Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions solutions/security/investigate/notes.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,9 @@ Incorporate notes into your investigative workflows to coordinate responses, con
Configure the `securitySolution:maxUnassociatedNotes` [advanced setting](/solutions/security/get-started/configure-advanced-settings.md#max-notes-alerts-events) to specify the maximum number of notes that you can attach to alerts and events.
::::

## Grant access to notes [notes-privileges]

You can control access to notes by setting the [{{kib}} privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md) for the **Notes** feature under **Security**.

## View and add notes to alerts and events [notes-alerts-events]

Expand Down
4 changes: 4 additions & 0 deletions solutions/security/investigate/timeline.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,10 @@ You can drag or send fields of interest to a Timeline to create the desired quer
In addition to Timelines, you can create and attach Timeline templates to [detection rules](/solutions/security/detect-and-alert.md). Timeline templates allow you to define the source event fields used when you investigate alerts in Timeline. You can select whether the fields use predefined values or values retrieved from the alert. For more information, refer to [Timeline templates](/solutions/security/investigate/timeline-templates.md).


## Grant access to Timeline [timeline-privileges]

You can control access to Timeline by setting the [{{kib}} privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md) for the **Timeline** feature under **Security**.

## Create new or open existing Timeline [open-create-timeline]

To make a new Timeline, choose one of the following:
Expand Down
Loading