[Observability/Kibana][Alerting] Document Stack and Observability Alerts feature privileges (#7642)

## Summary

Documents the new **Stack Alerts** and **Observability Alerts** feature
privileges (9.5 and Serverless), which let users read alerts and perform
per-alert actions (snooze, unsnooze, acknowledge) without the broader
rule-management privilege. Also adds dedicated **Required permissions**
sections to the rules and alerts pages so readers see rule-management
and alert-triage privileges side by side, with the stack/serverless
differences called out inline instead of in separate notes.

Fixes #7228.

### Previews

* [Alerting setup | Give access to triage alerts without managing
rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7642/explore-analyze/alerting/alerts/alerting-setup#_give_access_to_triage_alerts_without_managing_rules):
New section explaining how to grant the Stack Alerts and Observability
Alerts feature privileges, what their All and Read levels allow, and
which rule types can appear under both privileges.
* [Create and manage rules (Kibana) | Required
permissions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7642/explore-analyze/alerting/alerts/create-manage-rules#_required_permissions):
Restructured into two flat bullets (Rules, Alerts) covering both the
{{stack}} and serverless permission models, including the Editor role
for serverless rule management and the Stack/Observability Alerts
privilege for triage-only access.
* [View and manage alerts
(Kibana)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7642/explore-analyze/alerting/alerts/view-alerts):
Adds a **Required permissions** section (replacing the old inline note)
explaining the Stack Alerts / Observability Alerts privilege needed to
view alerts and perform per-alert actions.
* [Create and manage rules (Observability) | Required
permissions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7642/solutions/observability/incident-management/create-manage-rules#_required_permissions):
Consolidates the previous top-of-page notes into the intro paragraph and
a new **Required permissions** section with Rules and Alerts bullets
covering both stack and serverless.
* [View and manage alerts
(Observability)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7642/solutions/observability/incident-management/view-alerts):
Adds a **Required permissions** section explaining the Observability
Alerts privilege needed to view alerts and perform per-alert actions.

## Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this
contribution?
- [x] Yes - Cursor + Claude
- [ ] No

Author: nastasha-solomon

explore-analyze/alerting/alerts/alerting-setup.md

@@ -72,6 +72,30 @@ The rule type also affects the privileges that are required. For example, to vie
 
 ::::
 
+### Give access to triage alerts without managing rules [_give_access_to_triage_alerts_without_managing_rules]
+
+```{applies_to}
+stack: ga 9.5+
+serverless: ga
+```
+
+To let users read alerts and perform per-alert actions such as [snooze](view-alerts.md), unsnooze, and [acknowledge](view-alerts.md#acknowledge-alerts), assign one or both of the following feature privileges. These privileges do not include rule management.
+
+**{{kib}} privileges**
+
+* **Management → Stack Alerts**:
+  * `All`: Read {{stack-manage-app}} alerts and perform per-alert actions across {{stack-manage-app}} rule types (for example, the {{es}} query, index threshold, geo-containment, transform health, {{ml}} anomaly detection, and custom threshold rule types).
+  * `Read`: Read {{stack-manage-app}} alerts and their snooze state.
+* **Observability → Observability Alerts**:
+  * `All`: Read {{observability}} alerts and perform per-alert actions across {{observability}} rule types (for example, the APM, infrastructure, logs, SLO burn rate, Synthetics, and custom threshold rule types).
+  * `Read`: Read {{observability}} alerts and their snooze state.
+
+Some rule types, such as {{es}} query, custom threshold, and {{ml}} anomaly detection, can appear on both the **Stack Alerts** and **Observability Alerts** pages. Grant the privilege that matches the alerts page your users work from, or grant both when they need access in each context.
+
+:::{note}
+These privileges don't grant permission to create, edit, enable, disable, or delete rules. To manage rules, users still need the appropriate **{{stack-rules-feature}}** or {{observability}} feature privileges described earlier on this page. On both alerts pages, viewing rule stats, rule name links, and the **View rule details** action requires rule-read authorization in addition to these alert privileges.
+:::
+
 ### Give view-only access to alerts in **Discover** or **Dashboards** [_give_view_only_access_to_alerts_in_discover_or_dashboards]
 
 **{{kib}} privileges**

explore-analyze/alerting/alerts/create-manage-rules.md

@@ -39,7 +39,9 @@ For more information on alerting concepts and the types of rules and connectors
 
 ## Required permissions [_required_permissions]
 
-Access to rules is granted based on your {{alert-features}} privileges. For more information, go to [Security](alerting-setup.md#alerting-security).
+* **Rules**: To create and manage rules, you need the appropriate feature privileges for the app that owns the rule type, for example, {{observability}} features for Observability rules, or {{ml-app}} for anomaly detection rules. For more information, go to [Security](alerting-setup.md#alerting-security). {applies_to}`serverless: ga` On serverless, assign the **Editor** role or higher instead. For more information, refer to [Assign user roles and privileges](/deploy-manage/users-roles/cloud-organization/user-roles.md#general-assign-user-roles).
+
+* **Alerts**: To read alerts and perform per-alert actions (such as snooze, unsnooze, and acknowledge) without allowing users to manage rules—assign the **Stack Alerts** or **Observability Alerts** feature privilege, depending on which alerts page you use (`All` for full access, or `Read` for view and snooze state only). Assign this through {{kib}} roles on the {{stack}}, or through a [custom role](/deploy-manage/users-roles/serverless-custom-roles.md) on serverless. For details, refer to [Give access to triage alerts without managing rules](alerting-setup.md#_give_access_to_triage_alerts_without_managing_rules).
 
