---
title: Elastic Cloud Serverless changelog
description: Review the changes, fixes, and more to Elastic Cloud Serverless. Allows you to search scheduled reports by title and creator #243841, Updates the rule...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4226/release-notes/elastic-cloud-serverless
products:
  - Elastic Cloud Serverless
---

# Elastic Cloud Serverless changelog
Review the changes, fixes, and more to Elastic Cloud Serverless.

## December 8, 2025


### Features and enhancements

- Allows you to search scheduled reports by title and creator [#243841](https://github.com/elastic/kibana/pull/243841)
- Updates the rule flapping schema to add an optional `enabled` field [#243855](https://github.com/elastic/kibana/pull/243855)
- Improves suggestions for `LIKE` and `RLIKE` operators so they only suggest string-compatible options [#244903](https://github.com/elastic/kibana/pull/244903)
- Redesigns the Lookup index editor with a new layout and controls [#244480](https://github.com/elastic/kibana/pull/244480)
- Adds support for global custom ingest pipelines for service-level objectives (SLOs), allowing you to create a single pipeline that applies to all SLO rollup and summary documents [#245025](https://github.com/elastic/kibana/pull/245025)
- Changes SLO rollup indexing to store service level indicator (SLI) data daily instead of monthly by default, with override support through a global custom ingest pipeline [#244978](https://github.com/elastic/kibana/pull/244978)
- Adds ELSER in Elastic Inference Service (EIS) as a model option for the Observability AI Assistant knowledge base [#243298](https://github.com/elastic/kibana/pull/243298)
- Adds an **Edit tags** action that lets you manually apply workflow tags to alerts [#243792](https://github.com/elastic/kibana/pull/243792)
- Allows you to view and filter alerts by manually added workflow tags [#244251](https://github.com/elastic/kibana/pull/244251)
- Adds a built-in product documentation tool to Agent Builder, available only when product documentation is installed [#242598](https://github.com/elastic/kibana/pull/242598)
- Adds a platform cases tool and experimental security attachments and tools to Agent Builder to support existing **Ask AI Assistant** and **View in Agent Builder** workflows [#243574](https://github.com/elastic/kibana/pull/243574).
- Adds an alerts search tool and two security agents (Alerts Agent and Entity Agent) to Agent Builder [#245205](https://github.com/elastic/kibana/pull/245205)
- Updates the API keys management page to default to displaying personal API keys only [#245261](https://github.com/elastic/kibana/pull/245261)
- Adds two new preconfigured connectors (General Purpose LLM v2 and General Purpose LLM v3) and renames the Elastic Managed LLM connector to General Purpose LLM v1 [#242791](https://github.com/elastic/kibana/pull/242791)
- Adds the Groq icon to the providers list displayed during AI Connector and Inference endpoint creation [#244962](https://github.com/elastic/kibana/pull/244962)
- Adds the **Suggest a pipeline** option in the Processing tab of streams to help generate ingest pipelines [#243950](https://github.com/elastic/kibana/pull/243950)
- Adds support for `geo_point` fields in the schema editor for classic streams [#244356](https://github.com/elastic/kibana/pull/244356)
- Enhances the Streams attachments feature with a details flyout, a better user experience, and better user feedback [#244880](https://github.com/elastic/kibana/pull/244880)
- Adds validation for Streamlang DSL to enforce field namespacing in wired streams and detect type mismatches in processor configurations [#244221](https://github.com/elastic/kibana/pull/244221)
- Adds an onboarding tour to the Streams UI to guide new users through core workflows [#244808](https://github.com/elastic/kibana/pull/244808)
- Allows you to filter ES|QL charts in dashboards [#243439](https://github.com/elastic/kibana/pull/243439)
- Enables Value reports in Elastic Cloud Hosted and adds logic to export them using the share plugin [#243511](https://github.com/elastic/kibana/pull/243511)
- Adds a **Span links** badge to the unified trace waterfall view [#244389](https://github.com/elastic/kibana/pull/244389)
- Adds dynamic form elements for the IBM Resilient connector fields, improving the configuration experience [#238869](https://github.com/elastic/kibana/pull/238869)
- Adds a time range selector to the Cases page to simplify filtering by timeframe [#243409](https://github.com/elastic/kibana/pull/243409)


### Fixes

- Fixes an issue where `alert.consecutiveMatches` was missing in the action context for rule executions [#244997](https://github.com/elastic/kibana/pull/244997)
- Fixes an issue where the Security alerts table did not update columns correctly when switching view mode [#245253](https://github.com/elastic/kibana/pull/245253)
- Handles alias resolution when checking lock index mappings [#244559](https://github.com/elastic/kibana/pull/244559)
- Fixes an issue where the SLOs page could cause inconsistent browser back button behavior [#242761](https://github.com/elastic/kibana/pull/242761)
- Standardizes error logging to make troubleshooting more consistent [#245030](https://github.com/elastic/kibana/pull/245030)
- Fixes an issue that prevented IdP-initiated authentication when multiple OIDC providers were configured [#243869](https://github.com/elastic/kibana/pull/243869)
- Improves UIAM reliability by increasing container health check timeouts and populating the UIAM shared secret in Elasticsearch [#245238](https://github.com/elastic/kibana/pull/245238)
- Fixes CSP-agnostic regressions by removing cloud provider host checks, ensuring all cloud providers for Elastic Cloud Hosted deployments and Serverless projects are supported [#242592](https://github.com/elastic/kibana/pull/242592)


## December 2, 2025


### Features and enhancements

- Adds the **Read global parameters** sub-feature privilege which allows you to read the values of synthetics global parameters [#243821](https://github.com/elastic/kibana/pull/243821)
- Adds Cc, Bcc, Subject, and Message fields with Mustache templating support to the Schedule exports flyout for email notifications [#242922](https://github.com/elastic/kibana/pull/242922)
- Allows users to enable scheduled reports [#244202](https://github.com/elastic/kibana/pull/244202)
- Adds a background Fleet policy revisions cleanup task to automatically remove excess policy revisions from the `.fleet-policies` index [#242612](https://github.com/elastic/kibana/pull/242612)
- Automatically migrates component template ILM policies during setup [#243333](https://github.com/elastic/kibana/pull/243333)
- Improves suggestion ordering using categorization to provide more relevant results [#243312](https://github.com/elastic/kibana/pull/243312)
- Allows you to select a column type in the lookup index editor [#241637](https://github.com/elastic/kibana/pull/241637)
- Ensures that infrastructure inventory UIs accurately reflect supported schemas [#244481](https://github.com/elastic/kibana/pull/244481)
- Adds a warning when deleting API keys currently in use by alerting rules [#243353](https://github.com/elastic/kibana/pull/243353)
- Removes the median line length check in the categorization anomaly detection job [#243827](https://github.com/elastic/kibana/pull/243827)
- Allows you to filter alerts using the KQL search bar [#240100](https://github.com/elastic/kibana/pull/240100)
- Introduces the Attachments API for streams [#243597](https://github.com/elastic/kibana/pull/243597)
- Introduces new UI components for the Drop processor [#243131](https://github.com/elastic/kibana/pull/243131)
- Adds service-level objective (SLO) support for streams attachments, migrates the UI to use the Attachments API for dashboards, rules, and SLOs, and removes deprecated API endpoints [#244092](https://github.com/elastic/kibana/pull/244092)
- Allows you to add custom descriptions for enrichment processors [#243998](https://github.com/elastic/kibana/pull/243998)
- Prevents conflicting actions in the Partitioning tab [#244228](https://github.com/elastic/kibana/pull/244228)
- Improves handling of missing streams [#244366](https://github.com/elastic/kibana/pull/244366)
- Allows you to configure the visibility of the Streams app per space [#244285](https://github.com/elastic/kibana/pull/244285)
- Improves error messaging when expensive queries are turned off in the Streams schema editor [#243406](https://github.com/elastic/kibana/pull/243406)
- Improves the Console UI to make key actions more intuitive [#242487](https://github.com/elastic/kibana/pull/242487)
- Adds targeted Elastic Inference Service (EIS) callouts and dismissible guided tours to Kibana for Elastic Cloud Hosted and Elastic Cloud Serverless users [#244626](https://github.com/elastic/kibana/pull/244626)
- Redesigns the Lens configuration flyout to show layers as tabs instead of vertically stacked panels [#235372](https://github.com/elastic/kibana/pull/235372)
- Consolidates attachments into a single Attachments tab with sub-tab navigation [#243708](https://github.com/elastic/kibana/pull/243708)
- Adds the ES|QL `CHUNK` function in technical preview [#138621](https://github.com/elastic/elasticsearch/pull/138621)
- Improves support for the `first()` and `last()` aggregation functions in ES|QL by disabling vector dispatch for blocks [#138390](https://github.com/elastic/elasticsearch/pull/138390)
- Adds informative timestamps to async ES|QL query results [#137957](https://github.com/elastic/elasticsearch/pull/137957)
- Add Groq as a chat completion inference service for machine learning [#138251](https://github.com/elastic/elasticsearch/pull/138251)
- Adds the node-scoped `vectors.indexing.use_gpu` setting to control GPU usage for vector indexing [#138738](https://github.com/elastic/elasticsearch/pull/138738)
- Adds routing support to the `_project/tags` endpoint
- Allows point-in-time (PIT) searches to span multiple projects [#137966](https://github.com/elastic/elasticsearch/pull/137966)
- Excludes synthetic `_id` postings from disk usage statistics [#138745](https://github.com/elastic/elasticsearch/pull/138745)
- Allows `project_routing` to be specified as a query parameter in EQL requests [#138559](https://github.com/elastic/elasticsearch/pull/138559)
- Avoids retrieving unnecessary fields during the node-reduce phase in ES|QL queries [#137920](https://github.com/elastic/elasticsearch/pull/137920)
- Updates `KNN` function options in ES|QL to align with the latest vector search behavior [#138372](https://github.com/elastic/elasticsearch/pull/138372)
- Updates the ES|QL `CHUNK` function to support `chunking_settings` as an optional argument [#138123](https://github.com/elastic/elasticsearch/pull/138123)
- Pushes down `COUNT(*) BY DATE_TRUNC` aggregations in ES|QL to improve performance [#138023](https://github.com/elastic/elasticsearch/pull/138023)
- Adds support for parameters to `LIKE` and `RLIKE` operators in ES|QL [#138051](https://github.com/elastic/elasticsearch/pull/138051)
- Adds support for the `time_zone` request parameter to `KQL` and `QSTR` functions in ES|QL [#138695](https://github.com/elastic/elasticsearch/pull/138695)
- Adds timezone support to the ES|QL `DateDiff` function [#138316](https://github.com/elastic/elasticsearch/pull/138316)
- Fuses the `MV_MIN` and `MV_MAX` functions in ES|QL and documents the fusion process [#138029](https://github.com/elastic/elasticsearch/pull/138029)
- Adds `GROUP BY ALL` support in ES|QL [#137367](https://github.com/elastic/elasticsearch/pull/137367)
- Extends `GROUP BY ALL` in ES|QL to support the dimensions output [#138595](https://github.com/elastic/elasticsearch/pull/138595)
- Extends the field capabilities API to support `project_routing` in the request body [#138681](https://github.com/elastic/elasticsearch/pull/138681)
- Improves security migration resilience by handling version conflicts more robustly [#137558](https://github.com/elastic/elasticsearch/pull/137558)
- Adds dynamic template parameters in bulk requests so OTLP metric units can be stored in index mappings [#134709](https://github.com/elastic/elasticsearch/pull/134709)
- Adds the `project_routing` option to SQL requests [#138718](https://github.com/elastic/elasticsearch/pull/138718)
- Uses a doc values skipper for `_tsid` when resolving synthetic `_id` values to skip unnecessary documents [#138568](https://github.com/elastic/elasticsearch/pull/138568)


### Fixes

- Verifies an alert exists before muting it [#242847](https://github.com/elastic/kibana/pull/242847)
- Prevents URL restore errors in Discover and Dashboards [#242788](https://github.com/elastic/kibana/pull/242788)
- Adds an authentication header to Kibana tool requests [#244017](https://github.com/elastic/kibana/pull/244017)
- Fixes an issue where the dashboard selector did not return results when trying to link dashboards to a rule [#243496](https://github.com/elastic/kibana/pull/243496)
- Fixes a validation error when creating custom threshold rules with data view objects [#244134](https://github.com/elastic/kibana/pull/244134)
- Ensures deleted text in form fields is not sent as an empty string during Inference endpoint and LLM Connector creation [#244059](https://github.com/elastic/kibana/pull/244059)
- Prevents cell selection from being cleared after you dismiss the alerts table popover in Anomaly Explorer [#244183](https://github.com/elastic/kibana/pull/244183)
- Fixes an issue where cell actions on empty cells populated the condition value with `undefined` [#243766](https://github.com/elastic/kibana/pull/243766)
- Removes references to Mustache template snippets from the UI form fields and descriptions for the Set processor [#243656](https://github.com/elastic/kibana/pull/243656)
- Fixes a screen-reader text mismatch on the Index management page [#243802](https://github.com/elastic/kibana/pull/243802)
- Fixes a sizing issue in the flyout for API key creation [#244072](https://github.com/elastic/kibana/pull/244072)
- Improves the error message that appears when the IBM Resilient connector fails [#244012](https://github.com/elastic/kibana/pull/244012)
- Catches connector errors without interrupting the case creation flow [#244188](https://github.com/elastic/kibana/pull/244188)
- Allows file paths containing spaces to be used in Observables [#244350](https://github.com/elastic/kibana/pull/244350)
- Fixes the serialization of `meta.error` in JSON layouts [#244364](https://github.com/elastic/kibana/pull/244364)
- Fixes an issue that could cause an infinite loading state after submitting the case creation form [#244543](https://github.com/elastic/kibana/pull/244543)
- Adds supprot for pruning columns when using `FORK` branches in ES|QL [#137907](https://github.com/elastic/elasticsearch/pull/137907)
- Fixes an Inference API issue to support correct type identification during deserialization [#138484](https://github.com/elastic/elasticsearch/pull/138484)
- Fixes `chunkedInfer()` to correctly handle empty inputs [#138632](https://github.com/elastic/elasticsearch/pull/138632)
- Ensures the circuit breaker limit is honored when building global ordinals by accounting their memory usage and breaking when the limit is exceeded [#108875](https://github.com/elastic/elasticsearch/pull/108875)
- Changes `DatabaseNodeService` error logs to warnings to reduce noise [#138438](https://github.com/elastic/elasticsearch/pull/138438)
- Avoids using `MIN` or `MAX` as `TOP`'s surrogate when an `outputField` is defined [#138380](https://github.com/elastic/elasticsearch/pull/138380)
- Uses the correct minimum transport version when resolving ES|QL `ENRICH` and `LOOKUP JOIN` types [#137431](https://github.com/elastic/elasticsearch/pull/137431)
- Fixes `SearchContext` circuit breaker memory accounting [#138002](https://github.com/elastic/elasticsearch/pull/138002)
- Adds missing `vector_similarity_support` flags in `InferenceFeatures` [#138644](https://github.com/elastic/elasticsearch/pull/138644)
- Extends the semantic text highlighter to improve the handling of vector-based queries [#138140](https://github.com/elastic/elasticsearch/pull/138140)
- Handles individual document parsing failures in bulk requests with ingest pipelines without failing the entire request [#138624](https://github.com/elastic/elasticsearch/pull/138624)
- Handles search timeouts that occur during collector initialization in `QueryPhase` by returning partial results instead of shard-level failures [#138084](https://github.com/elastic/elasticsearch/pull/138084)
- Fixes serialization of `null` blocks in `AggregateMetricDoubleBlock` [#138539](https://github.com/elastic/elasticsearch/pull/138539)
- Ensures filters are correctly applied to kNN queries [#138457](https://github.com/elastic/elasticsearch/pull/138457)
- Ensures filter queries, including semantic queries, are correctly rewritten and applied to kNN searches during coordinator-side inference [#138457](https://github.com/elastic/elasticsearch/pull/138457)
- Speeds up `LeafCollector#setScorer` in `TopHitsAggregator` [#138883](https://github.com/elastic/elasticsearch/pull/138883)\
- Reduces `LeafCollector#setScorer` overhead in `TopHitsAggregator` for multi-bucket aggregations by sharing a single `Scorable` instance across buckets [#138883](https://github.com/elastic/elasticsearch/pull/138883)
- Updates the `jts` dependency to version `1.20.0` [#138351](https://github.com/elastic/elasticsearch/pull/138351)
- Moves the `CrossProjectRoutingResolver` functionality to Serverless


## November 24, 2025


### Features and enhancements

- Allows users to edit scheduled exports [#241928](https://github.com/elastic/kibana/pull/241928)
- Uses `type@lifecycle` ILMs for new package installations [#241992](https://github.com/elastic/kibana/pull/241992)
- Allows ES|QL to support subqueries in the `FROM` command [#241921](https://github.com/elastic/kibana/pull/241921)
- Suggests adding curly braces after the `WITH` keyword for Rerank and Completion [#243047](https://github.com/elastic/kibana/pull/243047)
- Supports the new `exponential_histogram` Elasticsearch field type [#242748](https://github.com/elastic/kibana/pull/242748)
- Wraps the fork subcommands inside the `parens` node [#242369](https://github.com/elastic/kibana/pull/242369)
- Simplifies the search visor experience [#242123](https://github.com/elastic/kibana/pull/242123)
- Auto-scrolls to the suggestions panel in Streams  [#242891](https://github.com/elastic/kibana/pull/242891)
- Shows user-readable output for the MDE runscript response action [#242441](https://github.com/elastic/kibana/pull/242441)
- Saves the selected prevalence time to local storage [#243543](https://github.com/elastic/kibana/pull/243543)
- Saves the selected threat intelligence time to local storage [#243571](https://github.com/elastic/kibana/pull/243571)
- Adds custom header support for inference endpoint creation [#242187](https://github.com/elastic/kibana/pull/242187)
- Adds the `replace` processor to Streamlang DSL for string patterns replacement using regular expressions [#242310](https://github.com/elastic/kibana/pull/242310)
- Adds automatic dissect pattern generation capabilities to the Streams processing pipeline [#242377](https://github.com/elastic/kibana/pull/242377)
- Adds a rows per page selector to the tools, agents, and agent tools selection views [#242207](https://github.com/elastic/kibana/pull/242207)


### Fixes

- Uses the real dimensions when taking a screenshot of reports [#242127](https://github.com/elastic/kibana/pull/242127)
- Fixes a print mode regression in Dashboards [#242780](https://github.com/elastic/kibana/pull/242780)
- Fixes an issue where users could not save a dashboard after switching a dashboard link to an external URL [#243134](https://github.com/elastic/kibana/pull/243134)
- Uses `max_value` instead of infinity for the default maximum height of a panel in Dashboards [#243572](https://github.com/elastic/kibana/pull/243572)
- Adds retry behavior for `/api/fleet/agents` when transient issues with Elasticsearch are encountered [#243105](https://github.com/elastic/kibana/pull/243105)
- Uses a long expiration time for upgrade agents [#243443](https://github.com/elastic/kibana/pull/243443)
- Fixes retrying stuck agents in auto upgrade logic [#243326](https://github.com/elastic/kibana/pull/243326)
- Fixes the CPU query in Pod details by changing the gap policy to include zeros [#239596](https://github.com/elastic/kibana/pull/239596)
- Fixes the KPIs subtitle logic [#243217](https://github.com/elastic/kibana/pull/243217)
- Fixes custom links clearing filter values when a new field is selected or deleted [#241164](https://github.com/elastic/kibana/pull/241164)
- Updates the system prompt title for generic deployments [#243266](https://github.com/elastic/kibana/pull/243266)
- Fixes the squished Apple icon on Auto Detect flow cards [#242452](https://github.com/elastic/kibana/pull/242452)
- Handles the missing `error.id` when processing causes an error [#243638](https://github.com/elastic/kibana/pull/243638)
- Removes the block that prevented saving a Timeline with an ad-hoc dataview [#240537](https://github.com/elastic/kibana/pull/240537)
- Fixes the response actions API for Elastic Defend agent types, not sending the action to more than 10 agents [#243387](https://github.com/elastic/kibana/pull/243387)
- Fixes favicon CSS specificity issues [#243351](https://github.com/elastic/kibana/pull/243351)
- Fixes infinite loading of roles on the Edit spaces screen [#242954](https://github.com/elastic/kibana/pull/242954)
- Fixes import and improves validation for Anomaly Detection and Data Frame Analytics jobs [#242263](https://github.com/elastic/kibana/pull/242263)
- Fixes keyboard focus getting trapped in pages using document preview [#243791](https://github.com/elastic/kibana/pull/243791)
- Reverts "Fix issue where filters do not apply to overview stats" [#242978](https://github.com/elastic/kibana/pull/242978)
- Disables custom suggestion on embedded console [#241516](https://github.com/elastic/kibana/pull/241516)
- Shows the AI log assistant with fallback message fields [#243437](https://github.com/elastic/kibana/pull/243437)
- Ignores `resource_already_exists_exception` for value list creation hook [#243642](https://github.com/elastic/kibana/pull/243642)
- Prevents crashes on the Retention page for certain ILM policies [#243826](https://github.com/elastic/kibana/pull/243826)


## November 17, 2025


### Features and enhancements

- Enables the following HTTP request methods for the webhook connector: `POST` (default), `PUT`, `PATCH`, `GET`, and `DELETE` [#238072](https://github.com/elastic/kibana/pull/238072)
- Persists filter state for Fleet agent table during navigation [#228875](https://github.com/elastic/kibana/pull/228875)
- Displays inline suggestions in the ES|QL editor [#235162](https://github.com/elastic/kibana/pull/235162)
- Improves Attack Discovery prompts [#241346](https://github.com/elastic/kibana/pull/241346)
- Fixes grouping in the Alerts table [#237911](https://github.com/elastic/kibana/pull/237911)
- Collects cloud connector telemetry for the Cloud Asset Discovery integration [#240272](https://github.com/elastic/kibana/pull/240272)
- Syncs recently used date ranges in the time picker across browser tabs [#242467](https://github.com/elastic/kibana/pull/242467)
- Adds `drop_document` processor to Streamlang [#242161](https://github.com/elastic/kibana/pull/242161)
- Extracts `AbstractGeoIpDownloader` to share concurrency logic across GeoIP downloaders [#137660](https://github.com/elastic/elasticsearch/pull/137660)
- Iterates directly over `RoutingNode` contents to reduce allocation overhead [#137694](https://github.com/elastic/elasticsearch/pull/137694)
- Speeds up sorts that use secondary sort fields [#137533](https://github.com/elastic/elasticsearch/pull/137533)
- Reduces worst-case Inference API latency by removing an additional 50 ms delay for non–rate-limited requests [#136167](https://github.com/elastic/elasticsearch/pull/136167)
- Uses the `DEFAULT_UNSORTABLE` topN encoder for `TSID_DATA_TYPE` in ES|QL to improve sorting behavior [#137706](https://github.com/elastic/elasticsearch/pull/137706)
- Transitions Elastic Indexing Service auth polling to a single-node persistent task for improved reliability [#136713](https://github.com/elastic/elasticsearch/pull/136713)
- Makes ES|QL field fusion generic so it can be reused across more field types [#137382](https://github.com/elastic/elasticsearch/pull/137382)
- Releases the ES|QL `decay` function [#137830](https://github.com/elastic/elasticsearch/pull/137830)
- Adds additional APM attributes to coordinator-phase duration metrics for richer tracing [#137409](https://github.com/elastic/elasticsearch/pull/137409)
- Adds telemetry to track CPS usage [#137705](https://github.com/elastic/elasticsearch/pull/137705)
- Introduces simple bulk loading for binary doc values to improve indexing throughput [#137860](https://github.com/elastic/elasticsearch/pull/137860)
- Uses IVF_PQ for GPU-based index builds on large datasets to improve vector indexing performance [#137126](https://github.com/elastic/elasticsearch/pull/137126)
- Aligns match-phase shard APM metrics with the originating search request context [#137196](https://github.com/elastic/elasticsearch/pull/137196)
- Improves Serverless filtering behavior when creating resources from existing configurations [#137850](https://github.com/elastic/elasticsearch/pull/137850)
- Refactors model field parsing in `AnthropicChatCompletionStreamingProcessor` to better handle model variants [#137926](https://github.com/elastic/elasticsearch/pull/137926)
- Adds balancer-round summary metrics to shard allocation to aid tuning and diagnostics [#136043](https://github.com/elastic/elasticsearch/pull/136043)
- Adds merge support to `ES93BloomFilterStoredFieldsFormat` [#137622](https://github.com/elastic/elasticsearch/pull/137622)
- Adds additional DEBUG-level logging for authentication failures [#137941](https://github.com/elastic/elasticsearch/pull/137941)
- Adds support for an extra output field in the ES|QL `TOP` function [#135434](https://github.com/elastic/elasticsearch/pull/135434)
- Introduces the `INDEX_SHARD_COUNT_FORMAT` setting for index shard count formatting [#137210](https://github.com/elastic/elasticsearch/pull/137210)
- Implements an OpenShift AI integration for chat completion, embeddings, and reranking workloads [#136624](https://github.com/elastic/elasticsearch/pull/136624)
- Adds `first()` and `last()` aggregation functions to ES|QL [#137408](https://github.com/elastic/elasticsearch/pull/137408)
- Adds support for the `project_routing` parameter on `_search` and `_async_search` requests [#137566](https://github.com/elastic/elasticsearch/pull/137566)
- Adds a daily maintenance task to manage `.ml-state` indices in machine learning [#137653](https://github.com/elastic/elasticsearch/pull/137653)
- Adds an `es812` postings format index setting for advanced indexing control [#137857](https://github.com/elastic/elasticsearch/pull/137857)
- Adds centroid filtering support to DiskBBQ for more restrictive filters [#137959](https://github.com/elastic/elasticsearch/pull/137959)
- Adds timezone support to ES|QL `DATE_TRUNC`, `BUCKET`, and `TBUCKET` functions [#137450](https://github.com/elastic/elasticsearch/pull/137450)
- Further improves bulk loading performance for binary doc values [#137995](https://github.com/elastic/elasticsearch/pull/137995)
- Updates the Gradle wrapper to version `9.2.0`
- Improves logging for the sampled metrics provider
- Updates `BlobCacheIndexInput` to use `sliceDescription` as the resource description when available, improving diagnostics
- Switches APM trace detection to use `hasApmTraceContext` and its variant APIs


### Fixes

- Fixes a bug that caused the Alerts table's pagination to hang on Rule pages [#242275](https://github.com/elastic/kibana/pull/242275)
- Fixes an error that occurred when deselecting a `(blank)` option from an options list [#242036](https://github.com/elastic/kibana/pull/242036)
- Fixes an issue that caused the 'sync colors' and 'sync tooltips' settings to be ON by default [#242442](https://github.com/elastic/kibana/pull/242442)
- Fixes package icons loading [#242406](https://github.com/elastic/kibana/pull/242406)
- Fixes the docker image reference in the **Add agent** flyout's Kubernetes manifest [#242691](https://github.com/elastic/kibana/pull/242691)
- Fixes text truncation in tables [#241440](https://github.com/elastic/kibana/pull/241440)
- Fixes charts not filtering by `host.name` [#242673](https://github.com/elastic/kibana/pull/242673)
- Reverts show transform errors accross all SLO pages [#243013](https://github.com/elastic/kibana/pull/243013)
- Adds encoding of `cloudFormation` URL parameters [#242365](https://github.com/elastic/kibana/pull/242365)
- Changes `must_not` risk scoring filter to `must` [#242171](https://github.com/elastic/kibana/pull/242171)
- Fixes the rule link in a timeline’s alert flyout [#242313](https://github.com/elastic/kibana/pull/242313)
- Fixes the data frame analytics wizard for data views with runtime fields [#242557](https://github.com/elastic/kibana/pull/242557)
- Updates the default semantic text endpoint when adding semantic text field mappings to ELSER in EIS [#242436](https://github.com/elastic/kibana/pull/242436)
- Fixes auto extraction in event bulk actions [#242325](https://github.com/elastic/kibana/pull/242325)
- Fixes the extraction of the current JDK major version [#137779](https://github.com/elastic/elasticsearch/pull/137779)
- Fixes OTLP responses to return the correct response type for partial successes [#137718](https://github.com/elastic/elasticsearch/pull/137718)
- Fixes the get data stream API when a data stream's index mode has been changed to `time_series` [#137852](https://github.com/elastic/elasticsearch/pull/137852)
- Ensures `include_execution_metadata` in ES|QL always returns data, including for local-only queries [#137641](https://github.com/elastic/elasticsearch/pull/137641)
- Fixes an ES|QL vector similarity concurrency issue affecting byte vectors [#137883](https://github.com/elastic/elasticsearch/pull/137883)
- Reverts a previous change to `statsByShard` that regressed performance for very large shard counts [#137984](https://github.com/elastic/elasticsearch/pull/137984)
- Fixes scalability issues when updating machine learning calendar events [#136886](https://github.com/elastic/elasticsearch/pull/136886)
- Prevents ES|QL queries from failing when an index is deleted during query execution [#137702](https://github.com/elastic/elasticsearch/pull/137702)
- Fixes `GET /_migration/deprecations` not reporting node deprecations when the disk low watermark is exceeded, and improves reporting of node-level failures [#137964](https://github.com/elastic/elasticsearch/pull/137964)
- Fixes `GET /_migration/deprecations` incorrectly checking deprecated affix index settings [#137976](https://github.com/elastic/elasticsearch/pull/137976)
- Prevents passing an ingest pipeline with a logs stream index request, avoiding invalid configurations [#137992](https://github.com/elastic/elasticsearch/pull/137992)
- Removes vectors from `_source` documents in ES|QL when appropriate to reduce payload size [#138013](https://github.com/elastic/elasticsearch/pull/138013)
- Prevents the delete index API from failing if an index is removed while the request is in progress [#138015](https://github.com/elastic/elasticsearch/pull/138015)
- Prevents renaming a field to `timestamp` in ES|QL before its implicit use, avoiding type errors [#137713](https://github.com/elastic/elasticsearch/pull/137713)
- Fixes `KDE.evaluate()` to return the correct `ValueAndMagnitude` object [#128602](https://github.com/elastic/elasticsearch/pull/128602)
- Fixes file settings handling in the Restore API [#137585](https://github.com/elastic/elasticsearch/pull/137585)


