Merge branch 'main' into alerting/experimental-setup

Author: nastasha-solomon

deploy-manage/cloud-organization/billing/elastic-observability-billing-dimensions.md

@@ -34,8 +34,8 @@ sub:
 
 Your monthly bill is based on the capabilities you use. When you use {{obs-serverless}}, your bill is calculated based on data volume, which has these components:
 
-* **Ingest** — Measured by the number of GB of log/event/info data that you send to your Observability project over the course of a month.
-* **Retention** — Measured by the total amount of ingested data stored in your Observability project.
+* **Ingest** — Measured by the number of GB of data that you send to your Observability project over the course of a month. Metrics data ingested in [time series index mode](/manage-data/data-store/data-streams/time-series-data-stream-tsds.md) is priced at 25% of the standard per-GB ingest rate. All other data, including logs and traces, are priced at the standard rate.
+* **Retention** — Measured by the total amount of ingested data stored in your Observability project. Metrics data stored in time series index mode is priced at 25% of the standard per-GB retention rate. All other data, including logs and traces, are priced at the standard rate.
 
 :::{include} _snippets/note-data-volumes-ingest-retention.md
 :::

deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md

@@ -97,6 +97,7 @@ This table compares Elasticsearch capabilities between {{ech}} deployments and S
 | [**Elasticsearch for Apache Hadoop**](https://www.elastic.co/elasticsearch/hadoop) | ✅ | ❌ | Not available in Serverless |
 | **Enterprise Search (App Search & Workplace Search)** | ❌ (discontinued in 9.0) | ❌ | Not available in Serverless |
 | [**Kibana Alerts**](/deploy-manage/monitor/monitoring-data/configure-stack-monitoring-alerts.md) | ✅ | ✅ | |
+| [**Reindexing from remote**](/manage-data/migrate/migrate-data-using-reindex-api.md) | ✅ | ✅ | |
 | **Repository management** | ✅ | Managed | Automatically managed by Elastic |
 | [**Scripted metric aggregations**](elasticsearch://reference/aggregations/search-aggregations-metrics-scripted-metric-aggregation.md) | ✅ | ❌ | Not available in Serverless<br>The alternative for this in Serverless is [ES|QL](elasticsearch://reference/query-languages/esql.md) |
 | [**`join` fields**](elasticsearch://reference/elasticsearch/mapping-reference/parent-join.md) | ✅ | ❌ | Not available in Serverless<br>The alternative for this in Serverless is the ES\|QL [`LOOKUP JOIN`](elasticsearch://reference/query-languages/esql/commands/lookup-join.md) command |

deploy-manage/deploy/elastic-cloud/project-settings.md

@@ -3,12 +3,13 @@ mapped_pages:
   - https://www.elastic.co/guide/en/serverless/current/project-and-management-settings.html
   - https://www.elastic.co/guide/en/serverless/current/elasticsearch-manage-project.html
 applies_to:
-  serverless:
+  serverless: ga
 products:
   - id: cloud-serverless
+navigation_title: Project settings
 ---
 
-# Project settings
+# {{serverless-short}} project settings
 
 Project settings are configurations that apply to your entire project, managed from the {{ecloud}} console. While Elastic [manages many things for you](/deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings.md), you can customize the following aspects of your project:
 
@@ -66,6 +67,10 @@ Project features and add-ons control which capabilities are available in your se
 
 There are no additional project features or add-ons for {{es-serverless}} projects.
 
+:::{note}
+In {{serverless-full}}, your organization's {{ecloud}} subscription level controls only the support level you receive, and is not related to the features that you use or have access to. [Learn more about subscriptions](/deploy-manage/license.md).
+:::
+
 ### {{sec-serverless}} project features [elastic-sec-project-features]
 
 For {{sec-serverless}} projects, edit the **Project features** to select a feature tier and enable add-on options for specific use cases.
@@ -76,39 +81,8 @@ For {{sec-serverless}} projects, edit the **Project features** to select a featu
 | **Security Analytics Essentials** | A suite of security analytics, detections, investigations, and collaboration tools. Does not include AI-powered tools. Allows these add-ons:<br>• **Endpoint Protection Essentials**: endpoint protections with {{elastic-defend}}.<br>• **Cloud Protection Essentials**: Cloud native security features.|
 | **Security Analytics Complete** | Everything in **Security Analytics Essentials** and **EASE**, plus advanced features such as entity analytics, threat intelligence, and more. Allows these add-ons:<br><br>• **Endpoint Protection Complete**: Everything in **Endpoint Protection Essentials** plus advanced endpoint detection and response features.<br>• **Cloud Protection Complete**: Everything in **Cloud Protection Essentials** plus advanced cloud security features.|
 
