: diff --git a/solutions/security/investigate/run-osquery-from-investigation-guides.md b/solutions/security/investigate/run-osquery-from-investigation-guides.md index a97a413e6a..ecc51ec158 100644 --- a/solutions/security/investigate/run-osquery-from-investigation-guides.md +++ b/solutions/security/investigate/run-osquery-from-investigation-guides.md @@ -28,7 +28,7 @@ Detection rule investigation guides suggest steps for triaging, analyzing, and r :::: -:::{image} ../../../images/security-osquery-investigation-guide.png +:::{image} /solutions/images/security-osquery-investigation-guide.png :alt: Shows a live query in an investigation guide :screenshot: ::: @@ -44,7 +44,7 @@ You can only add Osquery to investigation guides for custom rules because prebui 1. Go to the **Rules** page. To access it, find **Detection rules (SIEM)** in the main menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). 2. Select a rule to open the its details, then click **Edit rule settings**. 3. Select the **About** tab, then expand the rule’s advanced settings. -4. Scroll down to the Investigation guide section. In the toolbar, click the **Osquery** button (![Click the Osquery button](../../../images/security-osquery-button.png "title =20x20")). +4. Scroll down to the Investigation guide section. In the toolbar, click the **Osquery** button (![Click the Osquery button](/solutions/images/security-osquery-button.png "title =20x20")). 1. Add a descriptive label for the query; for example, `Search for executables`. 2. Select a saved query or enter a new one. @@ -60,7 +60,7 @@ You can only add Osquery to investigation guides for custom rules because prebui :::: - :::{image} ../../../images/security-setup-osquery-investigation-guide.png + :::{image} /solutions/images/security-setup-osquery-investigation-guide.png :alt: Shows results from running a query from an investigation guide :screenshot: ::: @@ -91,7 +91,7 @@ You can only add Osquery to investigation guides for custom rules because prebui 7. Click **Save for later** to save the query for future use (optional). - :::{image} ../../../images/security-run-query-investigation-guide.png + :::{image} /solutions/images/security-run-query-investigation-guide.png :alt: Shows results from running a query from an investigation guide :screenshot: ::: diff --git a/solutions/security/investigate/session-view.md b/solutions/security/investigate/session-view.md index 05f81bab5d..92c88fa727 100644 --- a/solutions/security/investigate/session-view.md +++ b/solutions/security/investigate/session-view.md @@ -49,7 +49,7 @@ Session View is accessible from the **Hosts**, **Alerts**, and **Timelines** pag * On the Alerts page, scroll down to view the Alerts table. Look for alerts that have the **Open Session View** button in the **Actions** column: - :::{image} ../../../images/security-session-view-action-icon-detail.png + :::{image} /solutions/images/security-session-view-action-icon-detail.png :alt: Detail of the Open Session View button :screenshot: ::: @@ -61,7 +61,7 @@ Session View is accessible from the **Hosts**, **Alerts**, and **Timelines** pag The Session View UI has the following features: -:::{image} ../../../images/security-session-view-terminal-labeled.png +:::{image} /solutions/images/security-session-view-terminal-labeled.png :alt: Detail of Session view with labeled UI elements :screenshot: ::: @@ -78,23 +78,23 @@ The Session View UI has the following features: Session View includes additional badges not pictured above: -* The alert badge for multiple alerts appears when a single event causes alerts of multiple types (![Gear icon](../../../images/security-sess-view-process-alert-icon.png "title =20x20") for `process` alerts, ![Page icon](../../../images/security-sess-view-file-alert-icon.png "title =20x20") for `file` alerts, and ![Page icon](../../../images/security-sess-view-network-alert-icon.png "title =20x20") for `network` alerts): +* The alert badge for multiple alerts appears when a single event causes alerts of multiple types (![Gear icon](/solutions/images/security-sess-view-process-alert-icon.png "title =20x20") for `process` alerts, ![Page icon](/solutions/images/security-sess-view-file-alert-icon.png "title =20x20") for `file` alerts, and ![Page icon](/solutions/images/security-sess-view-network-alert-icon.png "title =20x20") for `network` alerts): - :::{image} ../../../images/security-session-view-alert-types-badge.png + :::{image} /solutions/images/security-session-view-alert-types-badge.png :alt: The alert badge for a command with all three alert types :screenshot: ::: * The **Exec user change** badge