## November 10, 2025


### Features and enhancements

- Adds nightly maintenance for anomaly detection results indices to keep to manageable size [#136065](https://github.com/elastic/elasticsearch/pull/136065)
- Adds the ability to preview index requests in transforms [#137455](https://github.com/elastic/elasticsearch/pull/137455)
- Allows field capabilities to span across Elasticsearch Serverless projects [#137530](https://github.com/elastic/elasticsearch/pull/137530)
- Improves ES|QL performance by skipping unnecessary query plan diff calculations in Elasticsearch Serverless [#137721](https://github.com/elastic/elasticsearch/pull/137721)
- Passes the Elasticsearch version in the EIS inference request header in Elasticsearch Serverless [#137643](https://github.com/elastic/elasticsearch/pull/137643)
- Introduces a synthetic `_id` format for time-series data streams [#137274](https://github.com/elastic/elasticsearch/pull/137274)
- Updates the Dashboard top navigation to include a **Save** menu [#237211](https://github.com/elastic/kibana/pull/237211)
- Moves visualization configuration settings, including appearance, titles and text, axis, and legend to a flyout panel in **Lens** [#240804](https://github.com/elastic/kibana/pull/240804)
- Supports subqueries in the Discover pretty printer [#241473](https://github.com/elastic/kibana/pull/241473)
- Adds context-aware autocomplete for Discover subqueries with nesting restrictions [#241912](https://github.com/elastic/kibana/pull/241912)
- Adds subquery support for columns after and validation in Discover [#241567](https://github.com/elastic/kibana/pull/241567)
- Adds support for Discover subqueries in FROM clauses across tools [#242166](https://github.com/elastic/kibana/pull/242166)
- Enables users to view the SLO associated with a burn rate rule on the rule details page in Elastic Observability Serverless [#240535](https://github.com/elastic/kibana/pull/240535)
- Exposes `sampling_rate` agent central config options to users in Elastic Observability Serverless [#241908](https://github.com/elastic/kibana/pull/241908)
- Makes the Elastic logo open a custom home page in solution view [#241571](https://github.com/elastic/kibana/pull/241571)
- Enforces the `object_src 'none'` directive in the Kibana content security policy [#241029](https://github.com/elastic/kibana/pull/241029)
- Adds origin configuration options for authentication providers [#239993](https://github.com/elastic/kibana/pull/239993)
- Adds the ability to cancel machine learning file uploads [#241297](https://github.com/elastic/kibana/pull/241297)
- Improves display of long field values in Data Visualizer top values list [#241006](https://github.com/elastic/kibana/pull/241006)
- Adds a temperature parameter to Inference AI, and OpenAI, Bedrock, and Gemini connectors [#239806](https://github.com/elastic/kibana/pull/239806)
- Adds support for custom headers in the OpenAI integration [#238710](https://github.com/elastic/kibana/pull/238710)
- Fixes public Update spaces APIs [#242136](https://github.com/elastic/kibana/pull/242136)
- Improves layout for custom inference endpoints [#241779](https://github.com/elastic/kibana/pull/241779)
- Displays field data types in the Processing table and step editor [#241825](https://github.com/elastic/kibana/pull/241825)
- Adds timezone and locale parameters to Streamlang [#241369](https://github.com/elastic/kibana/pull/241369)
- Displays field data types in the Streams Partitioning UI [#242134](https://github.com/elastic/kibana/pull/242134)
- Adds autocomplete for field values in Streams Partitioning and Processing tabs [#241119](https://github.com/elastic/kibana/pull/241119)
- Hides document match filter controls for users without manage privileges [#242119](https://github.com/elastic/kibana/pull/242119)


### Fixes

- Fixes feature display order when using explain in Learning to Rank (LTR) [#137671](https://github.com/elastic/elasticsearch/pull/137671)
- Fixes an issue where missing geotile buckets caused errors in Transform [#137476](https://github.com/elastic/elasticsearch/pull/137476)
- Ensures ES|QL full text functions accept `null` values as field parameters in Elasticsearch Serverless  [#137430](https://github.com/elastic/elasticsearch/pull/137430)
- Fixes a missing attribute issue in ES|QL full text functions in Elasticsearch Serverless [#137395](https://github.com/elastic/elasticsearch/pull/137395)
- Fixes a bug in `RankDocRetrieverBuilder` when `from` is set to the default -1 value [#137637](https://github.com/elastic/elasticsearch/pull/137637)
- Prevents use-after-close errors in async search by making `MutableSearchResponse` reference-counted  [#134359](https://github.com/elastic/elasticsearch/pull/134359)
- Removes early phase failures during batched search execution [#136889](https://github.com/elastic/elasticsearch/pull/136889)
- Improves SQL validation errors by providing more descriptive exception messages [#137560](https://github.com/elastic/elasticsearch/pull/137560)
- Correctly accounts for additional settings providers when determining data stream effective settings [#137407](https://github.com/elastic/elasticsearch/pull/137407)
- Adds proxy SSL options for download sources [#241115](https://github.com/elastic/kibana/pull/241115)
- Ensures Fleet policy name uniqueness is enforced consistently across spaces [#239631](https://github.com/elastic/kibana/pull/239631)
- Shows warnings on the sync integrations UI when referencing other entities [#241623](https://github.com/elastic/kibana/pull/241623)
- Escapes special characters when creating ES|QL queries for **Lens** charts in Elastic Observability Serverless [#241662](https://github.com/elastic/kibana/pull/241662)
- Fixes "Values" dropdown display on smaller screens in Elastic Observability Serverless [#241812](https://github.com/elastic/kibana/pull/241812)
- Excludes stale SLOs from group-by statistics in Elastic Observability Serverless [#240077](https://github.com/elastic/kibana/pull/240077)
- Fixes missing `EngineMetadata.type` in generic entity popovers in Elastic Security Serverless [#239661](https://github.com/elastic/kibana/pull/239661)
- Sanitizes lookup names when creating indices in Elastic Security Serverless [#240228](https://github.com/elastic/kibana/pull/240228)
- Supports multiple values in IOC flyout table tab in Elastic Security Serverless [#236110](https://github.com/elastic/kibana/pull/236110)
- Fixes top-N popover overlapping the new case flyout in Elastic Security Serverless [#242045](https://github.com/elastic/kibana/pull/242045)
- Fixes threshold source event handling in Elastic Security Serverless [#238707](https://github.com/elastic/kibana/pull/238707)
- Ensures Timeline ES|QL query editor displays correctly in full screen mode in Elastic Security Serverless  [#242027](https://github.com/elastic/kibana/pull/242027)
- Fixes invalid state for the **Enable wired streams** toggle [#241266](https://github.com/elastic/kibana/pull/241266)
- Fixes simulation of geo points in Streams [#241824](https://github.com/elastic/kibana/pull/241824)
- Decouples Streams AI features from Observability AI Assistant [#242019](https://github.com/elastic/kibana/pull/242019)
- Only applies tag changes when the connector supports them [#241944](https://github.com/elastic/kibana/pull/241944)


## November 3, 2025


### Features and enhancements

- Moves the **Lens** visualization toolbar from the workspace section to the configuration panel [#239879](https://github.com/elastic/kibana/pull/239879)
- Adds support for rolling back integrations to previous versions [#240761](https://github.com/elastic/kibana/pull/240761)
- Adds support for subqueries in the ES|QL abstract syntax tree (AST) [#241227](https://github.com/elastic/kibana/pull/241227)
- Adds subquery support for the walker and visitor in the ES|QL AST [#241451](https://github.com/elastic/kibana/pull/241451)
- Adds support for expressions in `LOOKUP JOIN` autocomplete [#240735](https://github.com/elastic/kibana/pull/240735)
- Adds support for multi-value variables in `MV_CONTAINS` [#239266](https://github.com/elastic/kibana/pull/239266)
- Adds client-side validation for `LOOKUP JOIN ON` expressions [#240930](https://github.com/elastic/kibana/pull/240930)
- Improves the ES|QL suggestions logic to provide more semantically intelligent suggestions [#241081](https://github.com/elastic/kibana/pull/241081)
- Adds an `isStream` parameter to the `chat/complete` endpoint to support non-streaming responses in the Observability AI Assistant [#240819](https://github.com/elastic/kibana/pull/240819)
- Makes the `opamp_polling_interval` and `sampling_rate` agent configuration variables available to EDOT Node.js [#241048](https://github.com/elastic/kibana/pull/241048)
- Adds a free-text popup for the `runscript` argument to provide user input to the selected script [#239436](https://github.com/elastic/kibana/pull/239436)
- Adds the deployment name to the breadcrumbs in Elastic Cloud Hosted [#238078](https://github.com/elastic/kibana/pull/238078)
- Adds a **Give feedback** button to the Anomaly Explorer and Single Metric Viewer [#239883](https://github.com/elastic/kibana/pull/239883)
- Adds a new `temperature` parameter to the AI Connector configuration schema [#239626](https://github.com/elastic/kibana/pull/239626)
- Makes the Update spaces APIs public [#241109](https://github.com/elastic/kibana/pull/241109)
- Adds support for the `convert` processor in stream data processing [#240023](https://github.com/elastic/kibana/pull/240023)
- Improves message feedback in collapsed Processors/Conditions sections [#240778](https://github.com/elastic/kibana/pull/240778)
- Optimizes workflow output in Agent Builder tools by removing workflow execution details from tool calls, reducing LLM token consumption and improving agent performance and reliability [#241040](https://github.com/elastic/kibana/pull/241040)


### Fixes

- Fixes layout issues for Markdown embeddables in small panels [#240806](https://github.com/elastic/kibana/pull/240806)
- Fixes an issue where labels in the **Create index** flow did not automatically render with the default vector tile scaling after saving or applying styling changes [#240728](https://github.com/elastic/kibana/pull/240728)
- Fixes `template_path` asset selection for certain integration packages [#240750](https://github.com/elastic/kibana/pull/240750)
- Omits system properties when syncing ingest pipelines [#241096](https://github.com/elastic/kibana/pull/241096)
- Fixes autocomplete for time series sources after a comma [#241402](https://github.com/elastic/kibana/pull/241402)
- Fixes a bottom gap that appeared while loading data in some cases [#238879](https://github.com/elastic/kibana/pull/238879)
- Hides non-trace services in service maps [#240104](https://github.com/elastic/kibana/pull/240104)
- Fixes an issue where the `kibana` tool failed when running Kibana behind a proxy [#236653](https://github.com/elastic/kibana/pull/236653)
- Fixes overlapping components in the Observability AI Assistant flyout on small screens [#241026](https://github.com/elastic/kibana/pull/241026)
- Aligns the **Members** link in the side navigation across all solutions [#240992](https://github.com/elastic/kibana/pull/240992)
- Updates Metrics experience API routes to delegate authorization to Elasticsearch [#241195](https://github.com/elastic/kibana/pull/241195)
- Copies alert states to the payload [#240411](https://github.com/elastic/kibana/pull/240411)
- Adds missing fields to transaction data [#241336](https://github.com/elastic/kibana/pull/241336)
- Simplifies metrics profile resolution by removing index pattern and time series validation [#241047](https://github.com/elastic/kibana/pull/241047)
- Allows partial matches on rule names when searching installed rules [#237496](https://github.com/elastic/kibana/pull/237496)
- Fixes a regression in threshold rule logic where threshold rules with no `group by` fields defined would no longer generate alerts [#241022](https://github.com/elastic/kibana/pull/241022)
- Fixes an issue where the alert details flyout on the **Risk contributions** tab did not display data in some cases [#241153](https://github.com/elastic/kibana/pull/241153)
- Fixes a table pagination issue on the Intelligence page [#241108](https://github.com/elastic/kibana/pull/241108)
- Fixes an issue with the **Regenerate** button in the Security Assistant [#241240](https://github.com/elastic/kibana/pull/241240)
- Fixes an issue where the Security AI Assistant's Index Entry form was showing incorrect field suggestions, missing searchable fields that exist as multi-fields or nested properties in Elasticsearch mappings [#239453](https://github.com/elastic/kibana/pull/239453)
- Fixes an issue where agent-based integrations failed to produce data [#241390](https://github.com/elastic/kibana/pull/241390)
- Fixes an infinite loop bug related to bootstrapping list resources [#241052](https://github.com/elastic/kibana/pull/241052)
- Reduces re-renders on resize and items change [#239888](https://github.com/elastic/kibana/pull/239888)
- Fixes index names causing an incompatible cluster error when product docs are installed with multiple inference IDs [#240506](https://github.com/elastic/kibana/pull/240506)
- Ensures all authentication fields are displayed correctly [#240913](https://github.com/elastic/kibana/pull/240913)
- Ensures the `max_tokens` parameter is passed as expected by the service [#241188](https://github.com/elastic/kibana/pull/241188)
- Updates the inference creation endpoint to ensure the `max_tokens` parameter is passed as expected when creating an Anthropic Connector [#241212](https://github.com/elastic/kibana/pull/241212)
- Removes the default fallback region for the Bedrock Connector [#241157](https://github.com/elastic/kibana/pull/241157)
- Fixes wrapping issues in the Streams UI [#240883](https://github.com/elastic/kibana/pull/240883)
- Speeds up field simulation in Streams [#241313](https://github.com/elastic/kibana/pull/241313)
- Updates action response codes [#240420](https://github.com/elastic/kibana/pull/240420)
- Fixes an infinite loop bug in the **Investigation guide** editor [#240472](https://github.com/elastic/kibana/pull/240472)


## October 27, 2025


### Features and enhancements

- Adds support for deleting export schedules [#238197](https://github.com/elastic/kibana/pull/238197)
- Moves the **Lens** visualization toolbar from the **Visualization parameters** section to the flyout header [#239176](https://github.com/elastic/kibana/pull/239176)
- Changes the processing order in ES|QL so the breakdown is applied before the date histogram [#239685](https://github.com/elastic/kibana/pull/239685)
- Adds a **View in Discover** button to the Alert details page for infrastructure rules [#236880](https://github.com/elastic/kibana/pull/236880)
- Introduces CDR Data View versioning and migration logic [#238547](https://github.com/elastic/kibana/pull/238547)
- Fixes layout wrapping for fields in the Machine Learning Overview and Notifications pages [#239113](https://github.com/elastic/kibana/pull/239113)
- Removes the AI Assistant Settings privilege [#239144](https://github.com/elastic/kibana/pull/239144)
- Adds ingest pipeline processor template suggestions to the manual ingest pipeline processor editor [#236919](https://github.com/elastic/kibana/pull/236919)
- Adds the `kibana.alert.index_pattern` field to all alerts [#239450](https://github.com/elastic/kibana/pull/239450)


### Fixes

- Fixes missing accessibility announcements in form rows [#240132](https://github.com/elastic/kibana/pull/240132)
- Improves the **Cases** table loading behavior to prevent flashing [#240155](https://github.com/elastic/kibana/pull/240155)
- Fixes a bug in Lens that incorrectly assigned unsaved data view references [#239431](https://github.com/elastic/kibana/pull/239431)
- Fixes an error when selecting the `(blank)` value in options lists [#239791](https://github.com/elastic/kibana/pull/239791)
- Pauses fetch operations until initialization completes [#239228](https://github.com/elastic/kibana/pull/239228)
- Fixes a bug that prevented users from resetting unsaved changes when enabling **timeRestore** and setting a time range [#239992](https://github.com/elastic/kibana/pull/239992)
- Fixes a search session restoration issue [#239822](https://github.com/elastic/kibana/pull/239822)
- Allows Fleet setup retries on start in all environments [#240342](https://github.com/elastic/kibana/pull/240342)
- Adds **FORK with KEEP/STATS** options to transformational commands [#240011](https://github.com/elastic/kibana/pull/240011)
- Fixes dependencies and service map issues for `txn == exit-span` use cases [#235392](https://github.com/elastic/kibana/pull/235392)
- Fixes the model label display in AI Assistant Settings [#239824](https://github.com/elastic/kibana/pull/239824)
- Updates the **Open in Discover** query in the related Logs section of the **Overview** tab [#240409](https://github.com/elastic/kibana/pull/240409)
- Fixes an issue where the Onboarding Integrations list wasn’t fetched for all pages [#239709](https://github.com/elastic/kibana/pull/239709)
- Fixes an issue where schedules couldn’t be created with **Cases** as the connector type [#239748](https://github.com/elastic/kibana/pull/239748)
- Fixes an issue where operators couldn’t be removed after selection in the **Add rule exception** flyout [#236051](https://github.com/elastic/kibana/pull/236051)
- Fixes `react-query` ID collision issues [#240517](https://github.com/elastic/kibana/pull/240517)
- Updates GenAI Settings to reflect the selected `AI Assistants Visibility` value from the header selector on the Settings page [#239555](https://github.com/elastic/kibana/pull/239555)
- Fixes the Inference endpoints UI to ensure the list loads correctly when the provider is custom [#240189](https://github.com/elastic/kibana/pull/240189)
- Fixes the URL in **Disk Usage** alerting rules [#240279](https://github.com/elastic/kibana/pull/240279)
- Fixes data preview metadata pop-up display issues by adding a tooltip and copy button to handle long IDs [#239768](https://github.com/elastic/kibana/pull/239768)
- Fixes the **Agents** and **Playground** icons in the side navigation to render correctly in dark mode [#240475](https://github.com/elastic/kibana/pull/240475)
- Ensures only valid queries are returned for significant events [#239501](https://github.com/elastic/kibana/pull/239501)
- Hides filtering capabilities in Hosts Metrics [#239724](https://github.com/elastic/kibana/pull/239724)


## October 20, 2025


### Features and enhancements

- [Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4226/solutions/search/elastic-agent-builder) is now available in technical preview and is enabled by default on Elastic Cloud Serverless
- Lets you remove root privileges from Fleet managed agents [#237790](https://github.com/elastic/kibana/pull/237790)
- Adds the `xpack.fleet.experimentalFeatures` setting [#238840](https://github.com/elastic/kibana/pull/238840)
- Supports expression suggestions within function parameters [#236343](https://github.com/elastic/kibana/pull/236343)
- Updates the Observability Serverless navigation menu [#235984](https://github.com/elastic/kibana/pull/235984)
- Allows the Observability AI Assistant to retrieve information from the  `.integration_knowledge*` system index [#237085](https://github.com/elastic/kibana/pull/237085)
- Adds file download relative URI to response actions that provide file output [#237713](https://github.com/elastic/kibana/pull/237713)
- Updates the UI and API for process descendants in trusted applications [#236318](https://github.com/elastic/kibana/pull/236318)
- Adds usage statistics collection for CSPM cloud connectors [#236992](https://github.com/elastic/kibana/pull/236992)
- Enhances the error message for malformed roles [#239098](https://github.com/elastic/kibana/pull/239098)
- Enables editing feature condition in the feature identification flyout and adds the **Open in Discover** button [#238646](https://github.com/elastic/kibana/pull/238646)
- Improves processing warnings for Streams [#239188](https://github.com/elastic/kibana/pull/239188)
- Enables AI-powered significant event identification for Streams [#239070](https://github.com/elastic/kibana/pull/239070)
- Enables numerical ID service for Cases [#238555](https://github.com/elastic/kibana/pull/238555)
- Adds agent ID as a default observables type [#238533](https://github.com/elastic/kibana/pull/238533)


### Fixes

- Updates `nodemailer` [#238816](https://github.com/elastic/kibana/pull/238816)
- Improves error handling on the **Visualize Listing** page [#238355](https://github.com/elastic/kibana/pull/238355)
- Prevents adhoc dataviews in ES|QL charts from being filtered out in the KQL search bar [#238731](https://github.com/elastic/kibana/pull/238731)
- Fixes a bug in Lens that broke **Click to filter** on table rows when any column was used as a formula [#239222](https://github.com/elastic/kibana/pull/239222)
- Fixes metric color assignment when breakdown and a max dimension are defined in Lens [#238901](https://github.com/elastic/kibana/pull/238901)
- Fixes "package not found" error when skipping cloud onboarding for a prerelease package [#238629](https://github.com/elastic/kibana/pull/238629)
- Fixes an issue with integration policy upgrades [#238542](https://github.com/elastic/kibana/pull/238542)
- Fixes `ignore_above` mapping for `flattened` fields [#238890](https://github.com/elastic/kibana/pull/238890)
- Fixes missing fields when using combined filters with the `ignoreFilterIfFieldNotInIndex` UI setting [#238945](https://github.com/elastic/kibana/pull/238945)
- Displays the available options when editing an existing variable control [#239315](https://github.com/elastic/kibana/pull/239315)
- Fixes `KEEP` behavior in ES|QL when a query initially returns no results [#239063](https://github.com/elastic/kibana/pull/239063)
- Adds a 10 second request timeout to ES|QL query execution [#238200](https://github.com/elastic/kibana/pull/238200)
- Uses `runWithCache` for bulk Fleet operations [#238326](https://github.com/elastic/kibana/pull/238326)
- Fixes error when Observability AI Assistant was disabled [#238811](https://github.com/elastic/kibana/pull/238811)
- Removes unecessary `_source` field from queries [#239205](https://github.com/elastic/kibana/pull/239205)
- Makes the rule condition chart parser replace metric names inside filter values (for example, A in "Accounts") [#238849](https://github.com/elastic/kibana/pull/238849)
- Fixes recover alert while monitor is down [#237479](https://github.com/elastic/kibana/pull/237479)
- Fixes layout of SLO management page combo box filter [#239418](https://github.com/elastic/kibana/pull/239418)
- Adds missing aria-label to BetaBadge component [#239400](https://github.com/elastic/kibana/pull/239400)
- Fixes the "missing authentication credentials" issue in `TelemetryConfigWatcher` and `PolicyWatcher` [#237796](https://github.com/elastic/kibana/pull/237796)
- Fixes an issue with Automatic Migration that prevented you from switching between migrations while translating rules [#238679](https://github.com/elastic/kibana/pull/238679)
- Fixes artifacts spaces migration (`v9.1`) to ensure all artifacts are processed [#238740](https://github.com/elastic/kibana/pull/238740)
- Checks for integrations permissions before loading component [#239122](https://github.com/elastic/kibana/pull/239122)
- Prioritizes connector `defaultModel` over stored conversation model [#237947](https://github.com/elastic/kibana/pull/237947)
- Deselects current selection after index pattern update [#239245](https://github.com/elastic/kibana/pull/239245)
- Fixes graph not rendering when switching tabs or refreshing the page [#238038](https://github.com/elastic/kibana/pull/238038)
- Adds unique accessible labels for **Show top field values** buttons [#237972](https://github.com/elastic/kibana/pull/237972)
- Fixes tool calling unavailable tools [#237174](https://github.com/elastic/kibana/pull/237174)
- Adds Jira's `otherFields` JSON editor to case creation flow [#238435](https://github.com/elastic/kibana/pull/238435)
- Updates connector API [#236863](https://github.com/elastic/kibana/pull/236863)
- Separates sync alert and auto-extract updates in activity log [#236519](https://github.com/elastic/kibana/pull/236519)
- Fixes auto extraction of observables in EASE [#239000](https://github.com/elastic/kibana/pull/239000)
- Removes `autoFocus` to preserve proper focus upon modal close [#239366](https://github.com/elastic/kibana/pull/239366)
- Adds manual focus to the Cases action button's actions [#239504](https://github.com/elastic/kibana/pull/239504)
- Fixes the behavior of Security serverless projects' Tier 1 and Tier 2 analyst roles by revoking their Endpoint exceptions read access


## October 15, 2025

- Elastic Cloud Serverless is now available in two new Amazon Web Services [regions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4226/deploy-manage/deploy/elastic-cloud/regions): `ap-northeast-1` (Tokyo) and `eu-west-2` (London)


## October 13, 2025


### Features and enhancements

- Adds a **Show agentless resources** toggle on the Fleet > Settings page for debugging and diagnostics [#237528](https://github.com/elastic/kibana/pull/237528)
- Allows you to carry over the controls when navigating to a dashboard, preserving the histogram [#237070](https://github.com/elastic/kibana/pull/237070)
- Enables the risk score reset feature [#237829](https://github.com/elastic/kibana/pull/237829)
- Uses ES|QL for calculating risk scores [#237871](https://github.com/elastic/kibana/pull/237871)
- Adds Security ML modules for GCP Audit and Azure Activity Logs [#236849](https://github.com/elastic/kibana/pull/236849)
- Removes the global empty state redirect [#237612](https://github.com/elastic/kibana/pull/237612)
- Replaces the existing document count chart with RED metrics [#236635](https://github.com/elastic/kibana/pull/236635)


### Fixes

- Fixes an error that occurred when deleting orphaned integration policies [#237875](https://github.com/elastic/kibana/pull/237875)
- Prevents creation of default alerts when no connectors are defined [#237504](https://github.com/elastic/kibana/pull/237504)
- Turns off the maximum attempts limit for the private locations sync task [#237784](https://github.com/elastic/kibana/pull/237784)
- Fixes a flyout rendering issue [#237840](https://github.com/elastic/kibana/pull/237840)
- Corrects icon colors in the side navigation [#237970](https://github.com/elastic/kibana/pull/237970)
- Fixes a bug that affected the controls on the Alerts page [#236756](https://github.com/elastic/kibana/pull/236756)
- Updates the names of the **Security solution default** and **Security solution alerts** data views in the data view picker [#238354](https://github.com/elastic/kibana/pull/238354)
- Fixes a bug that caused the flyout on the Files management page to crash when there were uploaded files [#237588](https://github.com/elastic/kibana/pull/237588)
- Introduces a separate error message for empty login attempts with `saml/oidc` providers [#237611](https://github.com/elastic/kibana/pull/237611)
- Fixes an issue in the component template creation flow where creating a new template with an `@custom` suffix in its name could incorrectly update mappings for unrelated data streams and trigger rollover prompts [#237952](https://github.com/elastic/kibana/pull/237952)
- Fixes an issue where the retriever query copied from the **Search your data** JavaScript tutorial failed with `parsing_exception` when passed as a query parameter in the Node.js client; retriever queries are now passed in the request body to ensure correct serialization [#237654](https://github.com/elastic/kibana/pull/237654)
- Ensures the Index management mappings editor synchronizes the model deployment status correctly [#237812](https://github.com/elastic/kibana/pull/237812)
- Fixes an accessibility issue where resetting changes or removing all terms in the Synonyms panel was not announced by screen readers [#237877](https://github.com/elastic/kibana/pull/237877)
- Fixes an issue in the RAG Playground where invalid fields were highlighted but no error message appeared [#238284](https://github.com/elastic/kibana/pull/238284)
- Improves the performance of the clustering algorithm [#238394](https://github.com/elastic/kibana/pull/238394)