-#### Downgrading the feature tier [elasticsearch-manage-project-downgrading-the-feature-tier]
-
-:::{note}
-You cannot downgrade to EASE from any other feature tier. You can upgrade from EASE to other tiers.
-:::
-
-When you downgrade your Security project features selection from **Security Analytics Complete** to **Security Analytics Essentials**, the following features become unavailable:
-
-* All Entity Analytics features
-* The ability to use certain entity analytics-related integration packages, such as:
-  * Data Exfiltration detection
-  * Lateral Movement detection
-  * Living off the Land Attack detection
-* Intelligence Indicators page
-* External rule action connectors
-* Case connectors
-* Endpoint response actions history
-* Endpoint host isolation exceptions
-* Trusted devices
-* AI Assistant
-* Attack discovery
-
-And, the following data may be permanently deleted:
-
-* AI Assistant conversation history
-* AI Assistant settings
-* Entity Analytics user and host risk scores
-* Entity Analytics asset criticality information
-* Detection rule external connector settings
-* Detection rule response action settings
-
 :::{tip}
-For a full feature comparison, upgrading instructions, and more, refer to [{{product.serverless-security}} feature tiers](/solutions/security/security-serverless-feature-tiers.md).
+For a full feature comparison, upgrading instructions, downgrading information, and more, refer to [{{product.serverless-security}} feature tiers](/solutions/security/security-serverless-feature-tiers.md).
 :::
 
 ### {{obs-serverless}} project features

deploy-manage/license.md

@@ -24,6 +24,10 @@ Depending on your deployment type, licenses and subscriptions are applied at dif
 * **{{ecloud}}, {{ece}}, and {{eck}}:** Licenses and subscriptions are controlled at the orchestrator or organization level, and apply to all related deployments.
 * **Self-managed {{es}}:** Licenses are controlled at the cluster level, and apply only to a single cluster.
 
+:::{note}
+In {{serverless-full}}, your organization's {{ecloud}} subscription level controls only the support level you receive. Project features are controlled by each project's [feature tier and add-ons](/deploy-manage/deploy/elastic-cloud/project-settings.md#project-features-add-ons).
+:::
+
 For a comprehensive comparison of the available subscription levels, see [Elastic subscriptions](https://www.elastic.co/subscriptions).
 
 Use the topics in this section to manage your license or start a trial:  

explore-analyze/ai-features/agent-builder/builtin-skills-reference.md

@@ -117,12 +117,13 @@ $$$agent-builder-detection-rule-edit-skill$$$ `detection-rule-edit` {applies_to}
 
     **How to activate:** This skill is attachment-driven and activates when a rule attachment is present in the conversation. You can start a rule attachment from the rule creation form, the rule details page, or by asking the agent to "create a detection rule" in chat — the skill creates the attachment and renders an **Apply to creation** or **Update rule** button so you can save the change to the rule form.
 
-$$$agent-builder-automatic-troubleshooting-skill$$$ `automatic_troubleshooting` {applies_to}`stack: preview 9.4` {applies_to}`serverless: preview`
-:   Diagnoses [Elastic Defend](/solutions/security/configure-elastic-defend.md) endpoint configuration issues such as endpoints not reporting, policy response failures, agent enrollment problems, or incompatible antivirus. Queries endpoint data, inspects package configuration, and produces structured findings with specific endpoint IDs and remediation steps. Registered only when the `automaticTroubleshootingSkill` experimental feature flag is enabled.
-
+$$$agent-builder-automatic-troubleshooting-skill$$$ `automatic_troubleshooting` {applies_to}`stack: ga 9.5+, preview =9.4` {applies_to}`serverless: ga`
+:   Diagnoses [{{elastic-defend}}](/solutions/security/configure-elastic-defend.md) endpoint configuration issues such as endpoints not reporting, policy response failures, agent enrollment problems, or incompatible antivirus software. Queries endpoint data, inspects package configuration, and produces structured findings with specific endpoint IDs and remediation steps.
     **Assigned tools:** `platform.core.search`, `platform.core.get_document_by_id`, `platform.core.integration_knowledge`
 
-    **Prerequisites:** [Elastic Defend](/solutions/security/configure-elastic-defend.md) deployed and reporting. The `automaticTroubleshootingSkill` experimental feature flag must be enabled for the skill to appear.
+    **Prerequisites:** [{{elastic-defend}}](/solutions/security/configure-elastic-defend.md) deployed and reporting.
+
+    {applies_to}`stack: preview =9.4` In this version, the `automaticTroubleshootingSkill` [experimental feature flag](kibana://reference/configuration-reference/security-solution-settings.md#experimental-features) must be enabled for the skill to appear.
 
 ## Elasticsearch skills
 ```{applies_to}

reference/fleet/fleet-api-docs.md

@@ -1,6 +1,7 @@
 ---
 mapped_pages:
   - https://www.elastic.co/guide/en/fleet/current/fleet-api-docs.html
+description: Send Fleet API requests with the Kibana Console or cURL. Reference examples cover agent policies, integration policies, enrollment tokens, agent listing, KQL filters, and manual rollback.
 applies_to:
   stack: ga
   serverless: ga
@@ -11,34 +12,39 @@ products:
 
 # Kibana Fleet APIs [fleet-api-docs]
 
-You can find details for all available {{fleet}} API endpoints in the [Kibana API docs]({{kib-apis}}). For {{serverless-full}} projects, check the [Kibana Serverless API docs]({{kib-serverless-apis}}).
+This page provides cURL and {{kib}} Console examples for commonly used {{fleet}} APIs, including agent policies, integration policies, enrollment tokens, agent listing, KQL filtering, and agent rollback.
 
-In this section, we provide examples of some commonly used {{fleet}} APIs.
+For full endpoint specifications, parameters, and response schemas, refer to the [Kibana API docs]({{kib-apis}}). For {{serverless-full}} projects, use the [Kibana Serverless API docs]({{kib-serverless-apis}}).
+
+
+## Before you begin [fleet-api-before-you-begin]
+
+You'll need:
+
+* A running {{kib}} deployment or {{serverless-full}} project with {{fleet}} available
+* The {{kib}} host URL for your deployment (for example, `https://my-kibana-host:9243`)
+* Authentication credentials for {{kib}} API requests. API key authentication is recommended. For details, refer to [Authentication]({{kib-apis}}authentication).
+* A {{kib}} user with the required {{fleet}} and {{integrations}} privileges. For details, refer to [Roles and privileges](/reference/fleet/fleet-roles-privileges.md).
 
 
 ## Using the Console [using-the-console]
 
 You can run {{fleet}} API requests through the {{kib}} Console.
 
-1. Open the {{kib}} menu and go to **Management → Dev Tools**.
+1. To open **Console**, find **Dev Tools** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
 2. In your request, prepend your {{fleet}} API endpoint with `kbn:`, for example:
 
     ```sh
     GET kbn:/api/fleet/agent_policies
     ```
 
 
-For more detail about using the {{kib}} Console refer to [Run API requests](/explore-analyze/query-filter/tools/console.md).
-
-
-## Authentication [authentication]
-
-Authentication is required to send {{fleet}} API requests. For more information, refer to [Authentication]({{kib-apis}}authentication).
+For more details about using the {{kib}} Console, refer to [Run API requests](/explore-analyze/query-filter/tools/console.md).
 
 
 ## Create agent policy [create-agent-policy-api]
 
-To create a new agent policy in {{fleet}}, call `POST /api/fleet/agent_policies`.
+To create an agent policy in {{fleet}}, call `POST /api/fleet/agent_policies`.
 
 This cURL example creates an agent policy called `Agent policy 1` in the default namespace.
 
@@ -96,7 +102,7 @@ Example response:
 }
 ```
 
-1. Make a note of the policy ID. You’ll need the policy ID to add integration policies.
+1. Note the policy ID. You need it to add integration policies.
 
 
 
@@ -109,7 +115,7 @@ You can use the {{fleet}} API to [Create and customize an {{elastic-defend}} pol
 ::::
 
 
-This cURL example creates an integration policy for Nginx and adds it to the agent policy created in the previous example:
+This cURL example creates an integration policy for Nginx and adds it to the agent policy you created in [Create agent policy](#create-agent-policy-api):
 
 ```shell
 curl --request POST \
@@ -414,10 +420,10 @@ Example response (formatted for readability):
 
 ## List all {{agents}} [list-agents-api]
 
-Use the [Get agents API]({{kib-apis}}operation/operation-get-fleet-agents) to retrieve a list of currently enrolled {{agents}}:
+Use the [Get agents API]({{kib-apis}}operation/operation-get-fleet-agents) to retrieve a list of enrolled {{agents}}:
 
 ```shell
-curl -X GET 'http://<user>:<pass>@<kibana url>/api/fleet/agents
+curl -X GET 'http://<user>:<pass>@<kibana url>/api/fleet/agents'
 ```
 
 By default, a maximum of 10,000 agents are returned, with 20 agents listed per page.
@@ -461,24 +467,51 @@ curl -X GET 'http://<user>:<pass>@<kibana url>/api/fleet/agents?perPage=10000&se
 ```
 