highlights exec user changes, such as when a user escalates to root: - :::{image} ../../../images/security-session-view-exec-user-change-badge.png + :::{image} /solutions/images/security-session-view-exec-user-change-badge.png :alt: The Exec user change badge :screenshot: ::: * The **Output** badge appears next to commands that generated terminal output. Click it to view that command’s output in terminal output view. - :::{image} ../../../images/security-session-view-output-badge.png + :::{image} /solutions/images/security-session-view-output-badge.png :alt: The Output badge :screenshot: ::: @@ -125,7 +125,7 @@ You can configure several additional settings by clicking **Advanced settings** * `linux.advanced.tty_io.max_kilobytes_per_event`: The maximum number of kilobytes of output to send to {{es}} as a single event. Default: 512 KB. Additional data is captured as a new event. * `linux.advanced.tty_io.max_event_interval_seconds`: The maximum interval (in seconds) during which output is batched. Default: 30 seconds. Output will be sent to {{es}} at this interval (unless it first exceeds the `max_kilobytes_per_event` value, in which case it might be sent sooner). -:::{image} ../../../images/security-session-view-output-viewer.png +:::{image} /solutions/images/security-session-view-output-viewer.png :alt: Terminal output view :screenshot: ::: diff --git a/solutions/security/investigate/timeline-templates.md b/solutions/security/investigate/timeline-templates.md index d152fcc819..e200ca7ae2 100644 --- a/solutions/security/investigate/timeline-templates.md +++ b/solutions/security/investigate/timeline-templates.md @@ -50,14 +50,14 @@ When you add filters to a Timeline template, the items are color coded to indica Regular Timeline filter : Clicking **Convert to template field** changes the filter to a template filter: - :::{image} ../../../images/security-template-filter-value.png + :::{image} /solutions/images/security-template-filter-value.png :alt: Timeline template filter value :screenshot: ::: Template filter -:::{image} ../../../images/security-timeline-template-filter.png +:::{image} /solutions/images/security-timeline-template-filter.png :alt: timeline template filter :screenshot: ::: @@ -65,7 +65,7 @@ Template filter When you [convert a template to a Timeline](/solutions/security/investigate/timeline-templates.md#man-templates-ui), template filters with placeholders are disabled: -:::{image} ../../../images/security-invalid-filter.png +:::{image} /solutions/images/security-invalid-filter.png :alt: Invalid events filter :screenshot: ::: @@ -78,7 +78,7 @@ To enable the filter, either specify a value or change it to a field’s existin 1. Choose one of the following: * Find **Timelines** in the main menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Next, select the **Templates** tab, then click **Create new Timeline template**. - * Go to the Timeline bar (which is at the bottom of most pages), click the ![Click the add new button](../../../images/security-add-new-timeline-button.png "title =20x20") button, then click **Create new Timeline template**. + * Go to the Timeline bar (which is at the bottom of most pages), click the ![Click the add new button](/solutions/images/security-add-new-timeline-button.png "title =20x20") button, then click **Create new Timeline template**. * From an open Timeline or Timeline template, click **New** → **New Timeline template**. 2. To add filters, click **Add field**, and then select the required option: @@ -86,7 +86,7 @@ To enable the filter, either specify a value or change it to a field’s existin * **Add field**: Add a regular Timeline filter. * **Add template field**: Add a template filter with a value placeholder. - :::{image} ../../../images/security-create-a-timeline-template-field.png + :::{image} /solutions/images/security-create-a-timeline-template-field.png :alt: Shows an example of a Timeline template :screenshot: ::: @@ -104,7 +104,7 @@ To create a template for process-related alerts on a specific host: * Add a regular filter for the host name: `host.name: "Linux_stafordshire-061"` * Add template filter for process names: `process.name: "{process.name}"` -:::{image} ../../../images/security-template-query-example.png +:::{image} /solutions/images/security-template-query-example.png :alt: template query example :screenshot: ::: @@ -118,7 +118,7 @@ You can view, duplicate, export, delete, and create templates from existing Time 1. Find **Timelines** in the main menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then select the **Templates** tab. - :::{image} ../../../images/security-all-actions-timeline-ui.png + :::{image} /solutions/images/security-all-actions-timeline-ui.png :alt: All actions Timeline UI :screenshot: ::: diff --git a/solutions/security/investigate/timeline.md b/solutions/security/investigate/timeline.md index 8ea502a651..7d28ff4d44 100644 --- a/solutions/security/investigate/timeline.md +++ b/solutions/security/investigate/timeline.md @@ -14,7 +14,7 @@ Use Timeline as your workspace for investigations and threat hunting. You can ad You can drag or send fields of interest to a Timeline to create the desired query. For example, you can add fields from tables and histograms on the **Overview**, **Alerts**, **Hosts**, and **Network** pages, as well as from other Timelines. Alternatively, you can add a query directly in Timeline by expanding the [query builder](/solutions/security/investigate/timeline.md#narrow-expand) and clicking **+ Add field**. -:::{image} ../../../images/security-timeline-ui-updated.png +:::{image} /solutions/images/security-timeline-ui-updated.png :alt: example Timeline with several events :screenshot: ::: @@ -31,19 +31,19 @@ You can control access to Timeline by setting the [{{kib}} privileges](../../../ To make a new Timeline, choose one of the following: * Find **Timelines** in the main menu or by using the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then click **Create new Timeline**. -* Go to the Timeline bar (which is at the bottom of most pages), click the ![Add new button](../../../images/security-add-new-timeline-button.png "title =20x20") button, then click **Create new Timeline template**. +* Go to the Timeline bar (which is at the bottom of most pages), click the ![Add new button](/solutions/images/security-add-new-timeline-button.png "title =20x20") button, then click **Create new Timeline template**. * From an open Timeline or Timeline template, click **New** → **New Timeline**. To open an existing Timeline, choose one of the following: * Go to the Timelines page, then click a Timeline’s title. -* Go to the Timeline bar, click the ![Add new button](../../../images/security-add-new-timeline-button.png "title =20x20") button, then click **Open Timeline**. +* Go to the Timeline bar, click the ![Add new button](/solutions/images/security-add-new-timeline-button.png "title =20x20") button, then click **Open Timeline**. * From an open Timeline or Timeline template, click **Open**, then select the appropriate Timeline. To avoid losing your changes, you must save the Timeline before moving to a different {{security-app}} page. If you change an existing Timeline, you can use the **Save as new timeline** toggle to make a new copy of the Timeline without overwriting the original one. ::::{tip} -Click the star icon (![Favorite icon](../../../images/security-favorite-icon.png "title =20x20")) to favorite your Timeline and quickly find it later. +Click the star icon (![Favorite icon](/solutions/images/security-favorite-icon.png "title =20x20")) to favorite your Timeline and quickly find it later. :::: @@ -60,9 +60,9 @@ To further inspect an event or detection alert, click the **View details** butto ## Configure Timeline event context and display [conf-timeline-display] -Many types of events automatically appear in preconfigured views that provide relevant contextual information, called **Event renderers**. All event renderers are turned off by default. To turn them on, use the **Event renderers** toggle at the top of the results pane. To only turn on specific event renderers, click the gear (![Customize event renderer button](../../../images/security-customize-event-renderers.png "title =20x20")) icon next to the toggle, and select the ones you want enabled. Close the **Customize event renderers** pane when you’re done. Your changes are automatically applied to Timeline. +Many types of events automatically appear in preconfigured views that provide relevant contextual information, called **Event renderers**. All event renderers are turned off by default. To turn them on, use the **Event renderers** toggle at the top of the results pane. To only turn on specific event renderers, click the gear (![Customize event renderer button](/solutions/images/security-customize-event-renderers.png "title =20x20")) icon next to the toggle, and select the ones you want enabled. Close the **Customize event renderers** pane when you’re done. Your changes are automatically applied to Timeline. -:::{image} ../../../images/security-timeline-ui-renderer.png +:::{image} /solutions/images/security-timeline-ui-renderer.png :alt: example timeline with the event renderer highlighted :screenshot: ::: @@ -85,9 +85,9 @@ You can also modify a Timeline’s display in other ways: The Timeline table shows fields that are available for alerts and events in the selected data view. You can modify the table to display fields that interest you. Use the sidebar to search for specific fields or scroll through it to find fields of interest. Fields that you select display as columns in the table. -To add a field from the sidebar, hover over it, and click the **Add field as a column** button (![Add a field as a column button](../../../images/security-add-field-button.png "title =20x20")), or drag and drop the field into the table. To remove a field, hover over it, and click the **Remove field as a column** button (![Remove a field as a column button](../../../images/security-remove-field-button.png "title =20x20")). +To add a field from the sidebar, hover over it, and click the **Add field as a column** button (![Add a field as a column button](/solutions/images/security-add-field-button.png "title =20x20")), or drag and drop the field into the table. To remove a field, hover over it, and click the **Remove field as a column** button (![Remove a field as a column button](/solutions/images/security-remove-field-button.png "title =20x20")). -:::{image} ../../../images/security-timeline-sidebar.png +:::{image} /solutions/images/security-timeline-sidebar.png :alt: Shows the sidebar that allows you to configure the columns that display in Timeline :screenshot: ::: @@ -95,10 +95,10 @@ To add a field from the sidebar, hover over it, and click the **Add field as a c ## Use the Timeline query builder [narrow-expand] -Expand the query builder by clicking the query builder button (![Query builder button](../../../images/security-query-builder-button.png "title =20x20")) to the right of the KQL query bar. Drop in fields to build a query that filters Timeline results. The fields' relative placement specifies their logical relationships: horizontally adjacent filters use `AND`, while vertically adjacent filters use `OR`. +Expand the query builder by clicking the query builder button (![Query builder button](/solutions/images/security-query-builder-button.png "title =20x20")) to the right of the KQL query bar. Drop in fields to build a query that filters Timeline results. The fields' relative placement specifies their logical relationships: horizontally adjacent filters use `AND`, while vertically adjacent filters use `OR`. ::::{tip} -Collapse the query builder and provide more space for Timeline results by clicking the query builder button (![Query builder button](../../../images/security-query-builder-button.png "title =20x20")). +Collapse the query builder and provide more space for Timeline results by clicking the query builder button (![Query builder button](/solutions/images/security-query-builder-button.png "title =20x20")). :::: @@ -109,7 +109,7 @@ Collapse the query builder and provide more space for Timeline results by clicki Click a filter to access additional operations such as **Add filter**, **Clear all**, **Load saved query**, and more: -:::{image} ../../../images/security-timeline-ui-filter-options.png +:::{image} /solutions/images/security-timeline-ui-filter-options.png :alt: timeline ui filter options :screenshot: ::: @@ -119,7 +119,7 @@ Here are examples of various types of filters: Field with value : Filters for events with the specified field value: - :::{image} ../../../images/security-timeline-filter-value.png + :::{image} /solutions/images/security-timeline-filter-value.png :alt: timeline filter value :screenshot: ::: @@ -128,7 +128,7 @@ Field with value Field exists : Filters for events containing the specified field: - :::{image} ../../../images/security-timeline-field-exists.png + :::{image} /solutions/images/security-timeline-field-exists.png :alt: timeline field exists :screenshot: ::: @@ -137,7 +137,7 @@ Field exists Exclude results : Filters for events that do not contain the specified field value (`field with value` filter) or the specified field (`field exists` filter): - :::{image} ../../../images/security-timeline-filter-exclude.png + :::{image} /solutions/images/security-timeline-filter-exclude.png :alt: timeline filter exclude :screenshot: ::: @@ -146,7 +146,7 @@ Exclude results Temporarily disable : The filter is not used in the query until it is enabled again: - :::{image} ../../../images/security-timeline-disable-filter.png + :::{image} /solutions/images/security-timeline-disable-filter.png :alt: timeline disable filter :screenshot: ::: @@ -216,7 +216,7 @@ When forming EQL queries, you can write a basic query to