## October 6, 2025


### Features and enhancements

- Adds support for encrypted headers in the Webhook connector to enhance security [#233695](https://github.com/elastic/kibana/pull/233695)
- Allows users to add custom fields to the IBM Resilient connector [#236144](https://github.com/elastic/kibana/pull/236144)
- Renames Fleet Server Host SSL options for clarity [#236887](https://github.com/elastic/kibana/pull/236887)
- Enables Discover tabs by default, allowing you to manage multiple data explorations in parallel [#235150](https://github.com/elastic/kibana/pull/235150)
- Automatically extracts case observables in the **Add to case** workflow [#233027](https://github.com/elastic/kibana/pull/233027)
- Introduces missing icons and updates v2 icons for the ECH Observability navigation [#236808](https://github.com/elastic/kibana/pull/236808)
- Adds a metrics dashboard for non-EDOT agents in the OpenTelemetry native ingestion path [#236978](https://github.com/elastic/kibana/pull/236978)
- Adds public APIs for Attack Discovery and Attack Discovery schedules [#236736](https://github.com/elastic/kibana/pull/236736)
- Enables automatic observable extraction in the Alerts table [#235433](https://github.com/elastic/kibana/pull/235433)
- Turns on the `newDataViewPickerEnabled` feature flag [#234101](https://github.com/elastic/kibana/pull/234101)
- Adds the ability to discover privileged users from the Entity Analytics Okta integration [#237129](https://github.com/elastic/kibana/pull/237129)
- Allows you to select which AI Assistant to show in the Elastic header; moves the **AI Assistant visibility** setting to the **GenAI Settings** page [#233727](https://github.com/elastic/kibana/pull/233727)
- Adds a new `update_all` endpoint for product documentation management [#231884](https://github.com/elastic/kibana/pull/231884)
- Adds an icon for Contextual AI in the AI Connector and Inference endpoint creation UI [#236951](https://github.com/elastic/kibana/pull/236951)
- Enables the new background search experience for improved performance [#236818](https://github.com/elastic/kibana/pull/236818)
- Adds triple-quote support to the Manual Ingest Pipeline Processor editor [#236595](https://github.com/elastic/kibana/pull/236595)
- Introduces the German locale for Kibana in `beta` [#236903](https://github.com/elastic/kibana/pull/236903)
- Adds an advanced option to disable filtering of file-backed volumes and CD-ROMs in the **Device Control** plugin [#236620](https://github.com/elastic/kibana/pull/236620)


### Fixes

- Rolls over the reporting data stream automatically when a newer template version is available [#234119](https://github.com/elastic/kibana/pull/234119)
- Fixes an issue where exported CSV columns in Lens tables could appear out of order [#236673](https://github.com/elastic/kibana/pull/236673)
- Fixes a bug causing Controls to fetch data twice [#237169](https://github.com/elastic/kibana/pull/237169)
- Removes the incorrect `fleet.ssl` configuration option [#236788](https://github.com/elastic/kibana/pull/236788)
- Fixes MSI commands (#233750) [#236994](https://github.com/elastic/kibana/pull/236994)
- Removes unnecessary span documents from the `getServiceAgent` function [#236732](https://github.com/elastic/kibana/pull/236732)
- Cleans up extra Synthetics package policies [#235200](https://github.com/elastic/kibana/pull/235200)
- Reverts a change to the page attachment type in Elastic Observability Serverless [#236958](https://github.com/elastic/kibana/pull/236958)
- Removes `null` values in the confirmation dialog when bulk-editing index patterns for rules [#236572](https://github.com/elastic/kibana/pull/236572)
- Increases the z-index of Timeline and related flyout components so they appear above the side navigation [#236655](https://github.com/elastic/kibana/pull/236655)
- Adds support for API key wildcard search [#221959](https://github.com/elastic/kibana/pull/221959)
- Hides the **Show forecast** button when changing jobs in the Single Metric Viewer [#236724](https://github.com/elastic/kibana/pull/236724)
- Improves performance of the Trained Models list [#237072](https://github.com/elastic/kibana/pull/237072)
- Fixes partition field settings errors in the Single Metric Viewer dashboard panels [#237046](https://github.com/elastic/kibana/pull/237046)
- Fixes layout issues with the **Parse in streams** button on smaller flyouts [#236548](https://github.com/elastic/kibana/pull/236548)
- Displays `(missing value)` and `(empty)` instead of `null` in charts and tables [#233369](https://github.com/elastic/kibana/pull/233369)
- Fixes privilege requirements for reindexing indices in Upgrade Assistant [#237055](https://github.com/elastic/kibana/pull/237055)


## September 29, 2025


### Features and enhancements

- Updates the Observability navigation menu [#236001](https://github.com/elastic/kibana/pull/236001)
- Enables cancelling response actions sent to hosts running Microsoft Defender Endpoint [#230399](https://github.com/elastic/kibana/pull/230399)
- Adds each alert's reason for closing to the Alerts page [#226590](https://github.com/elastic/kibana/pull/226590)
- Adds the Endpoint exceptions sub-privilege [#233433](https://github.com/elastic/kibana/pull/233433)
- Updates the source saved object schema to enable integrations sync markers [#236457](https://github.com/elastic/kibana/pull/236457)
- Updates the indicator details flyout [#230593](https://github.com/elastic/kibana/pull/230593)
- Adds an advanced policy `windows.advanced.firewall_anti_tamper` that lets you set the firewall anti-tamper plugin to off or detect-only [#236431](https://github.com/elastic/kibana/pull/236431)
- Displays document count chart for ES|QL categorize queries [#231459](https://github.com/elastic/kibana/pull/231459)
- Lets you manually map new fields from the schema editor [#235919](https://github.com/elastic/kibana/pull/235919)
- Adds AI-generative partition suggestions to Streams [#235759](https://github.com/elastic/kibana/pull/235759)
- In Streams, allows you to create routing conditions directly from preview table cells [#235560](https://github.com/elastic/kibana/pull/235560)
- Adds an option to convert an index to a lookup index to the **Manage index** menu [#233998](https://github.com/elastic/kibana/pull/233998)
- Improves code examples in the Synonyms UI [#235944](https://github.com/elastic/kibana/pull/235944)
- Automatically copies source data into the alerts-as-data documents for other ES Query rule types [#230010](https://github.com/elastic/kibana/pull/230010)
- Replaces the dashboard editor toolbar with the **Add** menu [#230324](https://github.com/elastic/kibana/pull/230324)
- Adds support for package spec v3.5 [#235942](https://github.com/elastic/kibana/pull/235942)
- Adds **View in discover** button in alert details page for SLO burn rate and ES query rules [#233855](https://github.com/elastic/kibana/pull/233855)


### Fixes

- Adjusts **Cancel** button height in Discover's tabs enabled view [#236118](https://github.com/elastic/kibana/pull/236118)
- Fixes dashboard title not updating when edited from content editor [#236561](https://github.com/elastic/kibana/pull/236561)
- Adds a unique count to transforms on the integrations overview to fix overcounting error [#236177](https://github.com/elastic/kibana/pull/236177)
- Fixes malformed synthetics package policies [#236176](https://github.com/elastic/kibana/pull/236176)
- Fixes controls trigger across various commands [#236121](https://github.com/elastic/kibana/pull/236121)
- Reverts filter policy inputs [#236104](https://github.com/elastic/kibana/pull/236104)
- Fixes the multiselect issue inside the toolbar selector when search is used [#236091](https://github.com/elastic/kibana/pull/236091)
- Integrates dataview logic into host KPIs charts [#236084](https://github.com/elastic/kibana/pull/236084)
- Fixes integrations RAG [#234211](https://github.com/elastic/kibana/pull/234211)
- Ensures the data view picker icon is always vertically centered [#236379](https://github.com/elastic/kibana/pull/236379)
- Fixes browser fields cache [#234381](https://github.com/elastic/kibana/pull/234381)
- Fixes the URL passed to detection rule actions using the `{{context.results_link}}` placeholder [#236067](https://github.com/elastic/kibana/pull/236067)
- Refactors `nav_control_popover` [#235780](https://github.com/elastic/kibana/pull/235780)
- Allows `xpack.spaces.defaultSolution` to be configured using docker [#236570](https://github.com/elastic/kibana/pull/236570)
- Fixes the Job details fly-out on the Analytics Map page [#236131](https://github.com/elastic/kibana/pull/236131)
- Limits `msearch` usage for log rate analysis [#235611](https://github.com/elastic/kibana/pull/235611)
- Fixes display of alerts from anomaly detection rules in [#236289](https://github.com/elastic/kibana/pull/236289)
- Adds `time` field to the get data views response schema [#235975](https://github.com/elastic/kibana/pull/235975)
- Adds `managed` field to the get data views response schema [#236237](https://github.com/elastic/kibana/pull/236237)
- Validates Logstash pipeline IDs sent to Kibana APIs [#236347](https://github.com/elastic/kibana/pull/236347)


## September 22, 2025


### Features and enhancements

- Adds a new connector for Jira Service Management [#235408](https://github.com/elastic/kibana/pull/235408)
- Adds OAuth2 client credentials authentication support to Kibana Webhook connectors [#218442](https://github.com/elastic/kibana/pull/218442)
- Completes OTel configuration pipelines by adding an exporter [#233090](https://github.com/elastic/kibana/pull/233090)
- Enables controls in Discover from the editor [#229598](https://github.com/elastic/kibana/pull/229598)
- Displays errors in the context of a trace [#234178](https://github.com/elastic/kibana/pull/234178)
- Creates functional tests for the Logs Essentials tier [#234904](https://github.com/elastic/kibana/pull/234904)
- Sets up the saved object infrastructure for Cloud Connectors and implements the end-to-end persistence flow for creating integrations with Cloud Connector support [#230137](https://github.com/elastic/kibana/pull/230137)
- Removes the **Tech Preview** badge and feature flag for Automatic Troubleshooting [#234853](https://github.com/elastic/kibana/pull/234853)
- Adds advanced options for opting out of collecting ransomware diagnostics on macOS [#235193](https://github.com/elastic/kibana/pull/235193)
- Adds the **Tech Preview** badge for the preconfigured `rerank` endpoint in the inference endpoints UI [#235222](https://github.com/elastic/kibana/pull/235222)
- Adds a default placeholder icon for future AI connectors [#235166](https://github.com/elastic/kibana/pull/235166)
- Adds search functionality to the Query rules details page [#232579](https://github.com/elastic/kibana/pull/232579)
- Adds a link to Agent Builder in the **View Data** dropdown [#234679](https://github.com/elastic/kibana/pull/234679)
- Adds the AutoOps Search tier page, which provides project-level insights and deeper insights into Serverless resources (VCUs) and performances

- Adds relevant attributes to search took time APM metrics [#134232](https://github.com/elastic/elasticsearch/pull/134232)
- Adds headers support for OpenAI chat completion [#134504](https://github.com/elastic/elasticsearch/pull/134504)
- Extends `kibana-system` permissions to manage security entities [#133968](https://github.com/elastic/elasticsearch/pull/133968)
- Tracks `shardStarted` events for simulation in `DesiredBalanceComputer` [#133630](https://github.com/elastic/elasticsearch/pull/133630)
- Adds file extension metadata to cache miss counter when it’s updated by `SharedBlobCacheService` [#134374](https://github.com/elastic/elasticsearch/pull/134374)
- Removes the `_type` deprecation warning in ingest conditional scripts [#134851](https://github.com/elastic/elasticsearch/pull/134851)
- Allows including semantic field embeddings in `_source` [#134717](https://github.com/elastic/elasticsearch/pull/134717)
- Integrates weights into simplified RRF retriever syntax [#132680](https://github.com/elastic/elasticsearch/pull/132680)
- Adjusts rollover criteria to have a better `max_age` rollover for tiny retentions [#134941](https://github.com/elastic/elasticsearch/pull/134941)
- Adds support for the `include_execution_metadata` parameter in ES|QL [#134446](https://github.com/elastic/elasticsearch/pull/134446)
- Adds telemetry support for Lookup Join On Expression in ES|QL [#134942](https://github.com/elastic/elasticsearch/pull/134942)
- Improves block loader for source-only runtime fields of type keyword [#135026](https://github.com/elastic/elasticsearch/pull/135026)
- Optimizes `BytesArray::indexOf` used in ndjson parsing [#135087](https://github.com/elastic/elasticsearch/pull/135087)
- Modifies `SecureString` methods (`equals`, `startsWith` and `regionMatches`) to operate in constant time relative to the length of the comparison string [#135053](https://github.com/elastic/elasticsearch/pull/135053)
- Updates URL encoding in ES|QL [#134503](https://github.com/elastic/elasticsearch/pull/134503)
- Adds new `/_security/stats` endpoint [#134835](https://github.com/elastic/elasticsearch/pull/134835)
- Makes the last source shard completely remove reshard metadata
- Adds a monitor for estimated heap usage


### Fixes

- Skips automatic scrolling when a panel is visible [#233226](https://github.com/elastic/kibana/pull/233226)
- Fixes an issue with the Actions column header size [#235227](https://github.com/elastic/kibana/pull/235227)
- Clears time field sorting when switching from classic to ES|QL mode [#235338](https://github.com/elastic/kibana/pull/235338)
- Fixes a bug where previously installed product docs (E5) were not upgraded during a Kibana version upgrade [#234792](https://github.com/elastic/kibana/pull/234792)
- Improves the accessibility of the badges on individual stream pages [#235625](https://github.com/elastic/kibana/pull/235625)
- Fixes the autocomplete configuration for the `pinned` retriever by removing the `match_criteria` field [#234903](https://github.com/elastic/kibana/pull/234903)
- Fixes a bug by allowing the use of `cmd + /` for comment toggling in the Monaco editor [#235334](https://github.com/elastic/kibana/pull/235334)
- Adds a check for all privileges for Elastic Security Serverless when creating lists [#234602](https://github.com/elastic/kibana/pull/234602)
- Fixes a bug to correctly update SLM stats when the master node is shut down after an SLM-triggered snapshot is completed [#134152](https://github.com/elastic/elasticsearch/pull/134152)
- Fixes a bug to facilitate second retrieval of the same value [#134790](https://github.com/elastic/elasticsearch/pull/134790)
- Avoids holding references to `SearchExecutionContext` in `SourceConfirmedTextQuery` [#134887](https://github.com/elastic/elasticsearch/pull/134887)
- Adds an exception for perform embedding inference requests which include a query [#131641](https://github.com/elastic/elasticsearch/pull/131641)
- Fixes a bug where the match only text block loader was not working correctly when a keyword multi-field was present [#134582](https://github.com/elastic/elasticsearch/pull/134582)
- Fixes conditional processor mutability bugs [#134936](https://github.com/elastic/elasticsearch/pull/134936)
- Fixes a bug where transforms did not wait for PITs to close [#134955](https://github.com/elastic/elasticsearch/pull/134955)
- Bypasses MMap arena grouping which caused issues with too many regions being mapped [#135012](https://github.com/elastic/elasticsearch/pull/135012)
- Fixes a deadlock in `ThreadPoolMergeScheduler` when a failing merge closes the `IndexWriter` [#134656](https://github.com/elastic/elasticsearch/pull/134656)
- Fixes `countDistinctWithConditions` in csv-spec tests [#135097](https://github.com/elastic/elasticsearch/pull/135097)
- Fixes a bug where `CentroidCalculator` did not return negative summation weights [#135176](https://github.com/elastic/elasticsearch/pull/135176)
- Limits the `topn` operations pushed to Lucene to 10,000 [#134497](https://github.com/elastic/elasticsearch/pull/134497)
- Bans `LIMIT` and `MV_EXPAND` before remote `ENRICH` [#135051](https://github.com/elastic/elasticsearch/pull/135051)
- Fixes expiration time in ES|QL async [#135209](https://github.com/elastic/elasticsearch/pull/135209)


## September 19, 2025


### Features and enhancements

- Elastic Cloud Serverless is now available in three new Google Cloud Platform [regions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4226/deploy-manage/deploy/elastic-cloud/regions): GCP South Carolina (`us-east1`), GCP Virginia (`us-east4`), and GCP Oregon (`us-west1`).


## September 15, 2025


### Features and enhancements

- Improves the ES|QL suggestions logic when a query changes [#231767](https://github.com/elastic/kibana/pull/231767)
- Updates the appearance popover in Lens metric charts [#233992](https://github.com/elastic/kibana/pull/233992)
- Adds support for installing `alerting_rule_template` assets from packages [#233533](https://github.com/elastic/kibana/pull/233533)
- Removes the default query limit of 10 [#234349](https://github.com/elastic/kibana/pull/234349)
- Adds support for remote cluster lookup mode indices in the editor [#232907](https://github.com/elastic/kibana/pull/232907)
- Extends ES|QL autocomplete to include columns from lookup indices and enrichment policies after `LOOKUP JOIN` and `ENRICH` commands [#233221](https://github.com/elastic/kibana/pull/233221)
- Adds a trace waterfall visualization for logs [#234072](https://github.com/elastic/kibana/pull/234072)
- Adds end-to-end UI tests for onboarding page validation [#232363](https://github.com/elastic/kibana/pull/232363)
- Updates the Playwright end-to-end tests to support Logs Essentials tier functionality [#234644](https://github.com/elastic/kibana/pull/234644)
- Introduces a Security Risk Scoring AI Assistant tool [#233647](https://github.com/elastic/kibana/pull/233647)
- Enables the SentinelOne `runscript` response action [#234492](https://github.com/elastic/kibana/pull/234492)
- Extends the `origin_info_collection` advanced policy setting to include `origin_url`, `origin_referrer_url`, and `Ext.windows.zone_identifier` fields for Windows process events [#234268](https://github.com/elastic/kibana/pull/234268)
- Restricts access to the Value report page to `admin` and `soc_manager` roles in complete tier [#234377](https://github.com/elastic/kibana/pull/234377)
- Ensures the **Tech Preview** badge is shown for the default inference endpoint for e5 on the inference endpoints UI [#234811](https://github.com/elastic/kibana/pull/234811)
- Ensures mapped fields are remembered across simulations [#233799](https://github.com/elastic/kibana/pull/233799)
- Adds time series telemetry in xpack usage [#134214](https://github.com/elastic/elasticsearch/pull/134214)


### Fixes

- Hides the side navigation during report generation [#234675](https://github.com/elastic/kibana/pull/234675)
- Fixes a bug where the save modal allowed duplicate saves of dashboards, visualizations, and other assets [#233933](https://github.com/elastic/kibana/pull/233933)
- Fixes an issue with special character handling when creating a pipeline from the flyout [#233651](https://github.com/elastic/kibana/pull/233651)
- Fixes a bug where the toggle column only worked on the Alerts page [#234278](https://github.com/elastic/kibana/pull/234278)
- Correctly updates the `@timestamp` and `event.ingested` fields when a privileged user is updated [#233735](https://github.com/elastic/kibana/pull/233735)
- Returns a `500` response code if there is an error during monitoring engine initialization [#234368](https://github.com/elastic/kibana/pull/234368)
- Fixes table highlighting issues in flyouts [#234222](https://github.com/elastic/kibana/pull/234222)
- Fixes issues in AI Assistant where it didn't append conversation messages or update titles [#233219](https://github.com/elastic/kibana/pull/233219)
- Enables repeated System Prompt navigation from the **Conversations** tab [#234812](https://github.com/elastic/kibana/pull/234812)
- Increases the `bulkGet` limit [#234151](https://github.com/elastic/kibana/pull/234151)
- Fixes an issue on the API Keys Management page that occurred when loading API keys with null names [#234083](https://github.com/elastic/kibana/pull/234083)
- Fixes an Anomaly Detection bug where custom URLs omitted generated fields in datafeed preview requests [#234709](https://github.com/elastic/kibana/pull/234709)
- Ensures full tool traces are displayed in flyouts [#234654](https://github.com/elastic/kibana/pull/234654)


## September 8, 2025


### Features and enhancements

- Makes maintenance windows globally available [#233870](https://github.com/elastic/kibana/pull/233870)
- Updates `@elastic/charts` to 71.0.0 and enables new metric chart in Lens [#229815](https://github.com/elastic/kibana/pull/229815)
- Adds toggle that grants permission for agents to write to `logs` datastream [#233374](https://github.com/elastic/kibana/pull/233374).
- Adds Knowledge Base integration support [#230107](https://github.com/elastic/kibana/pull/230107)
- Adds support for duration variable type to Fleet [#231027](https://github.com/elastic/kibana/pull/231027)
- Uses native function calling for self-managed LLMs [#232109](https://github.com/elastic/kibana/pull/232109)
- Unifies installation settings and improves status display for AI Assistant's Knowledge Base & product documentation [#232559](https://github.com/elastic/kibana/pull/232559)
- Links dashboards to SLO [#233265](https://github.com/elastic/kibana/pull/233265)
- Disables add-to-case functionality when all selected alerts are already attached [#231877](https://github.com/elastic/kibana/pull/231877)
- Disables save button on empty input [#233184](https://github.com/elastic/kibana/pull/233184)
- Adds **View in discover** button to alert details header [#233259](https://github.com/elastic/kibana/pull/233259)
- Adds `send_traces`, `send_metrics`, and `send_logs` agent configuration settings for EDOT Node.js [#233798](https://github.com/elastic/kibana/pull/233798)
- Updates missing index pattern table action [#233258](https://github.com/elastic/kibana/pull/233258)
- Shows trace context for logs [#232784](https://github.com/elastic/kibana/pull/232784)
- Adds IPv6 support to address fields in the Remote Clusters UI [#233415](https://github.com/elastic/kibana/pull/233415)
- Updates the Elasticsearch Serverless project creation in the UI to use the general purpose profile.
  The API continues to support alternative `optimized_for` options. Refer to [Elasticsearch Serverless billing dimensions > Managing Elasticsearch costs](/elastic/docs-content/pull/4226/deploy-manage/cloud-organization/billing/elasticsearch-billing-dimensions#elasticsearch-billing-managing-elasticsearch-costs).
  


### Fixes

- Fixes resize bug [#233755](https://github.com/elastic/kibana/pull/233755)
- Fixes the page height of the Observability AI Assistant page [#233924](https://github.com/elastic/kibana/pull/233924)
- Updates kibana MITRE data to `v17.1` [#231375](https://github.com/elastic/kibana/pull/231375)
- Fixes import of endpoint exceptions [#233142](https://github.com/elastic/kibana/pull/233142)
- Fixes a bug that affected display of mitre attack data [#233805](https://github.com/elastic/kibana/pull/233805).
- Prevents users who don't have crud privilege from deleting notes [#233948](https://github.com/elastic/kibana/pull/233948).
- Fixes rule editor flyout for Anomaly Explorer when no filter lists have been configured [#233085](https://github.com/elastic/kibana/pull/233085)
- Fixes `FormattedMessage` rendering escaped HTML instead of markup [#234079](https://github.com/elastic/kibana/pull/234079)


## September 1, 2025


### Features and enhancements

- Allows users to configure index settings when importing geospatial files in **File Upload** [#232308](https://github.com/elastic/kibana/pull/232308)
- Adds tooltip support for the ES|QL layer [#232147](https://github.com/elastic/kibana/pull/232147)
- Enables automatic content package installation when matching datasets are ingested using the `enableAutoInstallContentPackages` feature flag [#232668](https://github.com/elastic/kibana/pull/232668)
- Increases query history capacity to store more than 20 queries [#232955](https://github.com/elastic/kibana/pull/232955)
- Improves validation for functions in query inputs [#230139](https://github.com/elastic/kibana/pull/230139)
- Adds support for native function calling schema to the OpenAI connector when the API provider is set to "Other" [#232097](https://github.com/elastic/kibana/pull/232097)
- Retries inference calls when aborted due to transient errors [#232610](https://github.com/elastic/kibana/pull/232610)
- Adds the `raw_request` field to traces for better debugging [#232229](https://github.com/elastic/kibana/pull/232229)
- Adds dashboard references to SLO saved objects [#232583](https://github.com/elastic/kibana/pull/232583)
- Displays span links when APM indices are available [#232135](https://github.com/elastic/kibana/pull/232135)
- Adds a new `policy_response_failure` defend insight type [#231908](https://github.com/elastic/kibana/pull/231908)
- Enables conversation sharing in chat interfaces [#230614](https://github.com/elastic/kibana/pull/230614)
- Adds a new data view to the Privmon dashboard page [#233264](https://github.com/elastic/kibana/pull/233264)
- Improves the layout of custom URLs list in **Data Frame Analytics** [#232575](https://github.com/elastic/kibana/pull/232575)
- Adds icons for **AI21 Labs** and **Llama Stack** to the AI connector/inference endpoints creation UI [#232098](https://github.com/elastic/kibana/pull/232098)
- Ensures consistent Grok pattern generation across features [#230076](https://github.com/elastic/kibana/pull/230076)


### Fixes

- Ensures that maintenance windows with scoped queries apply to all rule types [#232307](https://github.com/elastic/kibana/pull/232307)
- Fixes pagination issues in alerting tables [#233030](https://github.com/elastic/kibana/pull/233030)
- Removes unused `availableOptions` from ES|QL values in query saved objects [#231690](https://github.com/elastic/kibana/pull/231690)
- Removes unnecessary output warning messages in Serverless deployments [#232785](https://github.com/elastic/kibana/pull/232785)
- Requires the `agents:all` privilege to use **Manage auto-upgrade agent** UI actions [#232429](https://github.com/elastic/kibana/pull/232429)
- Fixes read permission failures on the lookup indexes route [#233282](https://github.com/elastic/kibana/pull/233282)
- Refactors anonymization logic to walk JSON objects instead of stringifying them [#232319](https://github.com/elastic/kibana/pull/232319)
- Disables the **Save** button until a file is detected [#233141](https://github.com/elastic/kibana/pull/233141)
- Adds a missing **Alert details actions** button to the UI [#233113](https://github.com/elastic/kibana/pull/233113)
- Prevents SessionView crashes by normalizing event process arguments [#232462](https://github.com/elastic/kibana/pull/232462)
- Adds maximum function call limits to prevent recursive tool invocations [#231719](https://github.com/elastic/kibana/pull/231719)
- Ensures validation logic so the Elastic Managed LLM behaves as expected during testing [#231873](https://github.com/elastic/kibana/pull/231873)
- Fixes the **Restore status** tab display for system indices [#232839](https://github.com/elastic/kibana/pull/232839)
- Fixes responsiveness issues in the Stream management code editor area [#232630](https://github.com/elastic/kibana/pull/232630)
- Fixes an empty tooltip issue when creating tags [#232853](https://github.com/elastic/kibana/pull/232853)
- Fixes an issue where the **Create tag** modal wouldn't close properly [#233012](https://github.com/elastic/kibana/pull/233012)


## August 28, 2025


### Features and enhancements

- Elastic Cloud Serverless is now available in three new Microsoft Azure [regions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4226/deploy-manage/deploy/elastic-cloud/regions):
  - `northeurope` (North Europe), located in Ireland
- `australiaeast` (Australia East), located in Victoria, Australia
- ` westus2` (West US 2), located in Washington, United States


## August 25, 2025


### Features and enhancements

- Adds support for a new `url` variable type in Fleet packages, enabling improved input validation of URL values [#231062](https://github.com/elastic/kibana/pull/231062)
- Adds the `kibana.alert.grouping` field to the **Synthetics monitor status** rule in Elastic Observability Serverless  [#230513](https://github.com/elastic/kibana/pull/230513)
- Enables polling and sampling for EDOT central configuration in Elastic Observability Serverless [#231835](https://github.com/elastic/kibana/pull/231835)
- Adds a check to confirm that uploaded files are indexed and searchable in Machine learning [#231614](https://github.com/elastic/kibana/pull/231614)
- Updates sections and improves field handling in Machine learning [#231037](https://github.com/elastic/kibana/pull/231037)
- Improves the layout of the custom URLs list in Machine learning [#231751](https://github.com/elastic/kibana/pull/231751)
- Returns 429 status code instead of 500 for timeout handlers [#133111](https://github.com/elastic/elasticsearch/pull/133111)
- Allows configuring SAML private attributes [#133154](https://github.com/elastic/elasticsearch/pull/133154)


### Fixes

- Fixes a rendering issue that affected progress elements in Canvas [#232432](https://github.com/elastic/kibana/pull/232432)
- Fixes the enforcement of deployment mode restrictions when creating package policies in Fleet [#231679](https://github.com/elastic/kibana/pull/231679)
- Ensures transform index templates include `index.mapping.ignore_malformed: true` to prevent failures due to invalid values in source indices in Fleet [#232439](https://github.com/elastic/kibana/pull/232439)
- Fixes visibility issues with the DocViewer flyout in **Saved Search** embeddables in Discover [#229108](https://github.com/elastic/kibana/pull/229108)
- Restores legacy monitor filters in Elastic Observability Serverless [#231562](https://github.com/elastic/kibana/pull/231562)
- Handles multi-line values more reliably in Elastic Observability Serverless [#230929](https://github.com/elastic/kibana/pull/230929)
- Fixes broken views on AI Assistant settings pages for non-Enterprise license holders in Elastic Observability Serverless [#231989](https://github.com/elastic/kibana/pull/231989)
- Enables the recovery strategy toggle for monitor status rules in Elastic Observability Serverless [#231091](https://github.com/elastic/kibana/pull/231091)
- Fixes AI Assistant anonymization rules to avoid nested or overlapping masks when processing text in Elastic Observability Serverless [#231981](https://github.com/elastic/kibana/pull/231981)
- Fixes an issue that prevented the contextual flyout from showing full details in vulnerability findings in Elastic Security Serverless [#231778](https://github.com/elastic/kibana/pull/231778)
- Includes various bug fixes and improvements to the Manifest Manager in Elastic Security Serverless [#231039](https://github.com/elastic/kibana/pull/231039)
- Fixes an issue where the `unusedUrlsCLeanupTask` run interval did not update correctly when changed [#231883](https://github.com/elastic/kibana/pull/231883)
- Updates the prompt text for the `mv_slice` feature in Machine learning [#231870](https://github.com/elastic/kibana/pull/231870)
- Fixes a broken link in the **Build** breadcrumb that incorrectly pointed to the search indices page in Elasticsearch Serverless [#232504](https://github.com/elastic/kibana/pull/232504)
- Fixes inconsistencies in case activity statistics [#231948](https://github.com/elastic/kibana/pull/231948)
- Adds support for a `reporting_user` role with a reserved set of privileges [#231533](https://github.com/elastic/kibana/pull/231533)
- Fixes a bug where search failed when the bottom doc could not be formatted [#133188](https://github.com/elastic/elasticsearch/pull/133188)


## August 18, 2025


### Features and enhancements

- Removes the category selection step when adding filters to maintenance windows so you can add filters to maintenance windows based on alert fields from all solutions [#227888](https://github.com/elastic/kibana/pull/227888)
- Adds the ability to see all available log events in the shared logs overview even when ML features are not available [#225785](https://github.com/elastic/kibana/pull/225785)
- Improves Gemini prompts [#223476](https://github.com/elastic/kibana/pull/223476)
- Improves the AI Assistant Settings page by adding solution-specific logos [#224906](https://github.com/elastic/kibana/pull/224906)
- Enables the `trustedAppsAdvancedMode` feature flag by default [#230111](https://github.com/elastic/kibana/pull/230111)
- Updates the PrivMon UX [#231921](https://github.com/elastic/kibana/pull/231921)
- Improves error messages when your Kibana session fails to refresh a token [#231118](https://github.com/elastic/kibana/pull/231118)
- Adds inline markdown visualization [#229191](https://github.com/elastic/kibana/pull/229191)
- Adds an `AI` section to the `Stack Management` menu [#227289](https://github.com/elastic/kibana/pull/227289)
- Sets the default retention period for Logs anomaly detection to 120 days [#231080](https://github.com/elastic/kibana/pull/231080)
- Restricts indexing to child streams when streams mode is enabled [#132011](https://github.com/elastic/elasticsearch/pull/132011)
- Adds support for passing the `dimensions` field in the Google Vertex AI request [#132689](https://github.com/elastic/elasticsearch/pull/132689)


### Fixes

- Fixes a bug that stopped reports from spaces with a dash in them from appearing in the reporting list [#230876](https://github.com/elastic/kibana/pull/230876)
- Fixes Timeslider focus ring visibility in Firefox [#231351](https://github.com/elastic/kibana/pull/231351)
- Fixes error handling in the Links panel's **Save to library** modal [#231168](https://github.com/elastic/kibana/pull/231168)
- Fixes keyboard interaction on range slider control [#230893](https://github.com/elastic/kibana/pull/230893)
- Fixes older color mapping configuration in Lens [#231563](https://github.com/elastic/kibana/pull/231563)
- Fixes lost references when returning to unsaved dashboards with reference panels [#231517](https://github.com/elastic/kibana/pull/231517)
- Fixes rendering of aggregate metric fields in ES|QL mode [#231481](https://github.com/elastic/kibana/pull/231481)
- Disables sorting for json-like fields in ES|QL mode [#231289](https://github.com/elastic/kibana/pull/231289)
- Fixes a bug affecting the Inventory date picker's state [#231141](https://github.com/elastic/kibana/pull/231141)
- Fixes title generation for the Observability AI Assistant in conversations with self-managed LLMs [#231198](https://github.com/elastic/kibana/pull/231198)
- Fixes an endless loop that could occur during ES|QL `LOOKUP JOIN`s [#231217](https://github.com/elastic/kibana/pull/231217)
- Adjusts the Kubernetes OTel test to work in serverless nightly workflow [#231462](https://github.com/elastic/kibana/pull/231462)
- Updates the `ContentManagement` plugin to enable linked dashboards in more places [#229685](https://github.com/elastic/kibana/pull/229685)
- Provides the `aria-labelledby` attribute to the **Add cases** selector modal [#231887](https://github.com/elastic/kibana/pull/231887)
- Fixes incorrect threat enrichment for partially matched `AND` conditions in IM rules [#230773](https://github.com/elastic/kibana/pull/230773)
- Fixes Benchmark page accessibility issues [#229521](https://github.com/elastic/kibana/pull/229521)
- Fixes an issue that prevented the creation of Knowledge Base `Index` entries in deployments with a large number of indices and mappings [#231376](https://github.com/elastic/kibana/pull/231376)
- Fixes an index sync bug that prevented deletion of stale users [#229789](https://github.com/elastic/kibana/pull/229789)
- Fixes custom field grouping options in the Alerts table [#230121](https://github.com/elastic/kibana/pull/230121)
- Fixes a bug that made the ES|QL form read-only in the Rule upgrade flyout [#231699](https://github.com/elastic/kibana/pull/231699)
- Removes the default port the from interactive setup cluster address form, unless specified [#230582](https://github.com/elastic/kibana/pull/230582)
- Fixes positioning of the **Add rule** popover on the Role Mappings page [#231551](https://github.com/elastic/kibana/pull/231551)


## August 11, 2025


### Features and enhancements

- Adds **DOES NOT MATCH** capability to the IM rule type in Elastic Security Serverless [#227084](https://github.com/elastic/kibana/pull/227084)
- Adds Automatic Import documentation links to log descriptions and error messages [#229375](https://github.com/elastic/kibana/pull/229375)
- Improves dashboard usability at 400% zoom [#228978](https://github.com/elastic/kibana/pull/228978)
- Adds an **unsaved changes** modal in Discover [#225252](https://github.com/elastic/kibana/pull/225252)
- Adds a recovery mode switch for status alerts in Elastic Observability Serverless [#229962](https://github.com/elastic/kibana/pull/229962)
- Adds an error parameter to the agent config API in Elastic Observability Serverless [#230298](https://github.com/elastic/kibana/pull/230298)
- Adds an inference timeout to anonymization settings in Elastic Observability Serverless [#230640](https://github.com/elastic/kibana/pull/230640)
- Fetches referenced panels when loading dashboards in Elastic Observability Serverless [#228811](https://github.com/elastic/kibana/pull/228811)
- Installs product docs with KB installation in Elastic Observability Serverless [#228695](https://github.com/elastic/kibana/pull/228695)
- Links from alert details to related dashboards now include a time range filter in Elastic Observability Serverless [#230601](https://github.com/elastic/kibana/pull/230601)
- Updates the default Gemini model for the Gemini Connector in Playground from Gemini 1.5 Pro to Gemini 2.5 Pro in Elasticsearch Serverless [#230457](https://github.com/elastic/kibana/pull/230457)


### Fixes

- Removes unnecessary promises in dashboards [#230313](https://github.com/elastic/kibana/pull/230313)
- Fixes date math plus sign encoding in dashboards [#230469](https://github.com/elastic/kibana/pull/230469)
- Logs a warning if filter and query state are malformed in dashboards [#230088](https://github.com/elastic/kibana/pull/230088)
- Fixes duplicate panel action hangs when a dashboard has collapsed sections closed on page load [#230842](https://github.com/elastic/kibana/pull/230842)
- Fixes a screen reader–only header for accessibility in dashboards [#230470](https://github.com/elastic/kibana/pull/230470)
- Fixes missing validation errors in the package policy editor in Fleet [#229932](https://github.com/elastic/kibana/pull/229932)
- Fixes agentless integrations where `organization`, `division`, or `team` data fields were being overwritten by package metadata in Fleet [#230479](https://github.com/elastic/kibana/pull/230479)
- Fixes the output SSL config order in Fleet [#230758](https://github.com/elastic/kibana/pull/230758)
- Fixes glitches in the **data view creation** flyout in Discover when accessed from another page [#228749](https://github.com/elastic/kibana/pull/228749)
- Fixes a setup bug in the Elastic Observability Serverless lock manager [#230519](https://github.com/elastic/kibana/pull/230519)
- Adds a loading state in Elastic Observability Serverless for installing or uninstalling product docs [#229579](https://github.com/elastic/kibana/pull/229579)
- Includes a timestamp range filter to exclude the frozen tier in Elastic Observability Serverless [#230375](https://github.com/elastic/kibana/pull/230375)
- Adjusts e2e onboarding tests to work in Elastic Observability Serverless [#229969](https://github.com/elastic/kibana/pull/229969)
- Moves the `scheduleNow` call to the privmon engine init instead of the monitoring source engine in Elastic Security Serverless [#230263](https://github.com/elastic/kibana/pull/230263)
- Creates the Privileged user monitoring default index source only if it doesn't already exist in Elastic Security Serverless [#229693](https://github.com/elastic/kibana/pull/229693)
- Fixes Privileged user monitoring index sync in non-default spaces in Elastic Security Serverless [#230420](https://github.com/elastic/kibana/pull/230420)
- Adds a validation error if the actions throttle is shorter than the rule interval in Elastic Security Serverless [#229976](https://github.com/elastic/kibana/pull/229976)
- Excludes deprecated features from spaces solution visibility [#230385](https://github.com/elastic/kibana/pull/230385)
- Ensures form fields persist when validation fails in Machine Learning [#230321](https://github.com/elastic/kibana/pull/230321)
- Improves accessibility of the Streams table [#225659](https://github.com/elastic/kibana/pull/225659)
- Fixes a bug that prevented saving linked TSVB visualizations when changing the data view [#228685](https://github.com/elastic/kibana/pull/228685)
- Fixes a null property error in the Elasticsearch Serverless Playground [#230729](https://github.com/elastic/kibana/pull/230729)


## August 4, 2025


### Features and enhancements

- Updates AGENTLESS_DISABLED_INPUTS list in Fleet [#229117](https://github.com/elastic/kibana/pull/229117)
- Enables filter and saved query options in the optional Elastic Observability Serverless query filter [#229453](https://github.com/elastic/kibana/pull/229453)
- Introduces dashboard migration endpoints in Elastic Security Serverless [#229112](https://github.com/elastic/kibana/pull/229112)
- Adds the ability to save Playgrounds within a space in Elasticsearch Serverless [#229511](https://github.com/elastic/kibana/pull/229511)
- Enhances grok semantics extraction with Onigurama regex patterns in Discover [#229409](https://github.com/elastic/kibana/pull/229409)
- Adds **Prettify** button to the editor and removes the ability to unwrap in Discover [#228159](https://github.com/elastic/kibana/pull/228159)
- Adds support for expressions in Discover STATS [#229513](https://github.com/elastic/kibana/pull/229513)
- Allows pasting screenshots into Markdown comment fields for cases in Elastic Observability Serverless [#226077](https://github.com/elastic/kibana/pull/226077)
- Adds `detection_rule_upgrade_status` to snapshot telemetry in Elastic Security Serverless [#223086](https://github.com/elastic/kibana/pull/223086)
- Adds EASE value report in Elastic Security Serverless [#228877](https://github.com/elastic/kibana/pull/228877)
- Adds Machine Learning ability to filter AI Connector providers by solution type [#228116](https://github.com/elastic/kibana/pull/228116)
- Improves Console reliability by removing odd retry logic and adding Elasticsearch host selector [#229574](https://github.com/elastic/kibana/pull/229574)
- Improves rate limiter UX [#227678](https://github.com/elastic/kibana/pull/227678)
- Adds table list view to the space selector screen [#229046](https://github.com/elastic/kibana/pull/229046)
- Adds `kibana.alert.grouping` field to infra alerts [#229054](https://github.com/elastic/kibana/pull/229054)
- Skips search shards with `INDEX_REFRESH_BLOCK`
- Adds the `created_date` and `modified_date` system-managed properties to pipelines #130847](https://github.com/elastic/elasticsearch/pull/130847)
- Adds the `created_date` and `modified_date` system-managed properties to component templates [#131536](https://github.com/elastic/elasticsearch/pull/131536)
- Adds entity store and asset criticality index privileges to built-in roles [#129662](https://github.com/elastic/elasticsearch/pull/129662)
- Organization IdP routes are now public in the OpenAPI specifications.


### Fixes

- Fixes loading of saved queries in the Alerting rule definition [#229964](https://github.com/elastic/kibana/pull/229964)
- Fixes dashboard panel rendering when the defer-below-the-fold setting is on and panels are focused/unfocused [#229662](https://github.com/elastic/kibana/pull/229662)
- Fixes ESQL loading button state for long-running queries in **Lens** [#226565](https://github.com/elastic/kibana/pull/226565)
- Fixes extra padding below Advanced Options when inline editing in **Lens** [#229967](https://github.com/elastic/kibana/pull/229967)
- Improves Discover document viewer error handling where errors in one tab no longer break other tabs [#229220](https://github.com/elastic/kibana/pull/229220)
- Improves performance of breakdown field search in Discover [#229335](https://github.com/elastic/kibana/pull/229335)
- Enables **Save query** button after making changes in the Discover save query menu [#229053](https://github.com/elastic/kibana/pull/229053)
- Displays function license availability in Discover inline docs [#229961](https://github.com/elastic/kibana/pull/229961)
- Fixes incorrect filtering logic when removing a comment field in Discover [#230116](https://github.com/elastic/kibana/pull/230116)
- Modifies title generation to be scope-aware in Elastic Observability Serverless [#227434](https://github.com/elastic/kibana/pull/227434)
- Prevents destructive actions using the Elasticsearch tool in Elastic Observability Serverless [#229497](https://github.com/elastic/kibana/pull/229497)
- Replaces `EuiErrorBoundary` with `KibanaErrorBoundary` in Elastic Observability Serverless [#229710](https://github.com/elastic/kibana/pull/229710)
- Fixes keyboard accessibility for the Waterfall flyout in Elastic Observability Serverless [#229926](https://github.com/elastic/kibana/pull/229926)
- Allows knowledge base UI to work offline in Elastic Observability Serverless [#229874](https://github.com/elastic/kibana/pull/229874)
- Fixes diff display bug when importing rule customizations in Elastic Security Serverless [#228475](https://github.com/elastic/kibana/pull/228475)
- Adds missing announcements for filter in/out actions on bar charts in Elastic Security Serverless [#227388](https://github.com/elastic/kibana/pull/227388)
- Fixes toast counter badge stacking order [#229300](https://github.com/elastic/kibana/pull/229300)
- Fixes console error when adding Region map visualization for Machine Learning to a dashboard [#228669](https://github.com/elastic/kibana/pull/228669)
- Fixes product docs install logic when the target version is higher than the current version for Machine Learning [#229704](https://github.com/elastic/kibana/pull/229704)
- Adds support for the `name` attribute in create and update actions for saved objects [#228464](https://github.com/elastic/kibana/pull/228464)
- Fixes missing data view [#229467](https://github.com/elastic/kibana/pull/229467)


## July 28, 2025


### Features and enhancements

- Enhances the integrations overview by rendering an accordion for sample events in Data ingestion and Fleet [#228799](https://github.com/elastic/kibana/pull/228799)
- Displays related dashboard tags directly in the Elastic Observability Serverless UI [#228902](https://github.com/elastic/kibana/pull/228902)
- Adds the `kibana.alert.grouping` field to ES|QL rule definitions [#228580](https://github.com/elastic/kibana/pull/228580)
- Adds support for ingress IP filters. IP filter policies allow you to restrict traffic coming into your project to specific IP addresses or CIDR blocks.


### Fixes

- Fixes incorrect handling of the `pollEnabled` configuration in reporting [#228707](https://github.com/elastic/kibana/pull/228707)
- Fixes an issue in Firefox where scrolling was disabled in the **Lens** editor flyout [#228625](https://github.com/elastic/kibana/pull/228625)
- Fixes an issue in Firefox that prevented scrolling in the **ESQL** inline editor in Discover [#228849](https://github.com/elastic/kibana/pull/228849)
- Fixes an issue in *Lens* reports where PNG and PDF exports were clipped or misaligned [#228603](https://github.com/elastic/kibana/pull/228603)
- Corrects how the **Body cell lines** display option is handled when the default value is `-1` [#228697](https://github.com/elastic/kibana/pull/228697)
- Updates field stats logic to better select sub-fields when needed [#228969](https://github.com/elastic/kibana/pull/228969)
- Prevents search highlighting from affecting field action filters in the logs overview [#227652](https://github.com/elastic/kibana/pull/227652)
- Fixes an issue where dependency panels could infinitely load when no data was available [#228094](https://github.com/elastic/kibana/pull/228094)
- Fixes column sorting in the service error table [#229199](https://github.com/elastic/kibana/pull/229199)
- Ensures artifact links are visible even without endpoint list privileges [#226561](https://github.com/elastic/kibana/pull/226561)
- Fixes the incorrect background color in **Build Block Alerts** rows [#228226](https://github.com/elastic/kibana/pull/228226)
- Simplifies the **Misconfigurations** index pattern logic [#227995](https://github.com/elastic/kibana/pull/227995)
- Fixes an issue where **Security Assistant** settings landed on the wrong page when using a basic license [#229163](https://github.com/elastic/kibana/pull/229163)
- Removes the use of `removeIfExists` in the sync task scheduler [#228783](https://github.com/elastic/kibana/pull/228783)
- Fixes the width of the patterns field selector menu [#228791](https://github.com/elastic/kibana/pull/228791)
- Ensures the Gemini Vertex AI documentation link is available in the AI Connector [#228348](https://github.com/elastic/kibana/pull/228348)
- Fixes a skipped autocomplete test in the console [#229274](https://github.com/elastic/kibana/pull/229274)
- Ignores missing filters in rule parameters instead of causing errors [#229422](https://github.com/elastic/kibana/pull/229422)
- Fixes memory usage estimation for ELSER models [#131630](https://github.com/elastic/elasticsearch/pull/131630)


## July 22, 2025


### Features and enhancements

- Improves perceived performance for dashboard flyouts [#226052](https://github.com/elastic/kibana/pull/226052)
- Renders ES|QL controls using **OptionsList** UI components [#227334](https://github.com/elastic/kibana/pull/227334)
- Adds `MIGRATE` to signed actions [#228566](https://github.com/elastic/kibana/pull/228566)
- Excludes metrics data streams [#227842](https://github.com/elastic/kibana/pull/227842)
- Adds a package rollback API [#226754](https://github.com/elastic/kibana/pull/226754)
- Displays related error count and adds a failure badge [#227413](https://github.com/elastic/kibana/pull/227413)
- Adds form row labels to the ES|QL Editor [#228103](https://github.com/elastic/kibana/pull/228103)
- Registers a UI setting for anonymization [#224607](https://github.com/elastic/kibana/pull/224607)
- Adds support for span types [#227208](https://github.com/elastic/kibana/pull/227208)
- Introduces a public "test now" endpoint [#227760](https://github.com/elastic/kibana/pull/227760)
- Enables custom roles by default [#227878](https://github.com/elastic/kibana/pull/227878)
- Allows submitting case comments by pressing **⌘+Enter** (or **Ctrl+Enter**) [#228473](https://github.com/elastic/kibana/pull/228473)
- Increases the number of supported **Group by** fields in threshold rules from 3 to 5 [#227465](https://github.com/elastic/kibana/pull/227465)
- Adds the **Search AI Lake** view to AutoOps for Elastic Cloud Serverless to provide storage usage insights
- Fixes a semantic highlighting bug on flat quantized fields [#131525](https://github.com/elastic/elasticsearch/pull/131525)


### Fixes

- Fixes an issue in **Lens** where **Partition** charts (for example, Pie) blocked selection of legacy palettes [#228051](https://github.com/elastic/kibana/pull/228051)
- Correctly forwards the secondary prefix when the state value is an empty string (`None` option) in **Lens** [#228183](https://github.com/elastic/kibana/pull/228183)
- Fixes loading state and improves error handling in the dashboard save modal [#227861](https://github.com/elastic/kibana/pull/227861)
- Hides hidden indices from autocomplete when using a lookup index [#227819](https://github.com/elastic/kibana/pull/227819)
- Fixes incorrect validation between aggregation expressions [#227989](https://github.com/elastic/kibana/pull/227989)
- Fixes product docs installation status [#226919](https://github.com/elastic/kibana/pull/226919).
- Resolves issues in the `metric_item` component [#227969](https://github.com/elastic/kibana/pull/227969)
- Fixes a bug with the embeddings model dropdown when upgrading with a legacy endpoint [#226878](https://github.com/elastic/kibana/pull/226878)
- Fixes filtering by "unmodified" rules in the update table [#227859](https://github.com/elastic/kibana/pull/227859)
- Fixes an issue where alert status showed as untracked for newly created schedule rules [#226575](https://github.com/elastic/kibana/pull/226575)
- Improves copy in the bulk update modal [#227803](https://github.com/elastic/kibana/pull/227803).
- Enables soft-deleting of rule gaps on rule deletion [#227231](https://github.com/elastic/kibana/pull/227231)
- Migrates the anonymization in-memory table to `EuiBasicTable` for improved selection control [#222825](https://github.com/elastic/kibana/pull/222825)
- Fixes styling issues in flyouts [#228078](https://github.com/elastic/kibana/pull/228078)
- Fixes sub-menu behavior in the solution nav when collapsed [#227705](https://github.com/elastic/kibana/pull/227705)


## July 15, 2025


### Features and enhancements

- Elastic Cloud Serverless is now available in two new Amazon Web Services [regions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4226/deploy-manage/deploy/elastic-cloud/regions): `eu-central-1` (Frankfurt) and `us-east-2` (Ohio).
- Adds the ability to add tags from the **Agent details** page [#225433](https://github.com/elastic/kibana/pull/225433)
- Adds a **Profiles inspector** to Discover [#222999](https://github.com/elastic/kibana/pull/222999)
- Displays a callout about new rules in Elastic Observability Serverless **Metrics**, **Logs**, and **Inventory** rule types [#224387](https://github.com/elastic/kibana/pull/224387)
- Adds a manual test for bulk import functionality in Elastic Observability Serverless [#225497](https://github.com/elastic/kibana/pull/225497)
- Groups vulnerabilities by resource and cloud account using IDs instead of names in Elastic Security Serverless [#225492](https://github.com/elastic/kibana/pull/225492)
- Updates the default Gemini model in Elastic Security Serverless [#225917](https://github.com/elastic/kibana/pull/225917)
- Streamlines the side navigation in Elasticsearch Serverless [#225709](https://github.com/elastic/kibana/pull/225709)


### Fixes

- Fixes an issue where reports timed out and failed with an invalid header error [#225919](https://github.com/elastic/kibana/pull/225919)
- Ensures "Values from a query" options refresh when reloading dashboards [#225101](https://github.com/elastic/kibana/pull/225101)
- Removes warnings related to kebab-case naming [#226114](https://github.com/elastic/kibana/pull/226114)
- Prevents custom titles from being overwritten in Lens embeddables after reload [#225664](https://github.com/elastic/kibana/pull/225664)
- Prevents adhoc data views from being recommended in **Controls** [#225705](https://github.com/elastic/kibana/pull/225705)
- Hides the **Select all** checkbox in single-select controls [#226311](https://github.com/elastic/kibana/pull/226311)
- Fixes a bug where edited queries were overwritten when a request completed [#224671](https://github.com/elastic/kibana/pull/224671)
- Keeps the selected document stable when resizing the flyout with keyboard controls [#225594](https://github.com/elastic/kibana/pull/225594)
- Ensures suggested dashboards only appear for custom threshold alerts in Elastic Observability Serverless [#224458](https://github.com/elastic/kibana/pull/224458)
- Fixes schema page rendering issues in Elastic Observability Serverless [#225481](https://github.com/elastic/kibana/pull/225481)
- Limits environment name length when creating a Machine Learning job in Elastic Observability Serverless [#225973](https://github.com/elastic/kibana/pull/225973)
- Fixes broken **Operation** page in Elastic Observability Serverless [#226036](https://github.com/elastic/kibana/pull/226036)
- Fixes visual issues in Elastic Observability Serverless chat when `prefers-reduce-motion` is enabled [#226552](https://github.com/elastic/kibana/pull/226552)
- Prevents collapse of *query tool* calls in Elastic Observability Serverless [#226078](https://github.com/elastic/kibana/pull/226078)
- Adds a title to the rule gap histogram on the **Rules** dashboard in Elastic Security Serverless [#225274](https://github.com/elastic/kibana/pull/225274)
- Moves alerts redirect higher in the Elastic Security Serverless component tree to improve routing [#225650](https://github.com/elastic/kibana/pull/225650)
- Opens entity links in a flyout instead of navigating away in Elastic Security Serverless [#225381](https://github.com/elastic/kibana/pull/225381)
- Stops showing ML rule installation and upgrade errors on Basic license for Elastic Security Serverless [#224676](https://github.com/elastic/kibana/pull/224676)
- Updates the **Related Interactions** input placeholder and validation message in Elastic Security Serverless [#225775](https://github.com/elastic/kibana/pull/225775)
- Falls back to default value when `lookbackInterval` is empty in Anomaly Detection rules [#225249](https://github.com/elastic/kibana/pull/225249)
- Fixes time range handling in embedded anomaly swim lanes [#225803](https://github.com/elastic/kibana/pull/225803)
- Adds discernible text to the **Refresh data preview** button [#225816](https://github.com/elastic/kibana/pull/225816)
- Improves error handling in **Search Playground** when context limit is exceeded using Elastic Managed LLM [#225360](https://github.com/elastic/kibana/pull/225360)


## July 7, 2025


### Features and enhancements

- Adds action to add or remove tags on the **Agent details** page in Fleet [#225433](https://github.com/elastic/kibana/pull/225433)
- Adds a new **Profiles** tab to the Inspector flyout in Discover [#222999](https://github.com/elastic/kibana/pull/222999)
- Adds new rules callout to Metric, Logs, and Inventory rules in Elastic Observability Serverless [#224387](https://github.com/elastic/kibana/pull/224387)
- Adds manual test for bulk import functionality in Elastic Observability Serverless [#225497](https://github.com/elastic/kibana/pull/225497)
- Uses `id` instead of `name` to group vulnerabilities by resource and cloud account in Elastic Security Serverless [#225492](https://github.com/elastic/kibana/pull/225492)
- Updates Gemini model in Elastic Security Serverless [#225917](https://github.com/elastic/kibana/pull/225917)
- Updates the navigation menu in Elasticsearch Serverless [#225709](https://github.com/elastic/kibana/pull/225709)
- Adds performance charts to the **Usage and performance** section on the project overview page in Elastic Cloud Serverless


### Fixes

- Fixes an issue causing reports to fail with an invalid header error [#225919](https://github.com/elastic/kibana/pull/225919)
- Refreshes `Values from a query` options upon dashboard reload [#225101](https://github.com/elastic/kibana/pull/225101)
- Removes kebab-case warnings in Console [#226114](https://github.com/elastic/kibana/pull/226114)
- Fixes the default title being overwritten by a custom title upon reload in Lens [#225664](https://github.com/elastic/kibana/pull/225664)
- Fixes an issue with dashboards where adhoc dataviews were recommended as most relevant when creating a control [#225705](https://github.com/elastic/kibana/pull/225705)
- Hides the **Select all** checkbox from single select controls in dashboards [#226311](https://github.com/elastic/kibana/pull/226311)
- Fixes edited query being overwritten by the original query when it is resolved in Discover [#224671](https://github.com/elastic/kibana/pull/224671)
- Prevents selected document from changing when resizing the **Document** flyout with a keyboard in Discover [#225594](https://github.com/elastic/kibana/pull/225594)
- Only returns suggested dashboards for custom threshold alerts in Elastic Observability Serverless [#224458](https://github.com/elastic/kibana/pull/224458)
- Fixes `Unable to load page` error on the **Schema** page in Elastic Observability Serverless [#225481](https://github.com/elastic/kibana/pull/225481)
- Limits environment name length when creating an ML job in Elastic Observability Serverless [#225973](https://github.com/elastic/kibana/pull/225973)
- Fixes `Unable to load page` error on the **Operations** page in Elastic Observability Serverless [#226036](https://github.com/elastic/kibana/pull/226036)
- Fixes an issue with the AI assistant chat display in Elastic Observability Serverless when a device has `Reduce motion` turned on [#226552](https://github.com/elastic/kibana/pull/226552)
- Collapses *query tool calls in Elastic Observability Serverless [#226078](https://github.com/elastic/kibana/pull/226078)
- Adds a title to the rule gap histogram in the **Rules** dashboard in Elastic Security Serverless [#225274](https://github.com/elastic/kibana/pull/225274)
- Moves the alerts redirect higher in the components tree in Elastic Security Serverless [#225650](https://github.com/elastic/kibana/pull/225650)
- Updates entity links across Elastic Security Serverless to open flyouts instead of redirecting to other pages [#225381](https://github.com/elastic/kibana/pull/225381)
- Stops ML rule installation and upgrade errors from showing up for users with Basic licenses [#224676](https://github.com/elastic/kibana/pull/224676)
- Updates placeholder text and validation message for **Related integrations** in Elastic Security Serverless  [#225775](https://github.com/elastic/kibana/pull/225775)
- Resets to the default value when the `lookbackInterval` field is empty in Machine Learning [#225249](https://github.com/elastic/kibana/pull/225249)
- Fixes the handling of time range in embedded anomaly swim lane in Machine Learning [#225803](https://github.com/elastic/kibana/pull/225803)
- Adds discernible text to the refresh button on the **Streams** > **Processing** page [#225816](https://github.com/elastic/kibana/pull/225816)
- Fixes handling of context limit errors in Playground when using the Elastic Managed LLM [#225360](https://github.com/elastic/kibana/pull/225360)


## June 30, 2025


### Features and enhancements

- Adds the ability to schedule reports with a recurring schedule and view previously scheduled reports [#224849](https://github.com/elastic/kibana/pull/224849)
- Adds internal CRUD API routes in *Lens* [#223296](https://github.com/elastic/kibana/pull/223296)
- Adds `Select all` and `Deselect all` buttons to the options list popover to allow you to make bulk selections in Dashboards and Visualizations [#221010](https://github.com/elastic/kibana/pull/221010)
- Adds the flip LOOKUP JOIN parameter in ES|QL to GA in docs [#225117](https://github.com/elastic/kibana/pull/225117)
- Passes the `TimeRange` into the `getESQLResults` in order for queries with `_tstart` and `_tend` to work properly in Discover [#225054](https://github.com/elastic/kibana/pull/225054)
- Enables the "expand to fit" query function on mount in Discover [#225509](https://github.com/elastic/kibana/pull/225509)
- Adds Logs Essentials for APM/Infra in Elastic Observability Serverless [#223030](https://github.com/elastic/kibana/pull/223030)
- Allows users to choose which space monitors will be available in Elastic Observability Serverless [#221568](https://github.com/elastic/kibana/pull/221568)
- Remaps `iInCircle` and `questionInCircle`, and deprecates the `help` icon in the global header [#223142](https://github.com/elastic/kibana/pull/223142)
- Adds docs for the chat completion public API in Elastic Observability Serverless [#224235](https://github.com/elastic/kibana/pull/224235)
- Enables the Security Entity Analytics Privileged user monitoring feature in Elastic Security Serverless [#224638](https://github.com/elastic/kibana/pull/224638)
- Displays visualizations in the key insights panel of the Privileged User Monitoring dashboard in Elastic Security Serverless [#223092](https://github.com/elastic/kibana/pull/223092)
- Introduces a new UI to optionally update the `kibana.alert.workflow_status` field for alerts associated with Attack discoveries in Elastic Security Serverless [#225029](https://github.com/elastic/kibana/pull/225029)
- Enables the runscript feature flag in Elastic Security Serverless [#224819](https://github.com/elastic/kibana/pull/224819)
- Adds the incremental ID service; exposes the ID in the UI in Elastic Security Serverless [#222874](https://github.com/elastic/kibana/pull/222874)
- Adds the `windows.advanced.events.security.provider_etw` field as an advanced policy option in Elastic Defend in Elastic Security Serverless [#222197](https://github.com/elastic/kibana/pull/222197)
- Adds new starter prompts to the AI Assistant in Elastic Security Serverless [#224981](https://github.com/elastic/kibana/pull/224981)
- Adds the ability to revert prebuilt rules to their base version in Elastic Security Serverless [#223301](https://github.com/elastic/kibana/pull/223301)
- Adds support for a collapsible section in the integration readme in Kibana Security [#223916](https://github.com/elastic/kibana/pull/223916)
- Adds new severity colors, alignment, and UX for filtering anomalies in Machine learning [#221081](https://github.com/elastic/kibana/pull/221081)
- Updates NL-2-ESQL docs [#224868](https://github.com/elastic/kibana/pull/224868)
- Adds keyword highlighting for ES|QL patterns, and the ability to open a new Discover tab to filter for docs that match the selected pattern [#222871](https://github.com/elastic/kibana/pull/222871)
- Enables adaptive allocations and allows you to set max allocations in Machine learning [#222726](https://github.com/elastic/kibana/pull/222726)
- Adds a loading indicator while data sources are being fetched [#225005](https://github.com/elastic/kibana/pull/225005)
- Introduces a new home page in Elasticsearch Serverless [#223172](https://github.com/elastic/kibana/pull/223172)
- Adds a Search Home page in Elastic Stack classic and the solution navigation in Elasticsearch Serverless [#225162](https://github.com/elastic/kibana/pull/225162)
- Adds updates to streamline the solution navigation in Elasticsearch Serverless [#224755](https://github.com/elastic/kibana/pull/224755)


### Fixes

- Fixes the panel title sync with saved object when using `defaultTitle` in Dashboards and Visualizations [#225237](https://github.com/elastic/kibana/pull/225237)
- Fixes a performance issue in the Lens ES|QL charts in Dashboards and Visualizations [#225067](https://github.com/elastic/kibana/pull/225067)
- Fixes visual issues with truncated long labels and hover styles in Dashboards and Visualizations [#225430](https://github.com/elastic/kibana/pull/225430)
- Fixes controls selections that caused multiple fetches in Dashboards and Visualizations [#224761](https://github.com/elastic/kibana/pull/224761)
- Ensures package policy names are unique when moving across spaces in Data ingestion and Fleet [#224804](https://github.com/elastic/kibana/pull/224804)
- Fixes export CSV in the Agent list in Data ingestion and Fleet [#225050](https://github.com/elastic/kibana/pull/225050)
- Replaces call to registry when deleting Kibana assets for custom packages in Data ingestion and Fleet [#224886](https://github.com/elastic/kibana/pull/224886)
- Fixes UI error when no tags filter is selected in Data ingestion and Fleet [#225413](https://github.com/elastic/kibana/pull/225413)
- Uses bulk helper for bulk importing knowledge base entries in Elastic Observability Serverless [#223526](https://github.com/elastic/kibana/pull/223526)
- Improves the knowledge base retrieval by rewriting the user prompt before querying Elasticsearch in Elastic Observability Serverless [#224498](https://github.com/elastic/kibana/pull/224498)
- Fixes the Agent Explorer page in Elastic Observability Serverless [#225071](https://github.com/elastic/kibana/pull/225071)
- Hides Settings from serverless navigation in Elastic Observability Serverless [#225436](https://github.com/elastic/kibana/pull/225436)
- Replaces hard-coded CSS values to us the `euiTheme` instead in Elastic Security Serverless [#225307](https://github.com/elastic/kibana/pull/225307)
- Fixes URL query handling for asset inventory flyout in Elastic Security Serverless [#225199](https://github.com/elastic/kibana/pull/225199)
- Adds missing model Claude 3.7 to accepted models in Elasticsearch Serverless [#224943](https://github.com/elastic/kibana/pull/224943)


## June 26, 2025


### Features and enhancements

- Elastic Cloud Serverless is now available in the Microsoft Azure `eastus` [region](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4226/deploy-manage/deploy/elastic-cloud/regions).


## June 23, 2025


### Features and enhancements

- Adds new setting `xpack.actions.webhook.ssl.pfx.enabled` to disable PFX file support for SSL client authentication in Webhook connectors [#222507](https://github.com/elastic/kibana/pull/222507)
- Introduces **Scheduled Reports** feature [#221028](https://github.com/elastic/kibana/pull/221028)
- Adds `xpack.actions.email.services.enabled` setting to control availability of email services in connectors [#223363](https://github.com/elastic/kibana/pull/223363)
- Enables support for adding observables, procedures, and custom fields to alerts for TheHive [#207255](https://github.com/elastic/kibana/pull/207255)
- Improves visual highlight behavior in the add panel UI [#223614](https://github.com/elastic/kibana/pull/223614)
- Supports agentless traffic filters for Elastic Agent [#222082](https://github.com/elastic/kibana/pull/222082)
- Adds support for suggesting all operators in the query editor [#223503](https://github.com/elastic/kibana/pull/223503)
- Introduces accordion sections and attribute tables in UI components [#224185](https://github.com/elastic/kibana/pull/224185)
- Adds monitor downtime alert when no data is available [#220127](https://github.com/elastic/kibana/pull/220127)
- Introduces **Maintenance Windows** functionality [#222174](https://github.com/elastic/kibana/pull/222174)
- Enables editing of labels and tags for private locations in **Synthetics** [#221515](https://github.com/elastic/kibana/pull/221515)
- Adds new tail-based sampling settings to integration policies [#224479](https://github.com/elastic/kibana/pull/224479)
- Enables model ID retrieval from anonymization rules [#224280](https://github.com/elastic/kibana/pull/224280)
- Updates SLO starter prompt text for improved guidance [#224493](https://github.com/elastic/kibana/pull/224493)
- Introduces `deactivate_...` agent configuration settings for EDOT Node.js [#224502](https://github.com/elastic/kibana/pull/224502)
- Updates system prompt to include information about anonymization [#224211](https://github.com/elastic/kibana/pull/224211)
- Adds support for Microsoft Defender's `runscript` command in the **Response Console** [#222377](https://github.com/elastic/kibana/pull/222377)
- Moves Automatic Migration from **Tech Preview** to General Availability [#224544](https://github.com/elastic/kibana/pull/224544)
- Adds simplified bulk editing for alert suppression rules [#223090](https://github.com/elastic/kibana/pull/223090)
- Introduces **XSOAR Connector** [#212049](https://github.com/elastic/kibana/pull/212049)
- Adds `name` field to the Rule Migrations UI and data model [#223860](https://github.com/elastic/kibana/pull/223860)
- Enables collection of `dns` events for macOS in **Elastic Defend** [#223566](https://github.com/elastic/kibana/pull/223566)
- Adds usage callout for **Elastic Indexing Service (EIS)** [#221566](https://github.com/elastic/kibana/pull/221566)
- Adds `ecs@mappings` component template to transform destination index templates [#223878](https://github.com/elastic/kibana/pull/223878)
- Renames advanced policy setting `disable_origin_info_collection` to `origin_info_collection` and changed its default behavior to Opt-In [#223882](https://github.com/elastic/kibana/pull/223882)
- Introduces cleanup task for unused URLs [#220138](https://github.com/elastic/kibana/pull/220138)
- Marks the **Session Invalidation API** as Stable [#224076](https://github.com/elastic/kibana/pull/224076)
- Hides the Adaptive Allocations toggle for Trained Models in **Serverless** environments [#224097](https://github.com/elastic/kibana/pull/224097)
- Adds option to disable **AIOps** features in Kibana [#221286](https://github.com/elastic/kibana/pull/221286)
- Enables autocompletion for **ESQL** queries in the Console UI [#219980](https://github.com/elastic/kibana/pull/219980)
- Improves layout and content of rule listing and overview pages [#223603](https://github.com/elastic/kibana/pull/223603)
- Adds support for changing settings when re-processing Rule Migrations [#222542](https://github.com/elastic/kibana/pull/222542)
- Implements navigation UI for the **Overview Page** in **Entity Analytics** [#221748](https://github.com/elastic/kibana/pull/221748)
- Adds support for partial result handling in **ESQL** [#223198](https://github.com/elastic/kibana/pull/223198)
- Adds an **Executable Name** tab to the TopN view [#224291](https://github.com/elastic/kibana/pull/224291)
- Upgrades the Lucene version to 10.2.2 [#129546](https://github.com/elastic/elasticsearch/pull/129546)
- Adds a simplified syntax for the `linear` retriever [#129200](https://github.com/elastic/elasticsearch/pull/129200)


### Fixes

- Fixes pagination not working correctly in certain tables [#223537](https://github.com/elastic/kibana/pull/223537)
- Fixes bulk actions selecting incorrect agents when `namespace` filter is used [#224036](https://github.com/elastic/kibana/pull/224036)
- Corrects `z-index` issues in the **ESQL Query Editor** [#222841](https://github.com/elastic/kibana/pull/222841)
- Updates ARIA tags for improved accessibility in selected fields UI [#224224](https://github.com/elastic/kibana/pull/224224)
- Ensures **Last Successful Screenshot** matches the correct step in Synthetics [#224220](https://github.com/elastic/kibana/pull/224220)
- Improves network error handling for error details panel [#224296](https://github.com/elastic/kibana/pull/224296)
- Fixes broken **EDOT JVM Metrics Dashboard** when classic agent metrics are present [#224052](https://github.com/elastic/kibana/pull/224052)
- Fixes **SLO federated view** bug caused by exceeding index name byte limit [#224478](https://github.com/elastic/kibana/pull/224478)
- Fixes issue where OSS models failed when streaming was enabled [#224129](https://github.com/elastic/kibana/pull/224129)
- Corrects display issues for rule filters in the UI [#222963](https://github.com/elastic/kibana/pull/222963)
- Fixes time normalization bug for day units in rule scheduling [#224083](https://github.com/elastic/kibana/pull/224083)
- Resolves issue where unknown fields weren't supported in **Data Visualizer** and **Field Statistics** [#223903](https://github.com/elastic/kibana/pull/223903)
- Fixes Bedrock connector not using proxy configuration settings [#224130](https://github.com/elastic/kibana/pull/224130)
- Passes correct namespace to `migrateInputDocument` logic [#222313](https://github.com/elastic/kibana/pull/222313)
- Adjusts app menu header `z-index` to avoid clashing with the portable dev console [#224708](https://github.com/elastic/kibana/pull/224708)
- Reverts to using `.watches` system index in Watcher UI [#223898](https://github.com/elastic/kibana/pull/223898)
- Fixes several issues introduced in versions 8.18.0 through 9.1.0, including broken pagination (limited to 10 items), erroneous error banners, and broken search functionality.
- Fixes **Discard** button state change logic for toggles [#223493](https://github.com/elastic/kibana/pull/223493)
- Removes `originId` from connectors during rule import [#223454](https://github.com/elastic/kibana/pull/223454)


## June 17, 2025


### Features and enhancements

- Elastic Cloud Serverless is now available in two new Google Cloud Platform [regions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4226/deploy-manage/deploy/elastic-cloud/regions): GCP Belgium (`europe-west1`) and GCP Mumbai (`asia-south1`)


## June 16, 2025


### Features and enhancements

- Adds support for deleting active or inactive alerts after one day without a status update [#216613](https://github.com/elastic/kibana/pull/216613)
- Adds AWS SES email configuration options: `xpack.actions.email.services.ses.host` and `ses.port` [#221389](https://github.com/elastic/kibana/pull/221389)
- Adds point visibility option for area and line charts in **Lens** [#222187](https://github.com/elastic/kibana/pull/222187)
- Enables feature flag for the tabular integrations Fleet UI [#222842](https://github.com/elastic/kibana/pull/222842)
- Displays partial results when an ESQL query times out due to the `search:timeout` setting [#219027](https://github.com/elastic/kibana/pull/219027)
- Improves handling of long fields in the **Discover** editor [#223222](https://github.com/elastic/kibana/pull/223222)
- Adds a primary **Add to case** button to Elastic Observability Serverless [#223184](https://github.com/elastic/kibana/pull/223184)
- Renders suggested dashboards in relevant contexts in Elastic Observability Serverless [#223424](https://github.com/elastic/kibana/pull/223424)
- Adds a **History** tab for calendar-based SLOs in the Elastic Observability Serverless SLO details page [#223825](https://github.com/elastic/kibana/pull/223825)
- Updates the `spec.max` setting to version 3.4 for Elastic Observability Serverless [#221544](https://github.com/elastic/kibana/pull/221544)
- Adds support for anonymizing sensitive data for Elastic Observability Serverless [#223351](https://github.com/elastic/kibana/pull/223351)
- Adds `logging_level` configuration in Elastic Observability Serverless for EDOT Node.js agent [#222883](https://github.com/elastic/kibana/pull/222883)
- Removes `is_correction` and `confidence` attributes from Elastic Observability Serverless Knowledge Base entries [#222814](https://github.com/elastic/kibana/pull/222814)
- Displays linked cases in the Elastic Observability Serverless alert details overview [#222903](https://github.com/elastic/kibana/pull/222903)
- Refetches alert rule data when edits are submitted in the Elastic Observability Serverless flyout [#222118](https://github.com/elastic/kibana/pull/222118)
- Adds `disable_origin_info_collection` to endpoint policy advanced settings in Elastic Security Serverless [#222030](https://github.com/elastic/kibana/pull/222030)
- Improves alert filtering in Elastic Security Serverless by including ECS `data_stream` fields under `kibana.alert.original_data_stream.*` [#220447](https://github.com/elastic/kibana/pull/220447)
- Adds a rare scripts job to the preconfigured Security:Windows anomaly detection jobs [#223041](https://github.com/elastic/kibana/pull/223041)
- Adds `converse` and `converseStream` subActions to Bedrock connectors for Machine Learning [#223033](https://github.com/elastic/kibana/pull/223033)
- Improves error handling in the AI Connector creation UI for Machine Learning [#221859](https://github.com/elastic/kibana/pull/221859)
- Disables trace visualizations in **Discover** for Logs Essentials serverless mode in Elastic Observability Serverles [#222991](https://github.com/elastic/kibana/pull/222991)
- Adds the **Attributes** tab to the Elastic Observability Serverless document viewer [#222391](https://github.com/elastic/kibana/pull/222391)


### Fixes

- Reverts instructions for installing the complete Elastic Agent [#223520](https://github.com/elastic/kibana/pull/223520)
- Fixes incorrect function signatures in bucket functions for **Discover** [#222553](https://github.com/elastic/kibana/pull/222553)
- Reverts CSV export time range fix in **Discover** [#223249](https://github.com/elastic/kibana/pull/223249)
- Adds `aria-labelledby` to Elastic Charts SVG for accessibility in Elastic Observability Serverless [#220298](https://github.com/elastic/kibana/pull/220298)
- Hides **Data set details** when `dataStream` comes from a remote cluster in Elastic Observability Serverless [#220529](https://github.com/elastic/kibana/pull/220529)
- Prevents unnecessary re-render after completing a **Run test** action in Elastic Observability Serverless [#222503](https://github.com/elastic/kibana/pull/222503)
- Skips tool instructions in system messages when tools are disabled in Elastic Observability Serverless [#223278](https://github.com/elastic/kibana/pull/223278)
- Fixes broken **View in Discover** link in Elastic Security Serverless [#217993](https://github.com/elastic/kibana/pull/217993)
- Expands metrics pattern for the Java EDOT dashboard  in Elastic Observability Serverless [#223539](https://github.com/elastic/kibana/pull/223539)
- Applies `autoFocus` to the `cc` and `bcc` fields in the Elastic Observability Serverless email connector form [#223828](https://github.com/elastic/kibana/pull/223828)
- Fixes rendering issues in the Elastic Security Serverless Threat Enrichment component [#223164](https://github.com/elastic/kibana/pull/223164)
- Ensures ingest pipelines are installed in all relevant spaces and assigned to appropriate indices in Elastic Security Serverless [#221937](https://github.com/elastic/kibana/pull/221937)
- Fixes card overflow issues on the **Machine Learning Overview** page [#223431](https://github.com/elastic/kibana/pull/223431)
- Applies chunking algorithm to `getIndexBasicStats` to improve performance [#221153](https://github.com/elastic/kibana/pull/221153)


## June 9, 2025


### Features and enhancements

- Ensures the Report UI only displays reports generated in the current space [#221375](https://github.com/elastic/kibana/pull/221375).
- Color mapping is now GA. `palette` definitions are deprecated and turning off Legacy mode will replace the palette with an equivalent color mapping configuration in* **Lens**. [#220296](https://github.com/elastic/kibana/pull/220296).
- Updates time based charts to use the multi-layer time axis by default, providing a better time window context and improved label positioning. [#210579](https://github.com/elastic/kibana/pull/210579).
- Adds an integration flyout to Agent policy details in Fleet [#220229](https://github.com/elastic/kibana/pull/220229).
- Enables the `enableSyncIntegrationsOnRemote` feature flag in Fleet [#220215](https://github.com/elastic/kibana/pull/220215).
- Enables migration of a single agent to another cluster using the actions menu in Fleet. [#222111](https://github.com/elastic/kibana/pull/222111).
- Adds a button allowing users to skip to the next section in the fields list in **Discover** [#221792](https://github.com/elastic/kibana/pull/221792).
- Adds the **SLO Management** page to Elastic Observability Serverless, allowing users to view definitions, delete SLOs, and purge SLI data without having to consider instances [#222238](https://github.com/elastic/kibana/pull/222238).
- Adds a new APM dashboard for the Golang OpenTelemetry runtime metrics in Elastic Observability Serverless [#220242](https://github.com/elastic/kibana/pull/220242).
- Uses the bulk API to import knowledge base entries in Elastic Observability Serverless [#222084](https://github.com/elastic/kibana/pull/222084).
- Improves system prompt and instructions for the `context` function in the Elastic Observability AI Assistant to work better with Claude models [#221965](https://github.com/elastic/kibana/pull/221965).
- Sets `observabilityAIAssistantAPIClient` as the preferred test for type-safe endpoint calls with scoped users in the Elastic Observability AI Assistant [#222753](https://github.com/elastic/kibana/pull/222753).
- Adds a custom script selector component to the **Response console** in Elastic Security Serverless [#204965](https://github.com/elastic/kibana/pull/204965).
- Updates the `AssetCriticalityBadge` colors to the Borealis theme in Elastic Security Serverless [#222024](https://github.com/elastic/kibana/pull/222024).
- Updates the risk severity colors to the Borealis theme in Elastic Security Serverless [#222061](https://github.com/elastic/kibana/pull/222061).
- Enables **Content Connectors** in the **Stack Management** menu in Elastic Security Serverless [#221856](https://github.com/elastic/kibana/pull/221856).
- Implements PKI authentication support for the `.gen-ai` connector’s `OpenAI Other` provider [#219984](https://github.com/elastic/kibana/pull/219984).
- Implements SAML custom attributes support in the Identity Provider plugin [#128176](https://github.com/elastic/elasticsearch/pull/128176)
- Fixes unsupported privileges error message during role and API key creation [#128858](https://github.com/elastic/elasticsearch/pull/128858)


### Fixes

- Fixes Kibana being stuck in a reboot loop when `cancelAlertsOnRuleTimeout` is set to `false` [#222263](https://github.com/elastic/kibana/pull/222263).
- Adds saved object version for collapsible sections [#222450](https://github.com/elastic/kibana/pull/222450).
- Fixes the `UnenrollInactiveAgentsTask` query in Fleet to un-enroll only those agents that are inactive for longer than `unenroll_timeout` [#222592](https://github.com/elastic/kibana/pull/222592).
- Adds **Actions** header to the unified data table in **Discover** [#220824](https://github.com/elastic/kibana/pull/220824).
- Fixes `COALESCE` validation in **ESQL** [#222425](https://github.com/elastic/kibana/pull/222425).
- Fixes incorrect suggestions after a named variable such as `?value` is entered in a `WHERE` query in **ESQL** [#222312](https://github.com/elastic/kibana/pull/222312).
- Replaces `onChangedItemIndices` with `onChangeRenderedItems` when determining which service details to fetch in Elastic Observability Serverless [#222439](https://github.com/elastic/kibana/pull/222439).
- Fixes pagination on the Services **Inventory** page when progressive loading is enabled in Elastic Observability Serverless [#220514](https://github.com/elastic/kibana/pull/220514).
- Refactors styling for the timeline in Elastic Security Serverless from `styled-components` to `emotion` [#222438](https://github.com/elastic/kibana/pull/222438).
- Fixes wrong content appearing when switching tabs in the **Ingest your data** section on the **Get started** page in Elastic Security Serverless [#222271](https://github.com/elastic/kibana/pull/222271).
- Fixes incorrect header text in the **Rule exception** flyout in Elastic Security Serverless [#222248](https://github.com/elastic/kibana/pull/222248).
- Fixes an issue with adding a field when no pipeline has been generated during import in Machine Learning [#222775](https://github.com/elastic/kibana/pull/222775).
- Fixes an issue with the OpenAI connector not using the action proxy configuration for all subactions in Machine Learning [#219617](https://github.com/elastic/kibana/pull/219617).
- Fixes an issue with **Anomaly Explorer** where the selected Overall swimlane bucket is not respected for `viewBy jobId` in Machine Learning [#222845](https://github.com/elastic/kibana/pull/222845).
- Fixes error handling when one or more connectors is deleted [#221958](https://github.com/elastic/kibana/pull/221958).


