diff --git a/solutions/security/investigate/notes.md b/solutions/security/investigate/notes.md index b6c186bf3e..e149bf2137 100644 --- a/solutions/security/investigate/notes.md +++ b/solutions/security/investigate/notes.md @@ -16,7 +16,9 @@ Incorporate notes into your investigative workflows to coordinate responses, con Configure the `securitySolution:maxUnassociatedNotes` [advanced setting](/solutions/security/get-started/configure-advanced-settings.md#max-notes-alerts-events) to specify the maximum number of notes that you can attach to alerts and events. :::: +## Grant access to notes [notes-privileges] +You can control access to notes by setting the [{{kib}} privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md) for the **Notes** feature under **Security**. ## View and add notes to alerts and events [notes-alerts-events] diff --git a/solutions/security/investigate/timeline.md b/solutions/security/investigate/timeline.md index 918f4d056e..8ea502a651 100644 --- a/solutions/security/investigate/timeline.md +++ b/solutions/security/investigate/timeline.md @@ -22,6 +22,10 @@ You can drag or send fields of interest to a Timeline to create the desired quer In addition to Timelines, you can create and attach Timeline templates to [detection rules](/solutions/security/detect-and-alert.md). Timeline templates allow you to define the source event fields used when you investigate alerts in Timeline. You can select whether the fields use predefined values or values retrieved from the alert. For more information, refer to [Timeline templates](/solutions/security/investigate/timeline-templates.md). +## Grant access to Timeline [timeline-privileges] + +You can control access to Timeline by setting the [{{kib}} privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md) for the **Timeline** feature under **Security**. + ## Create new or open existing Timeline [open-create-timeline] To make a new Timeline, choose one of the following: