Issues

• [Observability] 9.5.7 Release notes

  Team:SKItriaged
  elastic/docs-content#9415 · Filter by author mdbirnstiehl opened on Nov 13, 2026
  1

  

• [Alerting V2][9.6.1 & 9.7] Note that rule event data values over 8,191 characters can't be searched or aggregated

  alerting-v2Team:SKItriaged
  elastic/docs-content#9414 · Filter by author nastasha-solomon opened on Nov 13, 2026
  1

• Document the Projection map setting

  documentationFeature: Kibana UXTeam:SKItriaged
  elastic/docs-content#9413 · Filter by author florent-leborgne opened on Nov 13, 2026
  1

  

• Update the Maps getting started tutorial for the current UI

  documentationFeature: Kibana UXTeam:SKItriaged
  elastic/docs-content#9412 · Filter by author florent-leborgne opened on Nov 13, 2026
  1

  

• Document how to create an SLO from a template

  Team:SKItriaged
  elastic/docs-content#9409 · Filter by author florent-leborgne opened on Nov 13, 2026
  1

• [Internal]: Update Entity Store index names in privileges docs for 9.6 and add upgrade note for custom roles

  triaged
  elastic/docs-content#9404 · Filter by author tcalopes opened on Nov 13, 2026
  1

• 9.5.7 Kibana release notes

  documentationTeam:SKItriaged
  elastic/docs-content#9397 · Filter by author florent-leborgne opened on Nov 13, 2026
  1

  

• [Internal]: vm.max_map_count persisted in /etc/sysctl.conf is overridden by the packaged sysctl file at boot and on package upgrade

  Team:Admintriaged
  elastic/docs-content#9396 · Filter by author anmironov opened on Nov 13, 2026
  1

• [Internal]: Promote Cases workflow triggers to GA

  Team:SKItriaged
  elastic/docs-content#9388 · Filter by author PhilippeOberti opened on Nov 12, 2026
  1

• [API]: Elastic Cloud Hosted "Get stack versions" path is missing the /regions/{region} prefix (returns 404)

  api-feedbackTeam:Admintriaged
  elastic/docs-content#9385 · Filter by author anmironov opened on Nov 12, 2026
  1

• [Internal]: Document the OTLP output in Fleet

  Team:SKItriaged
  elastic/docs-content#9377 · Filter by author juliaElastic opened on Nov 12, 2026
  1

• [Security][Attack Discovery][9.6 & Serverless] Document the Attack Discovery page as deprecated in 9.5 and removed in 9.6

  Team:SKItriaged
  elastic/docs-content#9374 · Filter by author nastasha-solomon opened on Nov 12, 2026
  1

  

• [ML][9.6] Document querying anomaly detection results with ES|QL (FROM .ml-anomalies)

  Team:Developertriaged
  elastic/docs-content#9358 · Filter by author kosabogi opened on Nov 11, 2026
  1

  

• [Internal]: Document the reserve disk space setting for Fleet agent binary sources

  Team:SKItriaged
  elastic/docs-content#9357 · Filter by author juliaElastic opened on Nov 11, 2026
  3

• [Internal]: Document managed tail-based sampling on Serverless

  Team:SKItriaged
  elastic/docs-content#9356 · Filter by author cpipilas opened on Nov 11, 2026
  1

  

• [Security Docs IA] Split the Automatic Import page into an overview and task pages

  choreTeam:SKItriaged
  elastic/docs-content#9354 · Filter by author nastasha-solomon opened on Nov 11, 2026
  1

  

• [Security][Cases][9.6 & Serverless] Attach attacks to cases and remove them with the alerts they added

  Feature: Threat HuntingTeam:SKItriagedunplanned
  elastic/docs-content#9353 · Filter by author nastasha-solomon opened on Nov 11, 2026
  1

  

• [Security][Cases][9.5.2, 9.5.3, 9.6, & Serverless] Case attributes save immediately, field library and template editing changes, and authoring-time field warnings

  Feature: Threat HuntingTeam:SKItriaged
  elastic/docs-content#9351 · Filter by author nastasha-solomon opened on Nov 10, 2026
  1

  

• [Security][Cases][9.5, 9.6, & Serverless] Custom field values are now mirrored into extended_fields for case analytics now that templates v2 is on by default

  Feature: Threat HuntingTeam:SKItriaged
  elastic/docs-content#9350 · Filter by author nastasha-solomon opened on Nov 10, 2026
  1

  

• [Security][Alert Details Flyout][9.6 & Serverless] Take-action menu grouping and order, wider Add-to-case permission, and flyout pagination

  Feature: Threat HuntingTeam:SKItriaged
  elastic/docs-content#9348 · Filter by author nastasha-solomon opened on Nov 10, 2026
  1

  

• [Alerting V1] Schedule maintenance windows and reports to recur on the last day of the month

  Feature: Threat HuntingTeam:SKItriaged
  elastic/docs-content#9347 · Filter by author nastasha-solomon opened on Nov 10, 2026
  1

  

• [Alerting V2] Assign severity levels to threshold rules in the alerting rule builder

  alerting-v2Team:SKItriaged
  elastic/docs-content#9346 · Filter by author nastasha-solomon opened on Nov 10, 2026
  1

  

• [Alerting V2] Get live validation, quick fixes, and Prettify (Cmd/Ctrl+I) in the alerting rule query sandbox

  alerting-v2Team:SKItriaged
  elastic/docs-content#9345 · Filter by author nastasha-solomon opened on Nov 10, 2026
  1

  

• [Security][Alert Details Flyout][9.7 & Serverless] The securitySolution:enableNewFlyout setting is removed and the new flyout is always used

  Team:SKItriaged
  elastic/docs-content#9344 · Filter by author nastasha-solomon opened on Nov 10, 2026
  1

  

• [Security][Workflows][9.6 & Serverless] Run a workflow automatically after an Agent Builder agent finishes responding

  Feature: WorkflowsTeam:SKItriagedunplanned
  elastic/docs-content#9340 · Filter by author nastasha-solomon opened on Nov 10, 2026
  1