[Security][Quality] Add conceptual documentation for detection alerts

[nastasha-solomon]

Summary

Fixes https://github.com/elastic/docs-content-internal/issues/837 by adding new conceptual documentation for detection alerts, addressing a gap where users and support lacked a clear explanation of what detection alerts are, how they work under the hood, and what is and isn't supported when filtering and searching them.

• Detection alert concepts
• Alert storage and schema
• How alerts are generated
• Detection alerts and external alerts

New pages

• Detection alert concepts (detection-alert-concepts.md) — Hub page covering what a detection alert is, the alert lifecycle (created → triaged → resolved), and a detailed breakdown of supported filtering/searching capabilities and known limitations.
• Alert storage and schema (alert-storage-and-schema.md) — Where alerts are stored (index aliases, backing indices, retention/rollover), how index mappings are composed from three component templates (ECS, technical, Security), and the key kibana.alert.* fields in an alert document.
• How alerts are generated (how-alerts-are-generated.md) — The 7-step alert generation pipeline, max_signals limits, preview alerts, and alert types (regular, building block, suppressed).
• Detection alerts and external alerts (detection-vs-external-alerts.md) — Side-by-side comparison of detection alerts (event.kind: "signal") and external alerts (event.kind: "alert"), plus how they relate (external alerts as inputs, detection alerts as outputs).

Note: Add these pages to the "Before you begin" section or the docs about managing alerts

Key details covered

These were previously undocumented or hard to find:

• Filtering/searching: what's supported (KQL on any mapped field, grouping, programmatic queries) and known limitations (1,000 max page size, unmapped fields excluded, no sorting in event-rendered view, browser-local filter state)
• Index mappings are system-managed and built from three component templates — users should use runtime fields instead of modifying mappings
• Alert retention has no delete phase by default; suggests adding a delete phase to the ILM policy
• Backing indices explained for users unfamiliar with Elasticsearch internals
• Alert deduplication via deterministic SHA-256 IDs
• Building block alerts and their role in EQL sequences

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

Claude + Cursor

[github-actions]

Vale Linting Results

Summary: 2 warnings, 2 suggestions found

⚠️ Warnings (2)

File	Line	Rule	Message
solutions/security/detect-and-alert/alert-storage-and-schema.md	72	Elastic.DontUse	Don't use 'just'.
solutions/security/detect-and-alert/detection-alert-concepts.md	35	Elastic.Spelling	'Triaged' is a possible misspelling.

💡 Suggestions (2)

File	Line	Rule	Message
solutions/security/detect-and-alert/alert-storage-and-schema.md	35	Elastic.Wordiness	Consider using 'all' instead of 'all of '.
solutions/security/detect-and-alert/alert-storage-and-schema.md	91	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/detect-and-alert/alert-storage-and-schema.md
• solutions/security/detect-and-alert/detection-alert-concepts.md
• solutions/security/detect-and-alert/detection-vs-external-alerts.md
• solutions/security/detect-and-alert/how-alerts-are-generated.md