 
+## Filter results with KQL [filter-results-with-kql]
+
+The following {{fleet}} list endpoints accept a `kuery` query parameter that takes a [{{kib}} Query Language (KQL)](elasticsearch://reference/query-languages/kql.md) string to filter results: agents (`GET /api/fleet/agents`), agent policies (`GET /api/fleet/agent_policies`), package policies (`GET /api/fleet/package_policies`), and enrollment tokens (`GET /api/fleet/enrollment_api_keys`). To check whether another endpoint accepts `kuery`, refer to its parameters in the [Kibana API docs]({{kib-apis}}).
+
+**Agents and enrollment tokens** are stored in {{es}} system indices. Reference fields directly, with no prefix. This cURL example returns only the online agents:
+
+```shell
+curl --request GET \
+  --url 'https://my-kibana-host:9243/api/fleet/agents?kuery=status:online' \
+  --header 'Authorization: ApiKey yourbase64encodedkey' \
+  --header 'kbn-xsrf: xx'
+```
+
+**Agent policies and package policies** are stored as saved objects. When a field path contains a dot, prefix it with the saved object type so the query parser reads it as a field name and not as a type. This cURL example returns only the package policies for the `nginx` integration:
+
+```shell
+curl --request GET \
+  --url 'https://my-kibana-host:9243/api/fleet/package_policies?kuery=ingest-package-policies.package.name:nginx' \
+  --header 'Authorization: ApiKey yourbase64encodedkey' \
+  --header 'kbn-xsrf: xx'
+```
+
+::::{tip}
+If a query returns a `400`, the field needs a saved object type prefix. When the error is a `KQLSyntaxError` about a missing key, it names the saved object index pattern to use as the prefix (for example `ingest-agent-policies.name`). When the error is `This type <x> is not allowed`, no pattern is named, so prefix the field with the endpoint's saved object type (for example `ingest-package-policies.package.name`).
+::::
+
+For the full query syntax, including wildcards, ranges, and boolean operators, refer to [{{kib}} Query Language (KQL)](elasticsearch://reference/query-languages/kql.md).
+
+
 ## Manually roll back an {{agent}} upgrade [agent-rollback-api]
 ```{applies_to}
 stack: ga 9.3+
 ```
 
-The manual rollback feature for {{agent}} gives you the ability to roll back to the previously installed version if the install artifacts are still available on disk--typically seven days after the upgrade. 
+The manual rollback feature for {{agent}} lets you roll back to the previously installed version if the install artifacts are still available on disk (typically seven days after the upgrade).
 
-To roll back a single agent:
-   :Call `POST /api/fleet/agents/{agentID}/rollback`.
+To roll back a single agent, call `POST /api/fleet/agents/{agentID}/rollback`.
 
-To roll back multiple agents:
-   :Call `POST /api/fleet/agents/bulk_rollback`.
+To roll back multiple agents, call `POST /api/fleet/agents/bulk_rollback`.
 
 ### Limitations for manual rollback [rollback-limitations-api]
 
-These limitations apply for the manual rollback feature: 
+These limitations apply for the manual rollback feature:
 
-* Rollback is limited to the version running _before_ the upgrade. Both the previously and currently running versions must be 9.3.0 or later for this functionality to be available.
+* Rollback is limited to the version running _before_ the upgrade. Both the pre-upgrade and post-upgrade versions must be 9.3.0 or later for this functionality to be available.
 * Data required for the rollback is stored on disk for seven days, which can impact available disk space.
 * Rollback must be performed within seven days of the upgrade. Rollback data is automatically cleaned up after seven days and becomes unavailable.
 * Manual rollback is not available for system-managed packages such as DEB and RPM.
@@ -489,6 +522,24 @@ These limitations apply for the manual rollback feature:
 If no version is available on disk to rollback to, you get an error.
 This situation can happen if:
 
-- the version you upgraded from is earlier than 9.3.0, as the feature is not supported for earlier versions. 
+- The version you upgraded from is earlier than 9.3.0, as the feature is not supported for earlier versions.
+
+- The rollback window has ended (typically more than seven days). When the rollback window ends, the files from the previous version are removed to free up disk space.
+
+
+## Next steps [fleet-api-next-steps]
+
+After you create agent and integration policies with the API:
+
+* [Enroll {{agents}}](/reference/fleet/fleet-enrollment-tokens.md) using enrollment tokens from your agent policy
+* [Manage {{agents}} in {{fleet}}](/reference/fleet/manage-elastic-agents-in-fleet.md) to monitor status and policy assignments
+* [Create an agent policy without using the UI](/reference/fleet/create-policy-no-ui.md) for automation use cases
+
+
+## Related pages [fleet-api-related-pages]
 
-- the rollback window has ended (typically more than seven days). When the rollback window ends, the files from the previous version are removed to free up disk space. 
+* [Kibana API docs]({{kib-apis}})
+* [Run API requests](/explore-analyze/query-filter/tools/console.md)
+* [Roles and privileges](/reference/fleet/fleet-roles-privileges.md)
+* [Grant standalone {{agents}} access to {{es}}](/reference/fleet/grant-access-to-elasticsearch.md)
+* [{{kib}} Query Language (KQL)](elasticsearch://reference/query-languages/kql.md)