## June 2, 2025


### Features and enhancements

- Adds collapsible sections to Dashboards [#220877](https://github.com/elastic/kibana/pull/220877)
- Introduces a new `Density` setting for the Lens Data Table[#220252](https://github.com/elastic/kibana/pull/220252)
- Allows the "Open in lens" button to open in the same tab [#217528](https://github.com/elastic/kibana/pull/217528)
- Allows you to select the data stream type when creating policies for input packages in Fleet [#214216](https://github.com/elastic/kibana/pull/214216)
- Adds a single agent migration endpoint in Fleet, allowing a user to migrate an individual agent to another cluster [#220601](https://github.com/elastic/kibana/pull/220601)
- Adds shortcuts to the editor in Discover [#221331](https://github.com/elastic/kibana/pull/221331)
- Allows you to change the Knowledge Base model after installation in Elastic Observability Serverless [#221319](https://github.com/elastic/kibana/pull/221319)
- Adds investigation guide configuration to all Observability rules in Elastic Observability Serverless [#217106](https://github.com/elastic/kibana/pull/217106)
- Remove semantic_text migration from Elastic Observability Serverless [#220886](https://github.com/elastic/kibana/pull/220886)
- Searches for the CVE ID in all search parameters instead of only the name in Elastic Security Serverless [#221099](https://github.com/elastic/kibana/pull/221099)
- Updates the "Highlighted fields" button in the details flyout and enables the feature flag in Elastic Security Serverless [#221862](https://github.com/elastic/kibana/pull/221862)
- Introduces new `empty` states for the Change Point Detection page in Machine learning [#219072](https://github.com/elastic/kibana/pull/219072)


### Fixes

- Uses msearch to fetch the alerts for maintenance windows with a scoped query [#221702](https://github.com/elastic/kibana/pull/221702)
- Fixes querying installed packages in Fleet [#221624](https://github.com/elastic/kibana/pull/221624)
- Fixes an issue that prevented the style components from receiving the correct `colorMode` in Fleet [#221979](https://github.com/elastic/kibana/pull/221979)
- Makes the **Pin** button more accessible in Discover [#219230](https://github.com/elastic/kibana/pull/219230)
- Fixes an issue where the `Filter by field type` menu screen reader announcements were using duplicated in Discover [#221090](https://github.com/elastic/kibana/pull/221090)
- Removes an unneeded tabindex from Discover [#221265](https://github.com/elastic/kibana/pull/221265)
- Changes the field list icon when mapping changes from unmapped to mapped in Discover [#221308](https://github.com/elastic/kibana/pull/221308)
- Updates the doc viewer table's `aria-label` in Discover [#221736](https://github.com/elastic/kibana/pull/221736)
- Shows the ESQL request URL in the Inspector flyout in Discover [#221816](https://github.com/elastic/kibana/pull/221816)
- Fixes index pattern parsing in Discover, which previously led to incomplete index pattern values being displayed [#221084](https://github.com/elastic/kibana/pull/221084)
- Ensures a non-aggregatable message is not shown if no data matches on the Dataset quality page in Elastic Observability Serverless [#221599](https://github.com/elastic/kibana/pull/221599)
- Deletes user instruction if the text is empty in Elastic Observability Serverless [#221560](https://github.com/elastic/kibana/pull/221560)
- Adjusts the bulk import knowledge base example to ndjson format in Elastic Observability Serverless [#221617](https://github.com/elastic/kibana/pull/221617)
- Modifies `RuleTypeModalComponent` to filter rule types that have `requiresAppContext` in Elastic Observability Serverless [#220005](https://github.com/elastic/kibana/pull/220005)
- Correctly nests APM > Synthetics Serverless navigation in Elastic Observability Serverless [#222115](https://github.com/elastic/kibana/pull/222115)
- Removes the "run soon for sync private location" task in Elastic Observability Serverless [#222062](https://github.com/elastic/kibana/pull/222062)
- Fixes the error count waterfall navigation reload issue in Elastic Observability Serverless [#221664](https://github.com/elastic/kibana/pull/221664)
- Fixes the Bedrock model on preconfigured connectors in Elastic Security Serverless [#221411](https://github.com/elastic/kibana/pull/221411)
- Removes the hard-coded width settings for the Threat Match mapping components in Elastic Security Serverless [#218628](https://github.com/elastic/kibana/pull/218628)
- Fixes the banner title in event preview in Elastic Security Serverless  [#222266](https://github.com/elastic/kibana/pull/222266)
- Ensures to only auto deploy Elastic models during file upload in Machine learning [#221357](https://github.com/elastic/kibana/pull/221357)
- Fixes the inference endpoint assignment to the trained model object in Machine learning  [#222076](https://github.com/elastic/kibana/pull/222076)
- Fixes an issue where `/etc/default/kibana` on deb packages and `/etc/sysconfig/kibana` on rpm packages would be overwritten during upgrading [#221276](https://github.com/elastic/kibana/pull/221276)


## May 26, 2025


### Features and enhancements

- Suggests full text search in our recommendations [#221239](https://github.com/elastic/kibana/pull/221239)
- Flattens grid layout [#218900](https://github.com/elastic/kibana/pull/218900)
- Enables ELSER and E5 on EIS [#220993](https://github.com/elastic/kibana/pull/220993)
- Links dashboards on the Rule and Alert pages [#219019](https://github.com/elastic/kibana/pull/219019)
- Saves `group by` information with dynamic mapping [#219826](https://github.com/elastic/kibana/pull/219826)
- Introduces a new endpoint scheme for SIEM migration [#219597](https://github.com/elastic/kibana/pull/219597)
- Extends default log pattern on server side to include error information [#219940](https://github.com/elastic/kibana/pull/219940)


### Fixes

- Fixes `getTimezone` default value [#220658](https://github.com/elastic/kibana/pull/220658)
- Loads correct system color mode at bootstrap [#218417](https://github.com/elastic/kibana/pull/218417)
- Fixes embeddables not refreshing on manual refresh or auto-refresh [#221326](https://github.com/elastic/kibana/pull/221326)
- Improves Discover session input focus behavior [#220876](https://github.com/elastic/kibana/pull/220876)
- Fixes suggestions after triple quote pair [#221200](https://github.com/elastic/kibana/pull/221200)
- Passes app state and global state to locator when redirecting from `/stream` path [#215867](https://github.com/elastic/kibana/pull/215867)
- Considers status rule locations only if not an empty array [#220983](https://github.com/elastic/kibana/pull/220983)
- Fixes a bug where update of an SLO created in a version older than 8.18 failed due to an invalid ingest pipeline [#221158](https://github.com/elastic/kibana/pull/221158)
- Checks for documents before starting semantic text migration [#221152](https://github.com/elastic/kibana/pull/221152)
- Improves error telemetry [#220938](https://github.com/elastic/kibana/pull/220938)
- Retrieves active integrations from installed integrations API [#218988](https://github.com/elastic/kibana/pull/218988)
- Fixes spaces search functionality for spaces created with avatar type as image [#220398](https://github.com/elastic/kibana/pull/220398)
- Fixes inability to clear Document ID in data view field editor preview [#220891](https://github.com/elastic/kibana/pull/220891)
- Reworks cookie and session storage to prevent unexpected logouts for certain users with certain use cases [#220430](https://github.com/elastic/kibana/pull/220430)
- Changes the AI Connector description [#221154](https://github.com/elastic/kibana/pull/221154)


## May 19, 2025


### Features and enhancements

- Supports recurring task scheduling with `rrule` in Alerting [#217728](https://github.com/elastic/kibana/pull/217728)
- Adds an embeddable panel to display alerts in **Dashboards** [#216076](https://github.com/elastic/kibana/pull/216076)
- Adds **Compare to** badge for **Metric chart** visualizations [#214811](https://github.com/elastic/kibana/pull/214811)
- Allows specifying an embedding model during onboarding for the Elastic Observability Serverless Knowledge Base [#218448](https://github.com/elastic/kibana/pull/218448)
- Enables click actions for **Stacktrace** and **Degraded Fields** in **Discover** for Elastic Observability Serverless [#214413](https://github.com/elastic/kibana/pull/214413)
- Shows **ELSER** in **EIS** only when available in Elastic Observability Serverless [#220096](https://github.com/elastic/kibana/pull/220096)
- Adds the ability to create alert rules from **ESQL** dashboard visualizations through context menu or right-clicking a data point [#217719](https://github.com/elastic/kibana/pull/217719)
- Enables the `enableAutomaticAgentUpgrades` feature flag for Fleet [#219932](https://github.com/elastic/kibana/pull/219932)
- Adds Cloud Connectors support to Fleet for **CSPM** [#212200](https://github.com/elastic/kibana/pull/212200)
- Ensures alerts created within **Maintenance Windows** trigger actions after the window expires [#219797](https://github.com/elastic/kibana/pull/219797)
- Adds **Copy value** button to field value cells in **Discover** [#218817](https://github.com/elastic/kibana/pull/218817)
- Hides the **Selected only** toggle in pages that don't support value-based filtering in **Discover** [#220624](https://github.com/elastic/kibana/pull/220624)
- Updates default model IDs for **Bedrock** and **OpenAI** connectors in Elastic Security Serverless [#220146](https://github.com/elastic/kibana/pull/220146)
- Integrates AI prompts in Elastic Security Serverless [#216106](https://github.com/elastic/kibana/pull/216106)
- Adds an **ESQL** control option to the dashboard controls dropdown [#219495](https://github.com/elastic/kibana/pull/219495)
- Enables full-text search in `STATS ... WHERE` **ESQL** queries [#220691](https://github.com/elastic/kibana/pull/220691)
- Prevents downloading trained models that are already present in other spaces and displays a warning in Machine Learning [#220238](https://github.com/elastic/kibana/pull/220238)


### Fixes

- Removes extra icon from map visualization tooltips [#220134](https://github.com/elastic/kibana/pull/220134)
- Fixes color mapping issues for custom ranges and multi-field values in visualizations [#207957](https://github.com/elastic/kibana/pull/207957)
- Fixes layout issues in embeddable dashboard panel headings with descriptions [#219428](https://github.com/elastic/kibana/pull/219428)
- Fixes invalid dashboards incorrectly showing 404 errors instead of validation messages [#211661](https://github.com/elastic/kibana/pull/211661)
- Fixes success message and auto-scroll behavior after adding a panel to a dashboard from the library [#220122](https://github.com/elastic/kibana/pull/220122)
- Fixes drill-down state not saving in by-value **Discover** sessions [#219857](https://github.com/elastic/kibana/pull/219857)
- Marks icons as presentational for accessibility in **Discover** [#219696](https://github.com/elastic/kibana/pull/219696)
- Fixes broken **Span Links** flyout in **Trace Explorer** in Elastic Observability Serverless [#219763](https://github.com/elastic/kibana/pull/219763)
- Prevents undefined errors in **Transaction flyout** in Elastic Observability Serverless [#220224](https://github.com/elastic/kibana/pull/220224)
- Fixes issues with **Processes** query in Elastic Observability Serverless [#220381](https://github.com/elastic/kibana/pull/220381)
- Removes unnecessary index write blocks in Elastic Observability Serverless [#220362](https://github.com/elastic/kibana/pull/220362)
- Improves resilience of API tests in Elastic Observability Serverless [#220503](https://github.com/elastic/kibana/pull/220503)
- Uses update-by-query for `semantic_text` migration in Elastic Observability Serverless [#220255](https://github.com/elastic/kibana/pull/220255)
- Fixes errors in `error_marker.tsx` to support **Mobile Services** in Elastic Observability Serverless [#220424](https://github.com/elastic/kibana/pull/220424)
- Moves from visualization responses to visualization tables in Elastic Security Serverless [#214888](https://github.com/elastic/kibana/pull/214888)
- Prevents risk score search requests from being aborted in Elastic Security Serverless [#219858](https://github.com/elastic/kibana/pull/219858)
- Fixes issue where exceptions list and actions were overwritten during legacy prebuilt rule upgrades in Elastic Security Serverless [#218519](https://github.com/elastic/kibana/pull/218519)
- Fixes incorrect validation for names containing asterisks in **ESQL** [#219832](https://github.com/elastic/kibana/pull/219832)
- Fixes overridden SSL config in full agent policy advanced YAML for Fleet [#219902](https://github.com/elastic/kibana/pull/219902)


## May 5, 2025


### Features and enhancements

- Adds grouping per row to the ES|QL rule type [#212135](https://github.com/elastic/kibana/pull/212135)
- Adds a compact view on the Monitors overview page in Elastic Observability Serverless [#219060](https://github.com/elastic/kibana/pull/219060)
- Adds backend schema changes for investigation guides in Elastic Observability Serverless [#216377](https://github.com/elastic/kibana/pull/216377)
- Adds the `context.grouping` action variable for the SLO Burn rate and ES|QL rules in Elastic Observability Serverless [#213550](https://github.com/elastic/kibana/pull/213550)
- Updates the styles for the color formatter to appear like a badge in Discover [#189391](https://github.com/elastic/kibana/pull/189391)
- Enhances the handling of missing `service.environment` attributes in Elastic Observability Serverless [#217899](https://github.com/elastic/kibana/pull/217899)
- Adds `logging_level` to the agent central configuration for the EDOT Java agent in Elastic Observability Serverless [#219722](https://github.com/elastic/kibana/pull/219722)
- Updates Kibana MITRE data to `v16.1` [#215026](https://github.com/elastic/kibana/pull/215026)
- Makes the Fleet agents tag filter searchable and sortable [#219639](https://github.com/elastic/kibana/pull/219639)
- Adds logic to exclude the `temperature` parameter from the body request of some OpenAI models [#218887](https://github.com/elastic/kibana/pull/218887)
- Adds the ability to switch between relative and absolute time range in Discover [#218056](https://github.com/elastic/kibana/pull/218056)


### Fixes

- Fixes ignored dynamic templates [#219875](https://github.com/elastic/kibana/pull/219875)

- Syncs the Dashboard ES|QL query and filters with the corresponding one in Visualizations [#218997](https://github.com/elastic/kibana/pull/218997)
- Fixes the option list control, making two requests upon refreshing [#219625](https://github.com/elastic/kibana/pull/219625)
- Ensures that an individual alert is sent per monitor configuration when the "Receive distinct alerts per location" toggle is unchecked in Elastic Observability Serverless [#219291](https://github.com/elastic/kibana/pull/219291)
- Fixes an error that occurred when you interacted with the monitor status rule flyout's numeric controls in Elastic Observability Serverless [#218994](https://github.com/elastic/kibana/pull/218994)
- Fixes an issue where the Observability AI Assistant flyout reopened after navigating to another page URL [#219420](https://github.com/elastic/kibana/pull/219420)
- Fixes an issue with alerts filtering when the service environment was not defined in Elastic Observability Serverless [#219228](https://github.com/elastic/kibana/pull/219228)
- Handles missing `trace` in API response [#219512](https://github.com/elastic/kibana/pull/219512)
- Correctly displays an error message if there are failures when creating anomaly detection jobs [#219364](https://github.com/elastic/kibana/pull/219364)
- Adds optional chaining to prevent undefined error in `custom_link_flyout.tsx` in Elastic Observability Serverless [#219668](https://github.com/elastic/kibana/pull/219668)
- Corrects quotes in ES|QL queries for function arguments in Elastic Observability Serverless [#217680](https://github.com/elastic/kibana/pull/217680)
- Queries alerts using the `alert.start` field in Elastic Observability Serverless [#219651](https://github.com/elastic/kibana/pull/219651)
- Fixes a scroll error for the Rules flyout in Elastic Security Serverless [#218697](https://github.com/elastic/kibana/pull/218697)
- Adds a privilege check for enabling the **Run Engine** button in Elastic Security Serverless  [#213054](https://github.com/elastic/kibana/pull/213054)
- Removes checks for an unused connector role in Elastic Security Serverless [#219358](https://github.com/elastic/kibana/pull/219358)
- Fixes the rule import error message display [#218701](https://github.com/elastic/kibana/pull/218701)
- Fixes the capability required for the SIEM Migrations Topic in Fleet [#219427](https://github.com/elastic/kibana/pull/219427)
- Ensures the ability to change providers without error in Machine learning [#219020](https://github.com/elastic/kibana/pull/219020)
- Fixes broken icons in integrations from the Home plugin [#219206](https://github.com/elastic/kibana/pull/219206)


## April 28, 2025


### Features and enhancements

- Adds the option to use the logical `AND` when filtering Monitors by multiple tags or locations [#217985](https://github.com/elastic/kibana/pull/217985)
- Makes Attack Discovery alerts persistent and searchable [#218906](https://github.com/elastic/kibana/pull/218906)
- Improves edit ReadMe functionality for custom integrations [#215259](https://github.com/elastic/kibana/pull/215259)
- Removes metrics and logs from the `get_service_stats` API [#218346](https://github.com/elastic/kibana/pull/218346)
- Allows you to customize the table tab [#218686](https://github.com/elastic/kibana/pull/218686)
- Enables keyboard navigation for the create annotations form [#217918](https://github.com/elastic/kibana/pull/217918)
- Updates tika to 2.9.3 [#127353](https://github.com/elastic/elasticsearch/pull/127353)


### Fixes

- Fixes keyword format in metric visualizations [#218233](https://github.com/elastic/kibana/pull/218233)
- Fixes monitor history histogram and group by location issue [#218550](https://github.com/elastic/kibana/pull/218550)
- Prevents other conditions from changing when you change the condition type of a monitor status rule [#216426](https://github.com/elastic/kibana/pull/216426)
- Filters out null values from `sourceDataStreams` [#218772](https://github.com/elastic/kibana/pull/218772)
- Fixes span url link when `transactionId` is missing in span links [#218232](https://github.com/elastic/kibana/pull/218232)
- Fixes logical `AND` behavior when a filter is removed [#218910](https://github.com/elastic/kibana/pull/218910)
- Fixes a bug that prevented index template creation [#218901](https://github.com/elastic/kibana/pull/218901)
- Prevents unnecessary suggestion requests [#218927](https://github.com/elastic/kibana/pull/218927)
- Uses fields instead of `_source` in the metadata endpoint [#218869](https://github.com/elastic/kibana/pull/218869)
- Fills gaps in table tooltips [#218926](https://github.com/elastic/kibana/pull/218926)
- Makes output and fleet server non-editable for agentless integration policies [#218905](https://github.com/elastic/kibana/pull/218905)
- Improves anomaly charts object safety [#217552](https://github.com/elastic/kibana/pull/217552)
- Fixes title announcements in the details step of the anomaly detection job wizard [#218570](https://github.com/elastic/kibana/pull/218570)
- Fixes incorrect optimization for endpoint artifacts [#216437](https://github.com/elastic/kibana/pull/216437)


## April 21, 2025


### Features and enhancements

- Adds public Maintenance Window APIs for Alerting [#216756](https://github.com/elastic/kibana/pull/216756)
- Enables KQL filter for Elastic Observability Serverless TLS rules [#216973](https://github.com/elastic/kibana/pull/216973)
- Adds drilldown to synthetics stats overview embeddable for Elastic Observability Serverless [#217688](https://github.com/elastic/kibana/pull/217688)
- Updates the Elastic Observability Serverless embeddable view when only one monitor in one location is selected [#218402](https://github.com/elastic/kibana/pull/218402)
- Improves accessibility in the Elastic Observability Serverless create connector flyout [#218426](https://github.com/elastic/kibana/pull/218426)
- Removes double confirmation when deleting conversations in Elastic Observability Serverless [#217991](https://github.com/elastic/kibana/pull/217991)
- APM URLs now encode the service name in Elastic Observability Serverless [#217092](https://github.com/elastic/kibana/pull/217092)
- Adds improvements to the Embeddable Trace Waterfall in Elastic Observability Serverless [#217679](https://github.com/elastic/kibana/pull/217679)
- Updates the highlighted fields in the Elastic Security Serverless overview tab [#216740](https://github.com/elastic/kibana/pull/216740)
- Adds the ability to handle ELASTIC_PROFILER_STACK_TRACE_IDS for apm-profiler integration in Elastic Obserbability Serverless [#217020](https://github.com/elastic/kibana/pull/217020)
- Adds the ability to open links in a new window for Vega visualizations [#216200](https://github.com/elastic/kibana/pull/216200)
- Adds the ability to opt out of event-driven Memory Protection scanning in Elastic Security Serverless advanced policies [#218354](https://github.com/elastic/kibana/pull/218354)
- Replaces the Elastic Security Serverless analyzer sourcerer [#218183](https://github.com/elastic/kibana/pull/218183)
- Enables suggestions for `CHANGE_POINT` command in ESQL [#218100](https://github.com/elastic/kibana/pull/218100)
- Adds callouts for Fleet breaking changes for integration upgrades [#217257](https://github.com/elastic/kibana/pull/217257)
- Adds support for local `xpack.productDocBase.artifactRepositoryUrl` file path in Machine Learning [#217046](https://github.com/elastic/kibana/pull/217046)
- Adds defaultSolution to spaces configuration [#218360](https://github.com/elastic/kibana/pull/218360)
- Adds support for dots in the role mappings. Dots (.) can be used as part of the role mappings and the groups that are returned by the custom IdPs to match to.


### Fixes

- Fixes allow_hidden usage in the request for fields in Discover [#217628](https://github.com/elastic/kibana/pull/217628)
- Fixes an issue in Discover where keydown event propagation now stops when unified doc tabs are focused [#218300](https://github.com/elastic/kibana/pull/218300)
- Fixes an issue where sync global parameters are now called in the endpoints to add, edit, or delete global params in Elastic Observability Serverless [#216197](https://github.com/elastic/kibana/pull/216197)
- Adds the ability to allow group for ip type fields in Elastic Observability Serverless [#216062](https://github.com/elastic/kibana/pull/216062)
- Fixes the EDOT error summary in Elastic Observability Serverless [#217885](https://github.com/elastic/kibana/pull/217885)
- Fixes test run logs per page in Elastic Observability Serverless [#218458](https://github.com/elastic/kibana/pull/218458)
- Fixes the display results and Visualize query Bedrock error in Elastic Observability Serverless [#218213](https://github.com/elastic/kibana/pull/218213)
- Fixes prebuilt rules force upgrade on Endpoint policy creation in Elastic Security Serverless [#217959](https://github.com/elastic/kibana/pull/217959)
- Fixes related integrations render performance on rule editing pages in Elastic Security Serverless [#217254](https://github.com/elastic/kibana/pull/217254)
- Fixes the broken tooltip suggestions descriptions in ESQL [#218067](https://github.com/elastic/kibana/pull/218067)
- Adds the ability to retrieve empty columns in ESQL [#218085](https://github.com/elastic/kibana/pull/218085)
- Fixes an issue in ESQL where tables with no data would break [#217937](https://github.com/elastic/kibana/pull/217937)
- Fixes the ESQL editor menus when using Safari [#218167](https://github.com/elastic/kibana/pull/218167)
- Fixes the wrong source validation in case of unknown patterns in ESQL [#218352](https://github.com/elastic/kibana/pull/218352)
- Fixes vCPU usage message in the Machine Learning start deployment dialog [#218557](https://github.com/elastic/kibana/pull/218557)
- Removes the listing limit warning [#217945](https://github.com/elastic/kibana/pull/217945)
- Fixes an issue where the placeholder in the monaco editor would disappear when a value is set [#217828](https://github.com/elastic/kibana/pull/217828)
- Fixes an issue where the Saved Objects Rotate Encryption Key API would not affect sharable encrypted object types that exist in all spaces [#217625](https://github.com/elastic/kibana/pull/217625)
- Fixes an issue where refreshing multiple tabs when you log out will simultaneously log in successfully [#212148](https://github.com/elastic/kibana/pull/212148)


## April 14, 2025


### Features and enhancements

- Enables archiving of conversations in the Elastic Observability Serverless AI Assistant [#216012](https://github.com/elastic/kibana/pull/216012)
- Moves job and trained model management features into **Stack Management** [#204290](https://github.com/elastic/kibana/pull/204290)
- Adds Engine initialization API to Elastic Security Serverless [#215663](https://github.com/elastic/kibana/pull/215663)
- Allows creating an ESQL control by entering a question mark (`?`) in the query [#216839](https://github.com/elastic/kibana/pull/216839)
- Improves UI handling of multiple CVEs and package fields [#216411](https://github.com/elastic/kibana/pull/216411)
- Adds support for Windows MSI commands for Fleet and Elastic Agent installations [#217217](https://github.com/elastic/kibana/pull/217217)
- Reuses shared integration policies when duplicating agent policies in Fleet [#217872](https://github.com/elastic/kibana/pull/217872)
- Enables adding badges to all list items in the side navigation except the section header [#217301](https://github.com/elastic/kibana/pull/217301)


### Fixes

- Fixes error message when previewing index templates used by data streams [#217604](https://github.com/elastic/kibana/pull/217604)
- Wraps text in search bars [#217556](https://github.com/elastic/kibana/pull/217556)
- Adds support for `textBased` layers in ESQL visualizations [#216358](https://github.com/elastic/kibana/pull/216358)
- Corrects the alert count displayed in **Monitor** details [#216761](https://github.com/elastic/kibana/pull/216761)
- Fixes the **Save visualization** action on the Monitors **Overview** tab [#216695](https://github.com/elastic/kibana/pull/216695)
- Removes direct function calling from the chat input Elastic Observability Serverless AI Assistant [#217359](https://github.com/elastic/kibana/pull/217359)
- Adds missing `aria-label` attributes to some buttons under the Services and Services Groups pages [#217325](https://github.com/elastic/kibana/pull/217325)
- Improves knowledge base installation flow and inference endpoint management [#214133](https://github.com/elastic/kibana/pull/214133)
- Improves `aria-label` for `EuiCodeBlock` on the APM onboarding page [#217292](https://github.com/elastic/kibana/pull/217292)
- Adds `source` and `target` fields to the `Dataset Quality Navigated` event [#217575](https://github.com/elastic/kibana/pull/217575)
- Improves `aria-label` attributes for latency correlations [#217512](https://github.com/elastic/kibana/pull/217512)
- Fixes navigation to the **Search Connectors** page [#217749](https://github.com/elastic/kibana/pull/217749)
- Sorts the **Environment** dropdown alphabetically in the APM UI [#217710](https://github.com/elastic/kibana/pull/217710)
- Ensures the Request Inspector shows accurate request and response data for successful scenarios [#216519](https://github.com/elastic/kibana/pull/216519)
- Fixes the `Change Point Detection` embeddable in dashboards [#217178](https://github.com/elastic/kibana/pull/217178)
- Fixes page crashes caused by the **Use full data** button [#217291](https://github.com/elastic/kibana/pull/217291)
- Filters inference connectors that lack existing endpoints in **Connectors** [#217641](https://github.com/elastic/kibana/pull/217641)
- Fixes focusability and keyboard access issues with the **Export** tab in the **Share this dashboard** modal [#217313](https://github.com/elastic/kibana/pull/217313)


## April 7, 2025


### Features and enhancements

- Adds keyboard navigation for drag-and-drop interactions in Dashboards [#208286](https://github.com/elastic/kibana/pull/208286)
- Adds 'Read More' and 'Read Less' functionality to fields in Document view in Discover [#215326](https://github.com/elastic/kibana/pull/215326)
- Injects and extracts tag references in Dashboards [#214788](https://github.com/elastic/kibana/pull/214788)
- Adds an option to User Settings that allows the Kibana interface to display in a high contrast mode [#216242](https://github.com/elastic/kibana/pull/216242)
- Adds a back external link indicator to the side navigation [#215946](https://github.com/elastic/kibana/pull/215946)
- Adds a default metrics dashboard for Node.js open telemetry in Elastic Observability Serverless [#215735](https://github.com/elastic/kibana/pull/215735)
- Replaces Sourcerer with the the Discover Data View picker in Elastic Security Serverless [#210585](https://github.com/elastic/kibana/pull/210585)
- Replaces Sourcerer in the global header in Elastic Security Serverless [#216685](https://github.com/elastic/kibana/pull/216685)
- Handles grouping in multivalue fields in Elastic Security Serverless [#215913](https://github.com/elastic/kibana/pull/215913)
- Adds validation and autocomplete support for the `CHANGE_POINT` command in ES|QL [#216043](https://github.com/elastic/kibana/pull/216043)
- Adds support for aggregrate filtering in the ES|QL editor [#216379](https://github.com/elastic/kibana/pull/216379)
- Changes the agent details last activity value to show the formatted datetime in Fleet [#215531](https://github.com/elastic/kibana/pull/215531)
- Allows SSL configuration to be disabled for the Fleet agent Logstash output [#216216](https://github.com/elastic/kibana/pull/216216)
- Enhances the display for anomaly time function values for Machine Learning [#216142](https://github.com/elastic/kibana/pull/216142)
- Adds Voyage AI and DeepSeek icons for Machine Learning [#216651](https://github.com/elastic/kibana/pull/216651)
- Moves rule settings to a flyout instead of a modal [#216162](https://github.com/elastic/kibana/pull/216162)


### Fixes

- Fixes a race condition in `useBatchedPublishingSubjects` in Dashboards and visualizations [#216399](https://github.com/elastic/kibana/pull/216399)
- Fixes State being dropped when editing visualize embeddables in Dashboards and visualizations [#216901](https://github.com/elastic/kibana/pull/216901)
- Updates the HTTP API response from 201 to 200 in Dashboards and visualizations [#217054](https://github.com/elastic/kibana/pull/217054)
- Fixes an issue where scaling edits weren't saved in Dashboards and visualizations [#217235](https://github.com/elastic/kibana/pull/217235)
- Fixes an issue where the Discover flyout closed when the focus was on filter [#216630](https://github.com/elastic/kibana/pull/216630)
- Fixes the CSV export for ES|QL embeddable in Discover [#216325](https://github.com/elastic/kibana/pull/216325)
- Fixes the JSON view for ES|QL record in DocViewer [#216642](https://github.com/elastic/kibana/pull/216642)
- Adds items count to fields accordion titled `aria-label` in Discover  [#216993](https://github.com/elastic/kibana/pull/216993)
- Makes service inventory icons visible if the `agentName` is returned in Elastic Observability Serverless [#216220](https://github.com/elastic/kibana/pull/216220)
- Changes the TPM abbreviation to trace per minute for screen readers in Elastic Observability Serverless [#216282](https://github.com/elastic/kibana/pull/216282)
- Adds the `aria-label` to the fold traces button in Elastic Observability Serverless [#216485](https://github.com/elastic/kibana/pull/216485)
- Adds the `aria-label` to the technical preview badge in Elastic Observability Serverless [#216483](https://github.com/elastic/kibana/pull/216483)
- Allows only `.ndjson` files when bulk importing to the knowledge base in Elastic Observability Serverless [#215433](https://github.com/elastic/kibana/pull/215433)
- Fixes the span link invalid filter in Elastic Observability Serverless [#215322](https://github.com/elastic/kibana/pull/215322)
- Fixes the missing URL in the transaction summary in Elastic Observability Serverless [#215397](https://github.com/elastic/kibana/pull/215397)
- Fixes the query for transaction marks in Elastic Observability Serverless [#215819](https://github.com/elastic/kibana/pull/215819)
- Updates the `retrieve_elastic_doc` API test in Elastic Observability Serverless [#215237](https://github.com/elastic/kibana/pull/215237)
- Adds error text in the environment filter when the input is invalid in Elastic Observability Serverless [#216782](https://github.com/elastic/kibana/pull/216782)
- Fixes the **Fold/unfold** button in traces waterfall explorer in Elastic Observability Serverless [#216972](https://github.com/elastic/kibana/pull/216972)
- Fixes the alert severity order in Elastic Security Serverless [#215813](https://github.com/elastic/kibana/pull/215813)
- Fixes the error callout placement on the **Entity Store** page's **Engine Status** tab in Elastic Security Serverless [#216228](https://github.com/elastic/kibana/pull/216228)
- Reads `config` from preconfigured connectors in AI Assistant and Attack Discovery in Elastic Security Serverless [#216700](https://github.com/elastic/kibana/pull/216700)
- Fixes bedrock `modelId` encoding in Elastic Security Serverless [#216915](https://github.com/elastic/kibana/pull/216915)
- Fixes the AI Assistant prompt in Elastic Security Serverless [#217058](https://github.com/elastic/kibana/pull/217058)
- Hides "not" operators from the suggestions menu in ES|QL [#216355](https://github.com/elastic/kibana/pull/216355)
- Fixes the CSV report time range when exporting from Discover in ES|QL [#216792](https://github.com/elastic/kibana/pull/216792)
- Fixes unenroll inactive agent tasks if the first set of agents returned is equal to `UNENROLLMENT_BATCH_SIZE` in Fleet [#216283](https://github.com/elastic/kibana/pull/216283)
- Supports integrations having secrets with multiple values in Fleet [#216918](https://github.com/elastic/kibana/pull/216918)
- Adds overlay to the add/edit integration page in Fleet [#217151](https://github.com/elastic/kibana/pull/217151)