 ## {{cps-cap}} scope for rules [cps-scope-for-rules]
 ```{applies_to}

explore-analyze/alerting/alerts/view-alerts.md

@@ -25,10 +25,9 @@ Manage alerts from the following places:
 :screenshot:
 :::
 
-::::{note}
-You must have the appropriate {{kib}} {{alert-features}} and index privileges to view alerts. Refer to [Alerting security requirements](alerting-setup.md#alerting-security).
+## Required permissions [_required_permissions]
 
-::::
+To view alerts and perform per-alert actions such as snooze, unsnooze, and acknowledge, assign the **Stack Alerts** or **Observability Alerts** feature privilege, depending on which alerts page you use (`All` for full access, or `Read` for view and snooze state only). Assign this through {{kib}} roles on the {{stack}}, or through a [custom role](/deploy-manage/users-roles/serverless-custom-roles.md) on serverless. For more information, refer to [Give access to triage alerts without managing rules](alerting-setup.md#_give_access_to_triage_alerts_without_managing_rules).
 
 ## Filter alerts [filter-alerts]
 

solutions/observability/incident-management/create-manage-rules.md

@@ -14,22 +14,21 @@ description: Create and manage alerting rules for Elastic Observability applicat
 
 # Create and manage rules for Elastic {{observability}} [observability-create-manage-rules]
 
-::::{note}
-
-**For Observability serverless projects**, the **Editor** role or higher is required to create and manage rules for alerting. To learn more, refer to [Assign user roles and privileges](/deploy-manage/users-roles/cloud-organization/user-roles.md#general-assign-user-roles).
-
-::::
-
-
 Alerting enables you to define *rules*, which detect complex conditions within different apps and trigger actions when those conditions are met. Alerting provides a set of built-in connectors and rules for you to use.
 
 ::::{note}
 :applies_to: {"stack": "ga 9.4+", "serverless": "ga"}
 
-All of your alerting rules appear in one list on the **Rules** page. Open the page from **{{stack-manage-app}}** > **Alerts and insights** > **{{rules-ui}}**, or from **Manage rules** (or the equivalent link) in {{observability}}, Discover, or Stack Monitoring. Each of these opens the same **Rules** page, where you can view and manage rules.
+All of your alerting rules appear in one list on the **Rules** page. Open the page from **{{stack-manage-app}}** → **Alerts and insights** → **{{rules-ui}}**, or from **Manage rules** (or the equivalent link) in {{observability}}, Discover, or Stack Monitoring. Each of these opens the same **Rules** page, where you can view and manage rules.
 ::::
 
 
+## Required permissions [_required_permissions]
+
+* **Rules**: To create and manage {{observability}} rules, assign `All` privileges for the relevant Observability features, which vary by rule type, for example, APM, Logs, Infrastructure, or Synthetics. Anomaly detection rules also require **Analytics → {{ml-app}}** privileges. For more information, refer to [Alerting security requirements](/explore-analyze/alerting/alerts/alerting-setup.md#alerting-security). {applies_to}`serverless: ga` On serverless, assign the **Editor** role or higher instead. For more information, refer to [Assign user roles and privileges](/deploy-manage/users-roles/cloud-organization/user-roles.md#general-assign-user-roles).
+
+* **Alerts**: To read {{observability}} alerts and perform per-alert actions (such as snooze, unsnooze, and acknowledge) without allowing users to manage rules—assign the **Observability Alerts** feature privilege (`All` for full access, or `Read` for view and snooze state only). Assign this through {{kib}} roles on the {{stack}}, or through a [custom role](/deploy-manage/users-roles/serverless-custom-roles.md) on serverless. For more information, refer to [Give access to triage alerts without managing rules](/explore-analyze/alerting/alerts/alerting-setup.md#_give_access_to_triage_alerts_without_managing_rules).
+
 ## Observability rules [observability-create-manage-rules-observability-rules]
 
 Learn more about Observability rules and how to create them:

solutions/observability/incident-management/view-alerts.md

@@ -22,6 +22,10 @@ The **Alerts** page provides a central view of all alerts across your Elastic {{
 :screenshot:
 :::
 
+## Required permissions [_required_permissions]
+
+To view {{observability}} alerts and perform per-alert actions such as snooze, unsnooze, and acknowledge, assign the **Observability Alerts** feature privilege (`All` for full access, or `Read` for view and snooze state only). Assign this through {{kib}} roles on the {{stack}}, or through a [custom role](/deploy-manage/users-roles/serverless-custom-roles.md) on serverless. For more information, refer to [Give access to triage alerts without managing rules](/explore-analyze/alerting/alerts/alerting-setup.md#_give_access_to_triage_alerts_without_managing_rules).
+
 ## Filter and customize the alerts table [observability-view-alerts-work-with-table]
 
 Use the KQL bar to search for specific alerts using [{{kib}} Query Language](/explore-analyze/query-filter/languages/kql.md), or use the time range picker and status filter buttons below it to narrow alerts by time period or status (active, recovered, or untracked).