return a list of events The following image shows what matched ordered events look like in the Timeline table. Events that belong to the same sequence are matched together in groups and shaded red or blue. Matched events are also ordered from oldest to newest in each sequence. -:::{image} ../../../images/security-correlation-tab-eql-query.png +:::{image} /solutions/images/security-correlation-tab-eql-query.png :alt: a Timeline's correlation tab :screenshot: ::: @@ -265,10 +265,10 @@ You can use {{esql}} in Timeline by opening the **{{esql}}** tab. From there, yo :::: -* Click the help icon (![ES|QL reference button](../../../images/security-esql-help-ref-button.png "title =20x20")) on the far right side of the query editor to open the in-product reference documentation for all {{esql}} commands and functions. +* Click the help icon (![ES|QL reference button](/solutions/images/security-esql-help-ref-button.png "title =20x20")) on the far right side of the query editor to open the in-product reference documentation for all {{esql}} commands and functions. * Visualize query results using [Discover](/explore-analyze/discover.md) functionality. -:::{image} ../../../images/security-esql-tab.png +:::{image} /solutions/images/security-esql-tab.png :alt: Example of the ES|QL tab in Timeline :screenshot: ::: diff --git a/solutions/security/investigate/visual-event-analyzer.md b/solutions/security/investigate/visual-event-analyzer.md index e009d3d885..3469434f17 100644 --- a/solutions/security/investigate/visual-event-analyzer.md +++ b/solutions/security/investigate/visual-event-analyzer.md @@ -49,7 +49,7 @@ To find events that can be visually analyzed: :::: - :::{image} ../../../images/security-analyze-event-button.png + :::{image} /solutions/images/security-analyze-event-button.png :alt: analyze event button :screenshot: ::: @@ -59,7 +59,7 @@ To find events that can be visually analyzed: :::: - :::{image} ../../../images/security-analyze-event-timeline.png + :::{image} /solutions/images/security-analyze-event-timeline.png :alt: analyze event timeline :screenshot: ::: @@ -81,42 +81,42 @@ To understand what fields were used to create the process, select the **Process * `ID`: Event field that uniquely identifies a node * `EDGE`: Event field which indicates the relationship between two nodes -:::{image} ../../../images/security-process-schema.png +:::{image} /solutions/images/security-process-schema.png :alt: process schema :screenshot: ::: Click the **Legend** to show the state of each process node. -:::{image} ../../../images/security-node-legend.png +:::{image} /solutions/images/security-node-legend.png :alt: node legend :screenshot: ::: Use the date and time filter to analyze the event within a specific time range. By default, the selected time range matches that of the table from which you opened the alert. -:::{image} ../../../images/security-date-range-selection.png +:::{image} /solutions/images/security-date-range-selection.png :alt: date range selection :screenshot: ::: Select a different data view to further filter the alert’s related events. -:::{image} ../../../images/security-data-view-selection.png +:::{image} /solutions/images/security-data-view-selection.png :alt: data view selection :screenshot: ::: To expand the analyzer to a full screen, select the **Full Screen** icon above the left panel. -:::{image} ../../../images/security-full-screen-analyzer.png +:::{image} /solutions/images/security-full-screen-analyzer.png :alt: full screen analyzer :screenshot: ::: The left panel contains a list of all processes related to the event, starting with the event chain’s first process. **Analyzed Events** — the event you selected to analyze from the events list or Timeline — are highlighted with a light blue outline around the cube. -:::{image} ../../../images/security-process-list.png +:::{image} /solutions/images/security-process-list.png :alt: process list :screenshot: ::: @@ -129,7 +129,7 @@ In the graphical view, you can: * Determine how much time passed between each process * Identify all events related to each process -:::{image} ../../../images/security-graphical-view.png +:::{image} /solutions/images/security-graphical-view.png :alt: graphical view :screenshot: ::: @@ -147,7 +147,7 @@ To learn more about each related process, select the process in the left panel o * Any other relevant process information * Any associated alerts -:::{image} ../../../images/security-process-details.png +:::{image} /solutions/images/security-process-details.png :alt: process details :screenshot: ::: @@ -158,14 +158,14 @@ Access event details by selecting