## March 31, 2025


### Features and enhancements

- Introduced an embeddable trace waterfall visualization in Elastic Observability Serverless [#216098](https://github.com/elastic/kibana/pull/216098)
- Adds support for span links in Elastic Observability Serverless service maps [#215645](https://github.com/elastic/kibana/pull/215645)
- Enables KQL filting for TLS alerting rules in Elastic Observability Serverless [#215110](https://github.com/elastic/kibana/pull/215110)
- Ensures a 404 response is returned only when `screenshot_ref` is truly missing in Elastic Observability Serverless [#215241](https://github.com/elastic/kibana/pull/215241)
- Adds a rule gaps histogram to the Elastic Security Serverless rules dashboard [#214694](https://github.com/elastic/kibana/pull/214694)
- Adds support for multiple CVEs and improves the vulnerability data grid, flyout, and contextual flyout UI in Elastic Security Serverless [#213039](https://github.com/elastic/kibana/pull/213039)
- Updates API key permissions for refreshing data view API for Elastic Security Serverless [#215738](https://github.com/elastic/kibana/pull/215738)
- Adds the ability to limit notes per document instead of globally in Elastic Security Serverless [#214922](https://github.com/elastic/kibana/pull/214922)
- Adds the ability to add badges to subitems in the side navigation [#214854](https://github.com/elastic/kibana/pull/214854)


### Fixes

- Fixes color palette assignment issues in partition charts [#215426](https://github.com/elastic/kibana/pull/215426)
- Adjusts page height for the AI Assistant app in solution views [#215646](https://github.com/elastic/kibana/pull/215646)
- Adds the `aria-label` to latency selector in Elastic Observabiity Serverless service overview [#215644](https://github.com/elastic/kibana/pull/215644)
- Adds the `aria-label` to popover service in Elastic Observabiity Serverless service overview [#215640](https://github.com/elastic/kibana/pull/215640)
- Adds the `aria-label` to "Try our new inventory" button in Elastic Observabiity Serverless [#215633](https://github.com/elastic/kibana/pull/215633)
- Adds the `aria-label` to Transaction type select in Elastic Observabiity Serverless service overview [#216014](https://github.com/elastic/kibana/pull/216014)
- Fixes an issue when selecting monitor frequency [#215823](https://github.com/elastic/kibana/pull/215823)
- Implements the `nameTooltip` API for Elastic Observabiity Serverless dependency tables [#215940](https://github.com/elastic/kibana/pull/215940)
- Fixes a location filter issue in the Elastic Observabiity Serverless status rule executor [#215514](https://github.com/elastic/kibana/pull/215514)
- Consolidates custom Fleet onboarding logic in Elastic Observabiity Serverless [#215561](https://github.com/elastic/kibana/pull/215561)
- Fixes left margin positioning in Elastic Observabiity Serverless waterfall visualizations [#216229](https://github.com/elastic/kibana/pull/216229)
- Corrects risk score table refresh issues in the Elastic Security Serverless Entity Analytics Dashboard [#215472](https://github.com/elastic/kibana/pull/215472)
- Fixes the Elastic Security Serverless host details flyout left panel tabs [#215672](https://github.com/elastic/kibana/pull/215672)
- Fixes an issue where the Entity Store init API did not check for index privileges in Elastic Security Serverless [#215329](https://github.com/elastic/kibana/pull/215329)
- Adds a `manage_ingest_pipeline` privilege check for Risk Engine enablement in Elastic Security Serverless [#215544](https://github.com/elastic/kibana/pull/215544)
- Updates API to dynamically retrieve `spaceID` for Elastic Security Serverless [#216063](https://github.com/elastic/kibana/pull/216063)
- Fixes the visibility of the ES|QL date picker [#214728](https://github.com/elastic/kibana/pull/214728)
- Enables the ES|QL time picker when time parameters are used with `cast` [#215820](https://github.com/elastic/kibana/pull/215820)
- Updates the Fleet minimum package spec version to 2.3 [#214600](https://github.com/elastic/kibana/pull/214600)
- Fixes text overflow and alignment in agent details integration input status in Fleet [#215807](https://github.com/elastic/kibana/pull/215807)
- Fixes pagination in the Anomaly Explorer Anomalies Table for Machine Learning [#214714](https://github.com/elastic/kibana/pull/214714)
- Ensures proper permissions for viewing Machine Learning nodes [#215503](https://github.com/elastic/kibana/pull/215503)
- Adds a custom link color option for the top banner [#214241](https://github.com/elastic/kibana/pull/214241)
- Updates the task state version after execution [#215559](https://github.com/elastic/kibana/pull/215559)


## March 24, 2025


### Features and enhancements

- Enables smoother scrolling in Kibana [#214512](https://github.com/elastic/kibana/pull/214512)
- Adds `context.grouping` action variable in Custom threshold and APM rules [#212895](https://github.com/elastic/kibana/pull/212895)
- Adds the ability to create an APM availability or latency SLO for all services [#214653](https://github.com/elastic/kibana/pull/214653)
- Enables editing central config for EDOT Agents / SDKs [#211468](https://github.com/elastic/kibana/pull/211468)
- Uses Data View name for Rule Data View display [#214495](https://github.com/elastic/kibana/pull/214495)
- Highlights the code examples in our inline docs [#214915](https://github.com/elastic/kibana/pull/214915)
- Updates data feeds for anomaly detection jobs to exclude Elastic Agent and Beats processes [#213927](https://github.com/elastic/kibana/pull/213927)
- Adds Mustache lambdas for alerting action [#213859](https://github.com/elastic/kibana/pull/213859)
- Adds 'page reload' screen reader warning [#214822](https://github.com/elastic/kibana/pull/214822)


### Fixes

- Fixes color by value for Last value array mode [#213917](https://github.com/elastic/kibana/pull/213917)
- Fixes can edit check [#213887](https://github.com/elastic/kibana/pull/213887)
- Fixes opening a rollup data view in Discover [#214656](https://github.com/elastic/kibana/pull/214656)
- Fixes entry item in waterfall shouldn't be orphan [#214700](https://github.com/elastic/kibana/pull/214700)
- Filters out upstream orphans in waterfall [#214704](https://github.com/elastic/kibana/pull/214704)
- Fixes KB bulk import UI example [#214970](https://github.com/elastic/kibana/pull/214970)
- Ensures that when an SLO is created, its ID is verified across all spaces [#214496](https://github.com/elastic/kibana/pull/214496)
- Fixes contextual insights scoring [#214259](https://github.com/elastic/kibana/pull/214259)
- Prevents `getChildrenGroupedByParentId` from including the parent in the children list [#214957](https://github.com/elastic/kibana/pull/214957)
- Fixes ID overflow bug [#215199](https://github.com/elastic/kibana/pull/215199)
- Removes unnecessary `field service.environment` from top dependency spans endpoint [#215321](https://github.com/elastic/kibana/pull/215321)
- Fixes missing `user_agent` version field and shows it on the trace summary [#215403](https://github.com/elastic/kibana/pull/215403)
- Fixes rule preview works for form's invalid state [#213801](https://github.com/elastic/kibana/pull/213801)
- Fixes session view error on the alerts tab [#214887](https://github.com/elastic/kibana/pull/214887)
- Adds index privileges check to `applyDataViewIndices` [#214803](https://github.com/elastic/kibana/pull/214803)
- Changes the default Risk score lookback period from `30m` to `30d` [#215093](https://github.com/elastic/kibana/pull/215093)
- Fixes issue with alert grouping re-render [#215086](https://github.com/elastic/kibana/pull/215086)
- Limits the `transformID` length to 36 characters [#213405](https://github.com/elastic/kibana/pull/213405)
- Fixes Data view refresh not supporting the `indexPattern` parameter [#215151](https://github.com/elastic/kibana/pull/215151)
- Uses Risk Engine `SavedObject` intead of `localStorage` on the Risk Score web page [#215304](https://github.com/elastic/kibana/pull/215304)
- Fixes autocomplete for comments when there is a space [#214696](https://github.com/elastic/kibana/pull/214696)
- Makes sure that the variables in the editor are always up to date [#214833](https://github.com/elastic/kibana/pull/214833)
- Calculates the query for retrieving the values correctly [#214905](https://github.com/elastic/kibana/pull/214905)
- Fixes overlay in integrations on mobile [#215312](https://github.com/elastic/kibana/pull/215312)
- Fixes chart in single metric anomaly detection wizard [#214837](https://github.com/elastic/kibana/pull/214837)
- Fixes regression that caused the cases actions to disappear from the detections engine alerts table bulk actions menu [#215111](https://github.com/elastic/kibana/pull/215111)
- Changes "Close project" to "Log out" in nav menu in serverless mode [#211463](https://github.com/elastic/kibana/pull/211463)
- Fixes search profiler index reset field when query is changed [#215420](https://github.com/elastic/kibana/pull/215420)


## March 17, 2025


### Features and enhancements

- Enables read-only editor mode in Lens to explore panel configuration [#208554](https://github.com/elastic/kibana/pull/208554)
- Allows you to share Observability AI Assistant conversations [#211854](https://github.com/elastic/kibana/pull/211854)
- Adds context-aware logic to Logs view in Discover [#211176](https://github.com/elastic/kibana/pull/211176)
- Replaces the Alerts status filter with filter controls [#198495](https://github.com/elastic/kibana/pull/198495)
- Adds SSL fields to agent binary source settings [#213211](https://github.com/elastic/kibana/pull/213211)
- Allows users to create a snooze schedule for rules using API [#210584](https://github.com/elastic/kibana/pull/210584)
- Splits up the top dependencies API for improved speed and response size [#211441](https://github.com/elastic/kibana/pull/211441)
- Adds working default metrics dashboard for Python OTel [#213599](https://github.com/elastic/kibana/pull/213599)
- Includes spaceID in SLI documents [#214278](https://github.com/elastic/kibana/pull/214278)
- Adds support for the `MV_EXPAND` command with the ES|QL rule type [#212675](https://github.com/elastic/kibana/pull/212675)
- Enables endpoint actions for events [#206857](https://github.com/elastic/kibana/pull/206857)
- Introduces GA support for the [`semantic_text`](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/elasticsearch/mapping-reference/semantic-text) field type on Elastic Cloud Serverless
- Adds the ability for users to [customize prebuilt rules](https://github.com/elastic/kibana/issues/174168). Users can modify most rule parameters, export and import prebuilt rules — including customized ones — and upgrade prebuilt rules while retaining customization settings [#212761](https://github.com/elastic/kibana/pull/212761)


### Fixes

- Fixes a bug with ServiceNow where users could not create the connector from the UI form using OAuth [#213658](https://github.com/elastic/kibana/pull/213658)
- Prevents unnecessary re-render when switching between View and Edit modes [#213902](https://github.com/elastic/kibana/pull/213902)
- Adds `event-annotation-group` to saved object privileges for dashboards [#212926](https://github.com/elastic/kibana/pull/212926)
- Makes the **Inspect configuration** button permanently visible [#213619](https://github.com/elastic/kibana/pull/213619)
- Fixes service maps not building paths when the trace's root transaction has a `parent.id` [#212998](https://github.com/elastic/kibana/pull/212998)
- Fixes span links with OTel data [#212806](https://github.com/elastic/kibana/pull/212806)
- Makes Kibana retrieval namespace-specific [#213505](https://github.com/elastic/kibana/pull/213505)
- Ensures semantic queries contribute to scoring when retrieving knowledge from search connectors [#213870](https://github.com/elastic/kibana/pull/213870)
- Passes `telemetry.sdk` data when loading a dashboard [#214356](https://github.com/elastic/kibana/pull/214356)
- Fixes `checkPrivilege` to query with indices [#214002](https://github.com/elastic/kibana/pull/214002)
- Adds support for rollup data views that reference aliases [#212592](https://github.com/elastic/kibana/pull/212592)
- Fixes an issue with the **Save** button not working when editing event filters [#213805](https://github.com/elastic/kibana/pull/213805)
- Fixes dragged elements becoming invisible when dragging-and-dropping in Lens [#213928](https://github.com/elastic/kibana/pull/213928)
- Fixes alignment of the Alerts table in the Rule Preview panel [#214028](https://github.com/elastic/kibana/pull/214028)
- Fixes Bedrock defaulting region to `us-east-1` [#214251](https://github.com/elastic/kibana/pull/214251)
- Fixes an issue with the Agent binary download field being blank when a policy uses the default download source [#214360](https://github.com/elastic/kibana/pull/214360)
- Fixes navigation issues with alert previews [#213455](https://github.com/elastic/kibana/pull/213455)
- Fixes an issue with changing the width of a Timeline column width bug [#214178](https://github.com/elastic/kibana/pull/214178)
- Reworks the `enforce_registry_filters` advanced option in Elastic Defend to align with Endpoint [#214106](https://github.com/elastic/kibana/pull/214106)
- Ensures cell actions are initialized in Event Rendered view and fixes cell action handling for nested event renderers [#212721](https://github.com/elastic/kibana/pull/212721)
- Supports `date_nanos` in `BUCKET` in the ES|QL editor [#213319](https://github.com/elastic/kibana/pull/213319)
- Fixes appearance of warnings in the ES|QL editor [#213685](https://github.com/elastic/kibana/pull/213685)
- Makes the Apply time range switch visible in the Job selection flyout when opened from the Anomaly Explorer [#213382](https://github.com/elastic/kibana/pull/213382)


## March 10, 2025


### Features and enhancements

- Adds an improved rule form for the Create Rule flyout in Elastic Observability Serverless [#206685](https://github.com/elastic/kibana/pull/206685)
- Resolves duplicate conversations in Elastic Observability Serverless [#208044](https://github.com/elastic/kibana/pull/208044)
- Splits the SLO Details view from the Overview page in Elastic Observability Serverless [#212826](https://github.com/elastic/kibana/pull/212826)
- Adds the reason message to the rules recovery context in Elastic Observability Serverless [#211411](https://github.com/elastic/kibana/pull/211411)
- Runtime metrics dashboards now support different ingest paths in Elastic Observability Serverless [#211822](https://github.com/elastic/kibana/pull/211822)
- Adds SSL options for Fleet Server hosts settings in Fleet [#208091](https://github.com/elastic/kibana/pull/208091)
- Introduces globe projection for Dashboards and visualizations [#212437](https://github.com/elastic/kibana/pull/212437)
- Registers a custom integrations search provider in Fleet [#213013](https://github.com/elastic/kibana/pull/213013)
- Adds support for searchAfter and PIT (point-in-time) parameters in the Get Agents List API in Fleet [#213486](https://github.com/elastic/kibana/pull/213486)


### Fixes

- Fixes an issue where Korean characters were split into two characters with a space in between when typing in the options list search input in Dashboards and visualizations [#213164](https://github.com/elastic/kibana/pull/213164)
- Prevents crashes when editing a Lens chart with a by-reference annotation layer in Dashboards and visualizations [#213090](https://github.com/elastic/kibana/pull/213090)
- Improves instructions for the summarize function in Elastic Observability Serverless [#212936](https://github.com/elastic/kibana/pull/212936)
- Fixes a "Product Documentation function not available" error in Elastic Observability Serverless [#212676](https://github.com/elastic/kibana/pull/212676)
- Fixes conversation tests in Elastic Observability Serverless [#213338](https://github.com/elastic/kibana/pull/213338)
- Allows wildcard filters in SLO queries in Elastic Observability Serverless [#213119](https://github.com/elastic/kibana/pull/213119)
- Fixes missing summary data in error samples in Elastic Observability Serverless [#213430](https://github.com/elastic/kibana/pull/213430)
- Fixes a failing test: Stateful Observability - Deployment-agnostic A… in Elastic Observability Serverless [#213530](https://github.com/elastic/kibana/pull/213530)
- Reduces the review rule upgrade endpoint response size in Elastic Security Serverless [#211045](https://github.com/elastic/kibana/pull/211045)
- Refactors conversation pagination in Elastic Security Serverless [#211831](https://github.com/elastic/kibana/pull/211831)
- Fixes alert insights color order in Elastic Security Serverless [#212980](https://github.com/elastic/kibana/pull/212980)
- Prevents empty conversation IDs in the chat/complete route in Elastic Security Serverless [#213049](https://github.com/elastic/kibana/pull/213049)
- Fixes issues with unstructured syslog flow in Elastic Security Serverless [#213042](https://github.com/elastic/kibana/pull/213042)
- Adds bulkGetUserProfiles privilege to Security Feature in Elastic Security Serverless [#211824](https://github.com/elastic/kibana/pull/211824)
- Fixes a Risk Score Insufficient Privileges warning due to missing cluster privileges in Elastic Security Serverless [#212405](https://github.com/elastic/kibana/pull/212405)
- Updates Bedrock prompts in Elastic Security Serverless [#213160](https://github.com/elastic/kibana/pull/213160)
- Adds organizationId and projectId OpenAI headers, along with support for arbitrary headers in Elastic Security Serverless [#213117](https://github.com/elastic/kibana/pull/213117)
- Ensures dataview selections persist reliably in timeline for Elastic Security Serverless [#211343](https://github.com/elastic/kibana/pull/211343)
- Fixes incorrect validation when a named parameter was used as a function in ES|QL [#213355](https://github.com/elastic/kibana/pull/213355)
- Fixes incorrect overall swim lane height in Machine Learning [#213245](https://github.com/elastic/kibana/pull/213245)
- Prevented a crash when applying a filter in the Machine Learning anomaly table [#213075](https://github.com/elastic/kibana/pull/213075)
- Fixes suppressed alerts alignment in the alert flyout in Elastic Security Serverless [#213029](https://github.com/elastic/kibana/pull/213029)
- Fixes an issue in solution project navigation where panels sometimes failed to toggle closed [#211852](https://github.com/elastic/kibana/pull/211852)
- Updates wording for options in the sortBy dropdown component [#206464](https://github.com/elastic/kibana/pull/206464)
- Allows EU hooks hostname in the Torq connector for Elastic Security Serverless [#212563](https://github.com/elastic/kibana/pull/212563)


## March 3, 2025


### Features and enhancements

- Introduces a background task that streamlines the upgrade process for agentless deployments in Elastic Security Serverless [#207143](https://github.com/elastic/kibana/pull/207143)
- Improves asset inventory onboarding with better context integration in Elastic Security Serverless [#212315](https://github.com/elastic/kibana/pull/212315)
- Adds syntax highlighting for working with ES|QL queries in Elastic Observability Serverless [#212669](https://github.com/elastic/kibana/pull/212669)
- Updates the delete confirmation modal in Elastic Observability Serverless [#212695](https://github.com/elastic/kibana/pull/212695)
- Removes the enablement check in PUT /api/streams/{id} for classic streams [#212289](https://github.com/elastic/kibana/pull/212289)


### Fixes

- Fixes issues affecting popularity scores in Discover [#211201](https://github.com/elastic/kibana/pull/211201)
- Corrects sorting behavior in the profiler storage explorer for Elastic Observability Serverless [#212583](https://github.com/elastic/kibana/pull/212583)
- Adds a loader to prevent flickering in the KB settings tab in Elastic Observability Serverless [#212678](https://github.com/elastic/kibana/pull/212678)
- Resolves incorrect enable button behavior in the Entity Store modal in Elastic Security Serverless [#212078](https://github.com/elastic/kibana/pull/212078)
- Converts the isolate host action into a standalone flyout in Elastic Security Serverless [#211853](https://github.com/elastic/kibana/pull/211853)
- Ensures model responses are correctly persisted to the chosen conversation ID in Elastic Security Serverless [#212122](https://github.com/elastic/kibana/pull/212122)
- Corrects image resizing issues for xpack.security.loginAssistanceMessage in Elastic Security Serverless [#212035](https://github.com/elastic/kibana/pull/212035)
- Fixes automatic import to correctly generate pipelines for parsing CSV files with special characters in Elastic Security Serverless column names [#212513](https://github.com/elastic/kibana/pull/212513)
- Fixes validation issues for empty EQL queries in Elastic Security Serverless [#212117](https://github.com/elastic/kibana/pull/212117)
- Resolves dual hover actions in the table tab in Elastic Security Serverless [#212316](https://github.com/elastic/kibana/pull/212316)
- Updates structured log processing to support multiple log types in Elastic Security Serverless [#212611](https://github.com/elastic/kibana/pull/212611)
- Ensures the delete model dialog prevents accidental multiple clicks in Machine Learning [#211580](https://github.com/elastic/kibana/pull/211580)


## February 24, 2025


### Features and enhancements

- Exposes SSL options for Elasticsearch and remote Elasticsearch outputs in the UI [#208745](https://github.com/elastic/kibana/pull/208745)
- Displays a warning and a tooltip for the _score column in the Discover grid [#211013](https://github.com/elastic/kibana/pull/211013)
- Allows `Command/Ctrl` click for the "New" action in the top navigation [#210982](https://github.com/elastic/kibana/pull/210982)
- Adds the ability for a user to create an API Key in synthetics settings that applies only to specified space(s) [#211816](https://github.com/elastic/kibana/pull/211816)
- Adds "unassigned" as an asset criticality level for bulk_upload [#208884](https://github.com/elastic/kibana/pull/208884)
- Sets the Enable visualizations in flyout advanced setting to "On" by default [#211319](https://github.com/elastic/kibana/pull/211319)
- Preserves user-made chart configurations when changing the query if the actions are compatible with the current chart, such as adding a "where" filter or switching compatible chart types [#210780](https://github.com/elastic/kibana/pull/210780)
- Adds effects when clicking the **Favorite** button in the list of dashboards and ES|QL queries, and adds the button to breadcrumb trails [#201596](https://github.com/elastic/kibana/pull/201596)
- Enables `/api/streams/{id}/_group` endpoints for GroupStreams [#210114](https://github.com/elastic/kibana/pull/210114)


### Fixes

- Fixes Discover session embeddable drilldown [#211678](https://github.com/elastic/kibana/pull/211678)
- Passes system message to inferenceCliente.chatComplete [#211263](https://github.com/elastic/kibana/pull/211263)
- Ensures system message is passed to the inference plugin [#209773](https://github.com/elastic/kibana/pull/209773)
- Adds automatic re-indexing when encountering a semantic_text bug [#210386](https://github.com/elastic/kibana/pull/210386)
- Removes unnecessary breadcrumbs in profiling [#211081](https://github.com/elastic/kibana/pull/211081)
- Adds minHeight to profiler flamegraphs [#210443](https://github.com/elastic/kibana/pull/210443)
- Adds system message in copy conversation JSON payload [#212009](https://github.com/elastic/kibana/pull/212009)
- Changes the confirmation message after RiskScore Saved Object configuration is updated [#211372](https://github.com/elastic/kibana/pull/211372)
- Adds a no data message in the flyout when an analyzer is not enabled [#211981](https://github.com/elastic/kibana/pull/211981)
- Fixes the Fleet **Save and continue** button [#211563](https://github.com/elastic/kibana/pull/211563)
- Suggests triple quotes when the user selects the KQL / QSTR [#211457](https://github.com/elastic/kibana/pull/211457)
- Adds remote cluster instructions for syncing integrations [#211997](https://github.com/elastic/kibana/pull/211997)
- Allows deploying a model after a failed deployment in Machine Learning [#211459](https://github.com/elastic/kibana/pull/211459)
- Ensures the members array is unique for GroupStreamDefinitions [#210089](https://github.com/elastic/kibana/pull/210089)
- Improves function search for easier navigation and discovery [#210437](https://github.com/elastic/kibana/pull/210437)


## February 17, 2025


### Features and enhancements

- Adds alert status management to the AI Assistant connector [#203729](https://github.com/elastic/kibana/pull/203729)
- Enables the new Borealis theme [#210468](https://github.com/elastic/kibana/pull/210468)
- Applies compact Display options Popover layout [#210180](https://github.com/elastic/kibana/pull/210180)
- Increases search timeout toast lifetime to 1 week [#210576](https://github.com/elastic/kibana/pull/210576)
- Improves performance in dependencies endpoints to prevent high CPU usage [#209999](https://github.com/elastic/kibana/pull/209999)
- Adds "Logs" tab to mobile services [#209944](https://github.com/elastic/kibana/pull/209944)
- Adds "All logs" data view to the Classic navigation [#209042](https://github.com/elastic/kibana/pull/209042)
- Changes default to "native" function calling if the connector configuration is not exposed [#210455](https://github.com/elastic/kibana/pull/210455)
- Updates entity insight badge to open entity flyouts [#208287](https://github.com/elastic/kibana/pull/208287)
- Standardizes actions in Alerts KPI visualizations [#206340](https://github.com/elastic/kibana/pull/206340)
- Allows the creation of dynamic aggregations controls for ES|QL charts [#210170](https://github.com/elastic/kibana/pull/210170)
- Fixes the values control FT [#211159](https://github.com/elastic/kibana/pull/211159)
- Trained models: Replaces the **Download** button by extending the deploy action [#205699](https://github.com/elastic/kibana/pull/205699)
- Adds the useCustomDragHandle property [#210463](https://github.com/elastic/kibana/pull/210463)
- Upcoming removal of SMS multifactor authentication method. In October, we made multifactor authentication mandatory for all users. As an additional security measure, the SMS MFA method will be removed in April. If you’re still using SMS, you will be prompted to set up a more secure MFA method, and your registered SMS MFA devices will be automatically deleted from Elastic Cloud.


