diff --git a/_observing-your-data/alerting/composite-monitors.md b/_observing-your-data/alerting/composite-monitors.md index 7defad4db5..80c95e677e 100644 --- a/_observing-your-data/alerting/composite-monitors.md +++ b/_observing-your-data/alerting/composite-monitors.md @@ -63,7 +63,7 @@ In this simple example, the first monitor could be a per document monitor config ## Managing composite monitors with the API -You can manage composite monitors using the OpenSearch REST API or [OpenSearch Dashboards](#creating-composite-monitors-in-opensearch-dashboards). This section covers API functionality for composite monitors. +You can manage composite monitors using the OpenSearch REST API or [OpenSearch Dashboards](#creating-composite-monitors-in-opensearch-dashboards). This section describes API functionality for composite monitors. ### Create composite monitor diff --git a/_security-analytics/sec-analytics-config/detectors-config.md b/_security-analytics/sec-analytics-config/detectors-config.md index e895db217f..531c1ed7aa 100644 --- a/_security-analytics/sec-analytics-config/detectors-config.md +++ b/_security-analytics/sec-analytics-config/detectors-config.md @@ -146,7 +146,7 @@ To set up an alert for a detector, continue with the following steps: ## Integrated Alerting plugin workflows -By default, when you create a threat detector the system automatically creates a composite monitor and triggers workflows for the Alerting plugin. The detector's rules are converted into search queries for the Alerting plugin monitor, and the monitor executes its queries according to a schedule derived from the detector's configuration. +By default, when you create a threat detector, the system automatically creates a composite monitor and triggers workflows for the Alerting plugin. The detector's rules are converted into search queries for the Alerting plugin monitor, and the monitor executes its queries according to a schedule derived from the detector's configuration. You can change the behavior of automatically generated composite monitors by enabling or disabling the workflow functionality with the `plugins.security_analytics.enable_workflow_usage` setting. This setting is defined using the [Cluster settings API]({{site.url}}{{site.baseurl}}/api-reference/cluster-api/cluster-settings/).