that event’s URL at the top of the process d Events are categorized based on the `event.category` value. -:::{image} ../../../images/security-event-type.png +:::{image} /solutions/images/security-event-type.png :alt: event type :screenshot: ::: When you select an `event.category` pill, all the events within that category are listed in the left panel. To display more details about a specific event, select it from the list. -:::{image} ../../../images/security-event-details.png +:::{image} /solutions/images/security-event-details.png :alt: event details :screenshot: ::: @@ -180,7 +180,7 @@ To examine alerts associated with the event, select the alert pill (***x* alert* In the example screenshot below, five alerts were generated by the analyzed event (`lsass.exe`). The left pane displays the associated alerts and basic information about each one. -:::{image} ../../../images/security-alert-pill.png +:::{image} /solutions/images/security-alert-pill.png :alt: alert pill :screenshot: ::: diff --git a/solutions/security/manage-elastic-defend/blocklist.md b/solutions/security/manage-elastic-defend/blocklist.md index 8d4cf80aee..df4b7adb60 100644 --- a/solutions/security/manage-elastic-defend/blocklist.md +++ b/solutions/security/manage-elastic-defend/blocklist.md @@ -71,7 +71,7 @@ By default, a blocklist entry is recognized globally across all hosts running {{ The **Blocklist** page displays all the blocklist entries that have been added to the {{security-app}}. To refine the list, use the search bar to search by name, description, or field value. -:::{image} ../../../images/security-blocklist.png +:::{image} /solutions/images/security-blocklist.png :alt: blocklist :screenshot: ::: diff --git a/solutions/security/manage-elastic-defend/endpoints.md b/solutions/security/manage-elastic-defend/endpoints.md index 6022e50e75..0981a2c794 100644 --- a/solutions/security/manage-elastic-defend/endpoints.md +++ b/solutions/security/manage-elastic-defend/endpoints.md @@ -23,7 +23,7 @@ The Endpoints page allows administrators to view and manage endpoints that are r The **Endpoints** list displays all hosts running {{elastic-defend}} and their relevant integration details. Endpoints appear in chronological order, with newly added endpoints at the top. -:::{image} ../../../images/security-endpoints-pg.png +:::{image} /solutions/images/security-endpoints-pg.png :alt: Endpoints page :screenshot: ::: @@ -64,7 +64,7 @@ The Endpoints list provides the following data: Click any link in the **Endpoint** column to display host details in a flyout. You can also use the **Take Action** menu button to perform the same actions as those listed in the Actions context menu, such as isolating the host, viewing host details, and viewing or reassigning the agent policy. -:::{image} ../../../images/security-host-flyout.png +:::{image} /solutions/images/security-host-flyout.png :alt: Endpoint details flyout :screenshot: ::: @@ -74,7 +74,7 @@ Click any link in the **Endpoint** column to display host details in a flyout. Y The endpoint details flyout also includes the **Response actions history** tab, which provides a log of the [response actions](/solutions/security/endpoint-response-actions.md) performed on the endpoint, such as isolating a host or terminating a process. You can use the tools at the top to filter the information displayed in this view. Refer to [](/solutions/security/endpoint-response-actions/response-actions-history.md) for more details. -:::{image} ../../../images/security-response-actions-history-endpoint-details.png +:::{image} /solutions/images/security-response-actions-history-endpoint-details.png :alt: Response actions history with a few past actions :screenshot: ::: @@ -91,7 +91,7 @@ Users must have permission to read/write to {{fleet}} APIs to make changes to th :::: -:::{image} ../../../images/security-integration-pg.png +:::{image} /solutions/images/security-integration-pg.png :alt: Integration page :screenshot: ::: @@ -103,7 +103,7 @@ Advanced settings are not recommended for most users. :::: -:::{image} ../../../images/security-integration-advanced-settings.png +:::{image} /solutions/images/security-integration-advanced-settings.png :alt: Integration page :screenshot: ::: @@ -130,7 +130,7 @@ If you need help troubleshooting a configuration failure, refer to [](/troublesh :::: -:::{image} ../../../images/security-config-status.png +:::{image} /solutions/images/security-config-status.png :alt: Config status details :screenshot: ::: @@ -140,7 +140,7 @@ If you need help troubleshooting a configuration failure, refer to [](/troublesh To filter the Endpoints