### Fixes

- Fixes an issue where clicking on the name badge for a synthetics monitor on an SLO details page would lead to a page that failed to load monitor details [#210695](https://github.com/elastic/kibana/pull/210695)
- Fixes an issue where the popover in the rules page may get stuck when being clicked more than once [#208996](https://github.com/elastic/kibana/pull/208996)
- Fixes an error in the cases list when the case assignee is an empty string [#209973](https://github.com/elastic/kibana/pull/209973)
- Fixes an issue with assigning color mappings when multiple layers are defined [#208571](https://github.com/elastic/kibana/pull/208571)
- Fixes an issue where behind text colors were not correctly assigned, such as in Pie, Treemap, and Mosaic charts [#209632](https://github.com/elastic/kibana/pull/209632)
- Fixes an issue where dynamic coloring has been disabled from Last value aggregation types [#209110](https://github.com/elastic/kibana/pull/209110)
- Fixes panel styles [#210113](https://github.com/elastic/kibana/pull/210113)
- Fixes incorrectly serialized searchSessionId attribute [#210765](https://github.com/elastic/kibana/pull/210765)
- Fixes the "Save to library" action that could break the chart panel [#210125](https://github.com/elastic/kibana/pull/210125)
- Fixes link settings not persisting [#211041](https://github.com/elastic/kibana/pull/211041)
- Fixes "Untitled" export title when exporting CSV from a dashboard [#210143](https://github.com/elastic/kibana/pull/210143)
- Missing items in the trace waterfall shouldn't break it entirely [#210210](https://github.com/elastic/kibana/pull/210210)
- Removes unused `error.id` in `getErrorGroupMainStatistics` queries [#210613](https://github.com/elastic/kibana/pull/210613)
- Fixes connector test in MKI [#211235](https://github.com/elastic/kibana/pull/211235)
- Fixes an issue where clicking a link in the host/user flyout did not refresh the details panel [#209863](https://github.com/elastic/kibana/pull/209863)
- Makes 7.x signals/alerts compatible with 8.18 alerts UI [#209936](https://github.com/elastic/kibana/pull/209936)
- Handles empty categorization results from LLM [#210420](https://github.com/elastic/kibana/pull/210420)
- Remembers page index in Rule Updates table [#209537](https://github.com/elastic/kibana/pull/209537)
- Adds concurrency limits and request throttling to prebuilt rule routes [#209551](https://github.com/elastic/kibana/pull/209551)
- Fixes package name validation on the Datastream page [#210770](https://github.com/elastic/kibana/pull/210770)
- Makes entity store description more generic [#209130](https://github.com/elastic/kibana/pull/209130)
- Deletes 'critical services' count from the Entity Analytics Dashboard header [#210827](https://github.com/elastic/kibana/pull/210827)
- Disables sorting IP ranges in value list modal [#210922](https://github.com/elastic/kibana/pull/210922)
- Updates entity store copies [#210991](https://github.com/elastic/kibana/pull/210991)
- Fixes generated name for integration title [#210916](https://github.com/elastic/kibana/pull/210916)
- Fixes formatting and sorting for custom ES|QL vars [#209360](https://github.com/elastic/kibana/pull/209360)
- Fixes WHERE autocomplete with MATCH before LIMIT [#210607](https://github.com/elastic/kibana/pull/210607)
- Updates install snippets to include all platforms [#210249](https://github.com/elastic/kibana/pull/210249)
- Updates component templates with deprecated setting [#210200](https://github.com/elastic/kibana/pull/210200)
- Hides saved query controls in AIOps [#210556](https://github.com/elastic/kibana/pull/210556)
- Fixes unattended Transforms in integration packages not automatically restarting after reauthorizing [#210217](https://github.com/elastic/kibana/pull/210217)
- Reinstates switch to support generating public URLs for embed when supported [#207383](https://github.com/elastic/kibana/pull/207383)
- Provides a fallback view to recover from Stack Alerts page filters bar errors [#209559](https://github.com/elastic/kibana/pull/209559)


## February 10, 2025


### Features and enhancements

- Handles multiple prompt for the Rule connector [#209221](https://github.com/elastic/kibana/pull/209221)
- Adds `max_file_size_bytes` advanced option to malware for all operating systems [#209541](https://github.com/elastic/kibana/pull/209541)
- Introducs GroupStreams [#208126](https://github.com/elastic/kibana/pull/208126)
- Service example added to entity store upload [#209023](https://github.com/elastic/kibana/pull/209023)
- Updates the bucket_span for ML jobs in the security_host module [#209663](https://github.com/elastic/kibana/pull/209663)
- Improves handling for operator-defined role mappings [#208710](https://github.com/elastic/kibana/pull/208710)
- Adds object_src directive to Content-Security-Policy-Report-Only header [#209306](https://github.com/elastic/kibana/pull/209306)


### Fixes

- Fixes highlight for HJSON [#208858](https://github.com/elastic/kibana/pull/208858)
- Disables pointer events on drag + resize [#208647](https://github.com/elastic/kibana/pull/208647)
- Restores show missing dataView error message in case of missing datasource [#208363](https://github.com/elastic/kibana/pull/208363)
- Fixes issue with Amsterdam theme where charts render with the incorrect background color [#209595](https://github.com/elastic/kibana/pull/209595)
- Fixes an issue in Lens Table where a split-by metric on a terms rendered incorrect colors in table cells [#208623](https://github.com/elastic/kibana/pull/208623)
- Forces return 0 on empty buckets on count if null flag is disabled [#207308](https://github.com/elastic/kibana/pull/207308)
- Fixes all embeddables rebuilt on refresh [#209677](https://github.com/elastic/kibana/pull/209677)
- Fixes using data view runtime fields during rule execution for the custom threshold rule [#209133](https://github.com/elastic/kibana/pull/209133)
- Fixes running processes that were missing from the processes table [#209076](https://github.com/elastic/kibana/pull/209076)
- Fixes missing exception stack trace [#208577](https://github.com/elastic/kibana/pull/208577)
- Fixes the preview chart in the Custom Threshold rule creation form when the field name has slashes [#209263](https://github.com/elastic/kibana/pull/209263)
- Display No Data in Threshold breached component [#209561](https://github.com/elastic/kibana/pull/209561)
- Fixes an issue where APM charts were rendered without required transaction type or service name, causing excessive alerts to appear [#209552](https://github.com/elastic/kibana/pull/209552)
- Fixes bug that caused issues with loading SLOs by status, SLI type, or instance id [#209910](https://github.com/elastic/kibana/pull/209910)
- Updates colors in the AI Assistant icon [#210233](https://github.com/elastic/kibana/pull/210233)
- Updates the simulate function calling setting to support "auto" [#209628](https://github.com/elastic/kibana/pull/209628)
- Fixes structured log template to use single quotes [#209736](https://github.com/elastic/kibana/pull/209736)
- Fixes ES|QL alert on alert [#208894](https://github.com/elastic/kibana/pull/208894)
- Fixes issue with multiple IP addresses in strings [#209475](https://github.com/elastic/kibana/pull/209475)
- Keeps the histogram config on time change [#208053](https://github.com/elastic/kibana/pull/208053)
- WHERE replacement ranges correctly generated for every case [#209684](https://github.com/elastic/kibana/pull/209684)
- Updates removed parameters of the Fleet -> Logstash output configurations [#210115](https://github.com/elastic/kibana/pull/210115)
- Fixes log rate analysis, change point detection, and pattern analysis embeddables not respecting filters from Dashboard's controls [#210039](https://github.com/elastic/kibana/pull/210039)


## February 3, 2025


### Features and enhancements

- Rework saved query privileges [#202863](https://github.com/elastic/kibana/pull/202863)
- In-table search [#206454](https://github.com/elastic/kibana/pull/206454)
- Refactor RowHeightSettings component to EUI layout [#203606](https://github.com/elastic/kibana/pull/203606)
- Chat history details in conversation list [#207426](https://github.com/elastic/kibana/pull/207426)
- Cases assignees sub feature [#201654](https://github.com/elastic/kibana/pull/201654)
- Adds preview logged requests for new terms, threshold, query, ML rule types [#203320](https://github.com/elastic/kibana/pull/203320)
- Adds in-text citations to security solution AI assistant responses [#206683](https://github.com/elastic/kibana/pull/206683)
- Remove Tech preview badge for GA [#208523](https://github.com/elastic/kibana/pull/208523)
- Adds new View job detail flyouts for Anomaly detection and Data Frame Analytics [#207141](https://github.com/elastic/kibana/pull/207141)
- Adds a default "All logs" temporary data view in the Observability Solution view [#205991](https://github.com/elastic/kibana/pull/205991)
- Adds Knowledge Base entries API [#206407](https://github.com/elastic/kibana/pull/206407)
- Adds Kibana Support for Security AI Prompts Integration [#207138](https://github.com/elastic/kibana/pull/207138)
- Changes to support event.ingested as a configurable timestamp field for init and enable endpoints [#208201](https://github.com/elastic/kibana/pull/208201)
- Adds Spaces column to Anomaly Detection, Data Frame Analytics and Trained Models management pages [#206696](https://github.com/elastic/kibana/pull/206696)
- Adds simple flyout based file upload to Search [#206864](https://github.com/elastic/kibana/pull/206864)
- Bump kube-stack Helm chart onboarding version [#208217](https://github.com/elastic/kibana/pull/208217)
- Log deprecated api usages [#207904](https://github.com/elastic/kibana/pull/207904)
- Added support for human readable name attribute for saved objects audit events [#206644](https://github.com/elastic/kibana/pull/206644)
- Enhanced Role management to manage larger number of roles by adding server side filtering, pagination and querying [#194630](https://github.com/elastic/kibana/pull/194630)
- Added Entity Store data view refresh task [#208543](https://github.com/elastic/kibana/pull/208543)
- Increase maximum Osquery timeout to 24 hours [#207276](https://github.com/elastic/kibana/pull/207276)


### Fixes

- Remove use of fr unit [#208437](https://github.com/elastic/kibana/pull/208437)
- Fixes load more request size [#207901](https://github.com/elastic/kibana/pull/207901)
- Persist runPastTimeout setting [#208611](https://github.com/elastic/kibana/pull/208611)
- Allow panel to extend past viewport on resize [#208828](https://github.com/elastic/kibana/pull/208828)
- Knowledge base install updates [#208250](https://github.com/elastic/kibana/pull/208250)
- Fixes conversations test in MKI [#208649](https://github.com/elastic/kibana/pull/208649)
- Fixes ping heatmap regression when Inspect flag is turned off [#208726](https://github.com/elastic/kibana/pull/208726)
- Fixes monitor status rule for empty kql query results [#208922](https://github.com/elastic/kibana/pull/208922)
- Fixes multiple flyouts [#209158](https://github.com/elastic/kibana/pull/209158)
- Adds missing fields to input manifest templates [#208768](https://github.com/elastic/kibana/pull/208768)
- "Select a Connector" popup does not show up after the user selects any connector and then cancels it from Endpoint Insights [#208969](https://github.com/elastic/kibana/pull/208969)
- Logs shard failures for eql event queries on rule details page and in event log [#207396](https://github.com/elastic/kibana/pull/207396)
- Adds filter to entity definitions schema [#208588](https://github.com/elastic/kibana/pull/208588)
- Fixes missing ecs mappings [#209057](https://github.com/elastic/kibana/pull/209057)
- Apply the timerange to the fields fetch in the editor [#208490](https://github.com/elastic/kibana/pull/208490)
- Update java.ts - removing serverless link [#204571](https://github.com/elastic/kibana/pull/204571)


## January 27, 2025


### Features and enhancements

- Breaks out timeline and note privileges in Elastic Security Serverless [#201780](https://github.com/elastic/kibana/pull/201780)
- Adds service enrichment to the detection engine in Elastic Security Serverless [#206582](https://github.com/elastic/kibana/pull/206582)
- Updates the Entity Store Dashboard to prompt for the Service Entity Type in Elastic Security Serverless [#207336](https://github.com/elastic/kibana/pull/207336)
- Adds enrichPolicyExecutionInterval to entity enablement and initialization APIs in Elastic Security Serverless [#207374](https://github.com/elastic/kibana/pull/207374)
- Introduces a lookback period configuration for the Entity Store in Elastic Security Serverless [#206421](https://github.com/elastic/kibana/pull/206421)
- Allows pre-configured connectors to opt into exposing their configurations by setting exposeConfig in Alerting [#207654](https://github.com/elastic/kibana/pull/207654)
- Adds selector syntax support to log source profiles in Elastic Observability Serverless [#206937](https://github.com/elastic/kibana/pull/206937)
- Displays stack traces in the logs overview tab in Elastic Observability Serverless [#204521](https://github.com/elastic/kibana/pull/204521)
- Enables the use of the rule form to create rules in Elastic Observability Serverless [#206774](https://github.com/elastic/kibana/pull/206774)
- Checks only read privileges of existing indices during rule execution in Elastic Security Serverless [#177658](https://github.com/elastic/kibana/pull/177658)
- Updates KNN search and query template autocompletion in Elasticsearch Serverless [#207187](https://github.com/elastic/kibana/pull/207187)
- Updates JSON schemas for code editors in Machine Learning [#207706](https://github.com/elastic/kibana/pull/207706)
- Reindexes the .kibana_security_session_1 index to the 8.x format in Security [#204097](https://github.com/elastic/kibana/pull/204097)
- Disables `prompt=login` and sign out of Okta before initiating SSO. Fixes an issue when using organization SAML SSO where users are required to re-authenticate with the external IdP due to ForceAuthn=true being sent in SAML requests. SAML requests will now send `ForceAuthn=false`.


### Fixes

- Fixes editing alerts filters for multi-consumer rule types in Alerting [#206848](https://github.com/elastic/kibana/pull/206848)
- Resolves an issue where Chrome was no longer hidden for reports in Dashboards and Visualizations [#206988](https://github.com/elastic/kibana/pull/206988)
- Updates library transforms and duplicate functionality in Dashboards and Visualizations [#206140](https://github.com/elastic/kibana/pull/206140)
- Fixes an issue where drag previews are now absolutely positioned in Dashboards and Visualizations [#208247](https://github.com/elastic/kibana/pull/208247)
- Fixes an issue where an accessible label now appears on the range slider in Dashboards and Visualizations [#205308](https://github.com/elastic/kibana/pull/205308)
- Fixes a dropdown label sync issue when sorting by "Type" [#206424](https://github.com/elastic/kibana/pull/206424)
- Fixes an access bug related to user instructions in Elastic Observability Serverless [#207069](https://github.com/elastic/kibana/pull/207069)
- Fixes the Open Explore in Discover link to open in a new tab in Elastic Observability Serverless [#207346](https://github.com/elastic/kibana/pull/207346)
- Returns an empty object for tool arguments when none are provided in Elastic Observability Serverless [#207943](https://github.com/elastic/kibana/pull/207943)
- Ensures similar cases count is not fetched without the proper license in Elastic Security Serverless [#207220](https://github.com/elastic/kibana/pull/207220)
- Fixes table leading actions to use standardized colors in Elastic Security Serverless [#207743](https://github.com/elastic/kibana/pull/207743)
- Adds missing fields to the AWS S3 manifest in Elastic Security Serverless [#208080](https://github.com/elastic/kibana/pull/208080)
- Prevents redundant requests when loading Discover sessions and toggling chart visibility in ES|QL [#206699](https://github.com/elastic/kibana/pull/206699)
- Fixes a UI error when agents move to an orphaned state in Fleet [#207746](https://github.com/elastic/kibana/pull/207746)
- Restricts non-local Elasticsearch output types for agentless integrations and policies in Fleet [#207296](https://github.com/elastic/kibana/pull/207296)
- Fixes table responsiveness in the Notifications feature of Machine Learning [#206956](https://github.com/elastic/kibana/pull/206956)


## January 13, 2025


### Features and enhancements

- Adds last alert status change to Elastic Security Serverless flyout [#205224](https://github.com/elastic/kibana/pull/205224)
- Case templates are now GA [#205940](https://github.com/elastic/kibana/pull/205940)
- Adds format to JSON messages in Elastic Observability Serverless Logs profile [#205666](https://github.com/elastic/kibana/pull/205666)
- Adds inference connector in Elastic Security Serverless AI features [#204505](https://github.com/elastic/kibana/pull/204505)
- Adds inference connector for Auto Import in Elastic Security Serverless [#206111](https://github.com/elastic/kibana/pull/206111)
- Adds Feature Flag Support for Cloud Security Posture Plugin in Elastic Security Serverless [#205438](https://github.com/elastic/kibana/pull/205438)
- Adds the ability to sync Machine Learning saved objects to all spaces [#202175](https://github.com/elastic/kibana/pull/202175)
- Improves messages for recovered alerts in Machine Learning Transforms [#205721](https://github.com/elastic/kibana/pull/205721)
- Introduces new deployment performance metrics charts. AutoOps provides aggregate metrics at the cluster level for key performance indicators. The data is tier-based, offering users a comprehensive understanding of each tier and the entire cluster.
- Deprecates Cloud Defend billing alerts. Following the deprecation of Cloud Defend in Serverless, removes the billing logic associated with the feature.


### Fixes

- Fixes an issue where "KEEP" columns are not applied after an Elasticsearch error in Discover [#205833](https://github.com/elastic/kibana/pull/205833)
- Resolves padding issues in the document comparison table in Discover [#205984](https://github.com/elastic/kibana/pull/205984)
- Fixes a bug affecting bulk imports for the knowledge base in Elastic Observability Serverless [#205075](https://github.com/elastic/kibana/pull/205075)
- Enhances the Find API by adding cursor-based pagination (search_after) as an alternative to offset-based pagination [#203712](https://github.com/elastic/kibana/pull/203712)
- Updates Elastic Observability Serverless to use architecture-specific Elser models [#205851](https://github.com/elastic/kibana/pull/205851)
- Fixes dynamic batching in the timeline for Elastic Security Serverless [#204034](https://github.com/elastic/kibana/pull/204034)
- Resolves a race condition bug in Elastic Security Serverless related to OpenAI errors [#205665](https://github.com/elastic/kibana/pull/205665)
- Improves the integration display by ensuring all policies are listed in Elastic Security Serverless [#205103](https://github.com/elastic/kibana/pull/205103)
- Renames color variables in the user interface for better clarity and consistency [#204908](https://github.com/elastic/kibana/pull/204908)
- Allows editor suggestions to remain visible when the inline documentation flyout is open in ES|QL [#206064](https://github.com/elastic/kibana/pull/206064)
- Ensures the same time range is applied to documents and the histogram in ES|QL [#204694](https://github.com/elastic/kibana/pull/204694)
- Fixes validation for the "required" field in multi-text input fields in Fleet [#205768](https://github.com/elastic/kibana/pull/205768)
- Fixes timeout issues for bulk actions in Fleet [#205735](https://github.com/elastic/kibana/pull/205735)
- Handles invalid RRule parameters to prevent infinite loops in alerts [#205650](https://github.com/elastic/kibana/pull/205650)
- Fixes privileges display for features and sub-features requiring "All Spaces" permissions in Fleet [#204402](https://github.com/elastic/kibana/pull/204402)
- Prevents password managers from modifying disabled input fields [#204269](https://github.com/elastic/kibana/pull/204269)
- Updates the listing control in the user interface [#205914](https://github.com/elastic/kibana/pull/205914)
- Improves consistency in the help dropdown design [#206280](https://github.com/elastic/kibana/pull/206280)


## January 6, 2025


### Features and enhancements

- Introduces case observables in Elastic Security Serverless [#190237](https://github.com/elastic/kibana/pull/190237)
- Adds a JSON field called "additional fields" to ServiceNow cases when sent using connector, containing the internal names of the ServiceNow table columns [#201948](https://github.com/elastic/kibana/pull/201948)
- Adds the ability to configure the appearance color mode to sync dark mode with the system value [#203406](https://github.com/elastic/kibana/pull/203406)
- Makes the "Copy" action visible on cell hover in Discover [#204744](https://github.com/elastic/kibana/pull/204744)
- Updates the EnablementModalCallout name to AdditionalChargesMessage in Elastic Security Serverless [#203061](https://github.com/elastic/kibana/pull/203061)
- Adds more control over which Elastic Security Serverless alerts in Attack Discovery are included as context to the large language model [#205070](https://github.com/elastic/kibana/pull/205070)
- Adds a consistent layout and other UI enhancements for machine learning pages [#203813](https://github.com/elastic/kibana/pull/203813)


### Fixes

- Fixes an issue that caused dashboards to lag when dragging the time slider [#201885](https://github.com/elastic/kibana/pull/201885)
- Updates the CloudFormation template to the latest version and adjusts the documentation to reflect the use of a single Firehose stream created by the new template [#204185](https://github.com/elastic/kibana/pull/204185)
- Fixes Integration and Datastream name validation in Elastic Security Serverless [#204943](https://github.com/elastic/kibana/pull/204943)
- Fixes an issue in the Automatic Import process where there is now inclusion of the @timestamp field in ECS field mappings whenever possible [#204931](https://github.com/elastic/kibana/pull/204931)
- Allows Automatic Import to safely parse Painless field names that are not valid Painless identifiers in if contexts [#205220](https://github.com/elastic/kibana/pull/205220)
- Aligns the Box Native Connector configuration fields with the source of truth in the connectors codebase, correcting mismatches and removing unused configurations [#203241](https://github.com/elastic/kibana/pull/203241)
- Fixes the "Show all agent tags" option in Fleet when the agent list is filtered [#205163](https://github.com/elastic/kibana/pull/205163)
- Updates the Results Explorer flyout footer buttons alignment in Data Frame Analytics [#204735](https://github.com/elastic/kibana/pull/204735)
- Adds a missing space between lines in the Data Frame Analytics delete job modal [#204732](https://github.com/elastic/kibana/pull/204732)
- Fixes an issue where the **Refresh** button in the Anomaly Detection Datafeed counts table was unresponsive [#204625](https://github.com/elastic/kibana/pull/204625)
- Fixes the inference timeout check in File Upload [#204722](https://github.com/elastic/kibana/pull/204722)
- Fixes the side bar navigation for the Data Visualizer [#205170](https://github.com/elastic/kibana/pull/205170)


## December 16, 2024


### Features and enhancements

- Optimizes the Kibana Trained Models API [#200977](https://github.com/elastic/kibana/pull/200977)
- Adds a Create Case action to the Log rate analysis page [#201549](https://github.com/elastic/kibana/pull/201549)
- Improves AI Assistant’s response quality by giving it access to Elastic’s product documentation [#199694](https://github.com/elastic/kibana/pull/199694)
- Adds support for suppressing EQL sequence alerts [#189725](https://github.com/elastic/kibana/pull/189725)
- Adds an Advanced settings section to the SLO form [#200822](https://github.com/elastic/kibana/pull/200822)
- Adds a new sub-feature privilege under Synthetics and Uptime Can manage private locations [#201100](https://github.com/elastic/kibana/pull/201100)


### Fixes

- Fixes point visibility regression [#202358](https://github.com/elastic/kibana/pull/202358)
- Improves help text of creator and view count features on dashboard listing page [#202488](https://github.com/elastic/kibana/pull/202488)
- Highlights matching field values when performing a KQL search on a keyword field [#201952](https://github.com/elastic/kibana/pull/201952)
- Supports "Inspect" in saved search embeddables [#202947](https://github.com/elastic/kibana/pull/202947)
- Fixes your ability to clear the user-specific system prompt [#202279](https://github.com/elastic/kibana/pull/202279)
- Fixes error when opening rule flyout [#202386](https://github.com/elastic/kibana/pull/202386)
- Fixes to Ops Genie as a default connector [#201923](https://github.com/elastic/kibana/pull/201923)
- Fixes actions on charts [#202443](https://github.com/elastic/kibana/pull/202443)
- Adds flyout to table view in Infrastructure Inventory [#202646](https://github.com/elastic/kibana/pull/202646)
- Fixes service names with spaces not being URL encoded properly for context.viewInAppUrl [#202890](https://github.com/elastic/kibana/pull/202890)
- Allows access query logic to handle user ID and name conditions [#202833](https://github.com/elastic/kibana/pull/202833)
- Fixes APM rule error message for invalid KQL filter [#203096](https://github.com/elastic/kibana/pull/203096)
- Rejects CEF logs from Automatic Import and redirects you to the CEF integration instead [#201792](https://github.com/elastic/kibana/pull/201792)
- Updates the install rules title and message [#202226](https://github.com/elastic/kibana/pull/202226)
- Fixes error on second entity engine init API call [#202903](https://github.com/elastic/kibana/pull/202903)
- *estricts unsupported log formats [#202994](https://github.com/elastic/kibana/pull/202994)
- Removes errors related to Enterprise Search nodes [#202437](https://github.com/elastic/kibana/pull/202437)
- Improves web crawler name consistency [#202738](https://github.com/elastic/kibana/pull/202738)
- Fixes editor cursor jumpiness [#202389](https://github.com/elastic/kibana/pull/202389)
- Fixes rollover datastreams on subobjects mapper exception [#202689](https://github.com/elastic/kibana/pull/202689)
- Fixes spaces sync to retrieve 10,000 trained models [#202712](https://github.com/elastic/kibana/pull/202712)
- Fixes log rate analysis embeddable error on the Alerts page [#203093](https://github.com/elastic/kibana/pull/203093)
- Fixes Slack API connectors not displayed under Slack connector type when adding new connector to rule [#202315](https://github.com/elastic/kibana/pull/202315)


## December 9, 2024


### Features and enhancements

- Elastic Observability Serverless adds a new sub-feature for managing private locations [#201100](https://github.com/elastic/kibana/pull/201100)
- Elastic Observability Serverless adds the ability to configure SLO advanced settings from the UI [#200822](https://github.com/elastic/kibana/pull/200822)
- Elastic Security Serverless adds support for suppressing EQL sequence alerts [#189725](https://github.com/elastic/kibana/pull/189725)
- Elastic Security Serverless adds a /trained_models_list endpoint to retrieve complete data for the Trained Model UI [#200977](https://github.com/elastic/kibana/pull/200977)
- Machine Learning adds an action to include log rate analysis in a case [#199694](https://github.com/elastic/kibana/pull/199694)
- Machine Learning enhances the Kibana API to optimize trained models [#201549](https://github.com/elastic/kibana/pull/201549)


### Fixes

- Fixes Slack API connectors not being displayed under the Slack connector type when adding a new connector to a rule in Alerting [#202315](https://github.com/elastic/kibana/pull/202315)
- Fixes point visibility regression in dashboard visualizations [#202358](https://github.com/elastic/kibana/pull/202358)
- Improves help text for creator and view count features on the Dashboard listing page [#202488](https://github.com/elastic/kibana/pull/202488)
- Highlights matching field values when performing a KQL search on a keyword field in Discover [#201952](https://github.com/elastic/kibana/pull/201952)
- Adds support for the Inspect option in saved search embeddables in Discover [#202947](https://github.com/elastic/kibana/pull/202947)
- Enables the ability to clear user-specific system prompts in Elastic Observability Serverless [#202279](https://github.com/elastic/kibana/pull/202279)
- Fixes an error when opening the rule flyout in Elastic Observability Serverless [#202386](https://github.com/elastic/kibana/pull/202386)
- Improves handling of Opsgenie as the default connector in Elastic Observability Serverless [#201923](https://github.com/elastic/kibana/pull/201923)
- Fixes issues with actions on charts in Elastic Observability Serverless [#202443](https://github.com/elastic/kibana/pull/202443)
- Adds a flyout to the table view in Infrastructure Inventory in Elastic Observability Serverless [#202646](https://github.com/elastic/kibana/pull/202646)
- Fixes service names with spaces not being URL-encoded properly for `{{context.viewInAppUrl}}` in Elastic Observability Serverless [#202890](https://github.com/elastic/kibana/pull/202890)
- Enhances access query logic to handle user ID and name conditions in Elastic Observability Serverless [#202833](https://github.com/elastic/kibana/pull/202833)
- Fixes an APM rule error message when a KQL filter is invalid in Elastic Observability Serverless [#203096](https://github.com/elastic/kibana/pull/203096)
- Restricts and rejects CEF logs in automatic import and redirects them to the CEF integration in Elastic Security Serverless [#201792](https://github.com/elastic/kibana/pull/201792)
- Updates the copy of the install rules title and message in Elastic Security Serverless [#202226](https://github.com/elastic/kibana/pull/202226)
- Clears errors on the second entity engine initialization API call in Elastic Security Serverless [#202903](https://github.com/elastic/kibana/pull/202903)
- Restricts unsupported log formats in Elastic Security Serverless [#202994](https://github.com/elastic/kibana/pull/202994)
- Removes errors related to Enterprise Search nodes in Elasticsearch Serverless [#202437](https://github.com/elastic/kibana/pull/202437)
- Ensures consistency in web crawler naming in Elasticsearch Serverless [#202738](https://github.com/elastic/kibana/pull/202738)
- Fixes editor cursor jumpiness in ES|QL [#202389](https://github.com/elastic/kibana/pull/202389)
- Implements rollover of data streams on subobject mapper exceptions in Fleet [#202689](https://github.com/elastic/kibana/pull/202689)
- Fixes trained models to retrieve up to 10,000 models when spaces are synced in Machine Learning [#202712](https://github.com/elastic/kibana/pull/202712)
- Fixes a Log Rate Analysis embeddable error on the Alerts page in AiOps [#203093](https://github.com/elastic/kibana/pull/203093)


## December 3, 2024


### Features and enhancements

- Adds tabs for Import Entities and Engine Status to the Entity Store [#201235](https://github.com/elastic/kibana/pull/201235)
- Adds status tracking for agentless integrations to Fleet [#199567](https://github.com/elastic/kibana/pull/199567)
- Adds a new machine learning module that can detect anomalous activity in host-based logs [#195582](https://github.com/elastic/kibana/pull/195582)
- Allows custom Mapbox Vector Tile sources to style map layers and provide custom legends [#200656](https://github.com/elastic/kibana/pull/200656)
- Excludes stale SLOs from counts of healthy and violated SLOs [#201027](https://github.com/elastic/kibana/pull/201027)
- Adds a "Continue without adding integrations" message to the Elastic Security Dashboards page that takes you to the Entity Analytics dashboard [#201363](https://github.com/elastic/kibana/pull/201363)
- Displays visualization descriptions under their titles [#198816](https://github.com/elastic/kibana/pull/198816)


### Fixes

- Hides the **Clear** button when no filters are selected [#200177](https://github.com/elastic/kibana/pull/200177)
- Fixes a mismatch between how wildcards were handled in previews versus actual rule executions [#201553](https://github.com/elastic/kibana/pull/201553)
- Fixes incorrect Y-axis and hover values in the Service Inventory’s Log rate chart [#201361](https://github.com/elastic/kibana/pull/201361)
- Disables the **Add note** button in the alert details flyout for users who lack privileges [#201707](https://github.com/elastic/kibana/pull/201707)
- Fixes the descriptions of threshold rules that use cardinality [#201162](https://github.com/elastic/kibana/pull/201162)
- Disables the **Install All** button on the Add Elastic Rules page when rules are installing [#201731](https://github.com/elastic/kibana/pull/201731)
- Reintroduces a data usage warning on the Entity Analytics Enablement modal [#201920](https://github.com/elastic/kibana/pull/201920)
- Improves accessibility for the Create a connector page [#201590](https://github.com/elastic/kibana/pull/201590)
- Fixes a bug that could cause Elastic Agents to get stuck updating during scheduled upgrades [#202126](https://github.com/elastic/kibana/pull/202126)
- Fixes a bug related to starting machine learning deployments with autoscaling and no active nodes [#201256](https://github.com/elastic/kibana/pull/201256)
- Initializes saved objects when the Trained Model page loads [#201426](https://github.com/elastic/kibana/pull/201426)
- Fixes the display of deployment stats for unallocated deployments of machine learning models [#202005](https://github.com/elastic/kibana/pull/202005)
- Enables the solution type search for instant deployments [#201688](https://github.com/elastic/kibana/pull/201688)
- Improves the consistency of alert counts across different views [#202188](https://github.com/elastic/kibana/pull/202188)