list, use the search bar to enter a query using [{{kib}} Query Language (KQL)](/explore-analyze/query-filter/languages/kql.md). To refresh the search results, click **Refresh**. -:::{image} ../../../images/security-filter-endpoints.png +:::{image} /solutions/images/security-filter-endpoints.png :alt: filter endpoints :screenshot: ::: diff --git a/solutions/security/manage-elastic-defend/event-filters.md b/solutions/security/manage-elastic-defend/event-filters.md index fbb00390b4..b17c7a5fc2 100644 --- a/solutions/security/manage-elastic-defend/event-filters.md +++ b/solutions/security/manage-elastic-defend/event-filters.md @@ -43,7 +43,7 @@ Create event filters from the **Hosts** page or the **Event filters** page. * To create an event filter from the **Event filters** page, click **Add event filter**. - :::{image} ../../../images/security-event-filter.png + :::{image} /solutions/images/security-event-filter.png :alt: Add event filter flyout :screenshot: ::: @@ -96,7 +96,7 @@ Create event filters from the **Hosts** page or the **Event filters** page. The **Event filters** page displays all the event filters that have been added to the {{security-app}}. To refine the list, use the search bar to search by filter name, description, comments, or field value. -:::{image} ../../../images/security-event-filters-list.png +:::{image} /solutions/images/security-event-filters-list.png :alt: event filters list :screenshot: ::: diff --git a/solutions/security/manage-elastic-defend/host-isolation-exceptions.md b/solutions/security/manage-elastic-defend/host-isolation-exceptions.md index ad19fb4db1..27037dd2e8 100644 --- a/solutions/security/manage-elastic-defend/host-isolation-exceptions.md +++ b/solutions/security/manage-elastic-defend/host-isolation-exceptions.md @@ -53,7 +53,7 @@ By default, a host isolation exception is recognized globally across all hosts r The **Host isolation exceptions** page displays all the host isolation exceptions that have been configured for {{elastic-sec}}. To refine the list, use the search bar to search by name, description, or IP address. -:::{image} ../../../images/security-host-isolation-exceptions-ui.png +:::{image} /solutions/images/security-host-isolation-exceptions-ui.png :alt: List of host isolation exceptions :screenshot: ::: diff --git a/solutions/security/manage-elastic-defend/identify-antivirus-software-on-hosts.md b/solutions/security/manage-elastic-defend/identify-antivirus-software-on-hosts.md index f7ac8dea95..ba7686e02c 100644 --- a/solutions/security/manage-elastic-defend/identify-antivirus-software-on-hosts.md +++ b/solutions/security/manage-elastic-defend/identify-antivirus-software-on-hosts.md @@ -39,7 +39,7 @@ To use this feature, you need: 3. Select an LLM connector, or [add](../ai/set-up-connectors-for-large-language-models-llm.md) a new one. 4. Click **Scan**. After a brief processing period, any detected AV products will appear under **Insights**. -:::{image} ../../../images/serverless-endpoint-insights-results.png +:::{image} /solutions/images/serverless-endpoint-insights-results.png :alt: Endpoint Insights results with the "Create trusted app" button highlighted ::: diff --git a/solutions/security/manage-elastic-defend/policies.md b/solutions/security/manage-elastic-defend/policies.md index 61c987a94e..8a484e1adf 100644 --- a/solutions/security/manage-elastic-defend/policies.md +++ b/solutions/security/manage-elastic-defend/policies.md @@ -19,7 +19,7 @@ You must have the **{{elastic-defend}} Policy Management** [privilege](/solution Click on an integration policy’s name to configure its settings. For more information on configuring an integration policy, refer to [](/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md). -:::{image} ../../../images/security-policy-list.png +:::{image} /solutions/images/security-policy-list.png :alt: policy list :screenshot: ::: diff --git a/solutions/security/manage-elastic-defend/trusted-applications.md b/solutions/security/manage-elastic-defend/trusted-applications.md index 4e4c902c24..7553abb775 100644 --- a/solutions/security/manage-elastic-defend/trusted-applications.md +++ b/solutions/security/manage-elastic-defend/trusted-applications.md @@ -76,7 +76,7 @@ To add a trusted application: The **Trusted applications** page displays all the trusted applications that have been added to the {{security-app}}. To refine the list, use the search bar to search by name, description, or field value. -:::{image} ../../../images/security-trusted-apps-list.png +:::{image} /solutions/images/security-trusted-apps-list.png :alt: trusted apps list :screenshot: :::