diff --git a/docs/en/serverless/images/anomalies-overlay.png b/docs/en/serverless/images/anomalies-overlay.png
index 096de18ceb..5f4c28720a 100644
Binary files a/docs/en/serverless/images/anomalies-overlay.png and b/docs/en/serverless/images/anomalies-overlay.png differ
diff --git a/docs/en/serverless/images/hosts-open-in-lens.png b/docs/en/serverless/images/hosts-open-in-lens.png
index cd37372e80..dbadc02bb3 100644
Binary files a/docs/en/serverless/images/hosts-open-in-lens.png and b/docs/en/serverless/images/hosts-open-in-lens.png differ
diff --git a/docs/en/serverless/images/logs-overlay.png b/docs/en/serverless/images/logs-overlay.png
index 8b2e538cb2..002656477d 100644
Binary files a/docs/en/serverless/images/logs-overlay.png and b/docs/en/serverless/images/logs-overlay.png differ
diff --git a/docs/en/serverless/images/metadata-overlay.png b/docs/en/serverless/images/metadata-overlay.png
index 71a61f565e..0ab8c94952 100644
Binary files a/docs/en/serverless/images/metadata-overlay.png and b/docs/en/serverless/images/metadata-overlay.png differ
diff --git a/docs/en/serverless/images/metrics-overlay.png b/docs/en/serverless/images/metrics-overlay.png
index 4d40b434d4..5bfcb52309 100644
Binary files a/docs/en/serverless/images/metrics-overlay.png and b/docs/en/serverless/images/metrics-overlay.png differ
diff --git a/docs/en/serverless/images/overview-overlay.png b/docs/en/serverless/images/overview-overlay.png
new file mode 100644
index 0000000000..ae501da1e6
Binary files /dev/null and b/docs/en/serverless/images/overview-overlay.png differ
diff --git a/docs/en/serverless/infra-monitoring/analyze-hosts.mdx b/docs/en/serverless/infra-monitoring/analyze-hosts.mdx
index 4584f07d94..1cd656f1e7 100644
--- a/docs/en/serverless/infra-monitoring/analyze-hosts.mdx
+++ b/docs/en/serverless/infra-monitoring/analyze-hosts.mdx
@@ -44,7 +44,8 @@ Need help getting started? Follow the steps in
The **Hosts** page provides several ways to view host metrics:
* Overview tiles show the number of hosts returned by your search plus
- averages of key metrics, including CPU usage, memory usage, and throughput.
+ averages of key metrics, including CPU usage, normalized load, and memory usage.
+ Max disk usage is also shown.
* The Host limit controls the maximum number of hosts shown on the page. The
default is 50, which means the page shows data for the top 50 hosts based on the
@@ -56,8 +57,7 @@ The **Hosts** page provides several ways to view host metrics:
or change the number of rows displayed on each page to see all of your hosts.
* Each host name is an active link to a page,
- which includes metrics, host metadata, alerts, processes, logs, and anomalies.
- You can optionally open the host details in an overlay.
+ where you can explore enhanced metrics and other observability data related to the selected host.
* Table columns are sortable, but note that the sorting behavior is applied to
the already returned data set.
@@ -109,13 +109,14 @@ page:
## View metrics
-On the **Metrics** tab of the **Hosts** page, view metrics trending over time, including normalized load,
-CPU usage, memory usage, network inbound, network outbound, disk read IOPS, and
-disk write IOPS. Place your cursor over a line to view metrics at a specific
-point in time.
+On the **Metrics** tab, view metrics trending over time, including CPU usage,
+normalized load, memory usage, disk usage, and other metrics related to disk IOPs and throughput.
+Place your cursor over a line to view metrics at a specific
+point in time. From within each visualization, you can choose to open the visualization in Lens.
To see metrics for a specific host, refer to .
+{/* TODO: Uncomment this section if/when the inspect option feature is added back in.
### Inspect and download metrics
@@ -134,7 +135,7 @@ file.
Click **View: Data** and notice that you can change the view to **Requests** to explore the request
used to fetch the data and the response returned from ((es)). On the **Request** tab, click links
-to further inspect and analyze the request in the Dev Console or Search Profiler.
+to further inspect and analyze the request in the Dev Console or Search Profiler. */}
@@ -212,8 +213,7 @@ The host details overlay contains the following tabs:
-These metrics are also available when viewing hosts on the **Inventory**
-page.
+The metrics shown on the **Hosts** page are also available when viewing hosts on the **Inventory** page.
diff --git a/docs/en/serverless/transclusion/host-details.mdx b/docs/en/serverless/transclusion/host-details.mdx
index 1544498e4b..c23264db25 100644
--- a/docs/en/serverless/transclusion/host-details.mdx
+++ b/docs/en/serverless/transclusion/host-details.mdx
@@ -2,34 +2,43 @@
-
-
-The **Overview** tab displays metrics about the selected host, including CPU usage,
-normalized load, memory usage, disk usage, network traffic, and the log rate.
+The **Overview** tab displays key metrics about the selected host, such as CPU usage,
+normalized load, memory usage, and max disk usage.
Change the time range to view metrics over a specific period of time.
+Expand each section to view more detail related to the selected host, such as metadata,
+active alerts, services detected on the host, and metrics.
+
Hover over a specific time period on a chart to compare the various metrics at that given time.
-Expand the **Alerts** section to see alerts related to the selected host.
+Click **Show all** to drill down into related data.
+
+
-
-
The **Metadata** tab lists all the meta information relating to the host,
including host, cloud, and agent information.
This information can help when investigating events—for example,
when filtering by operating system or architecture.
+
+
-
+
-
+The **Metrics** tab shows host metrics organized by type and is more complete than the view available in the *Overview* tab.
+
+
+
+
+
+
The **Processes** tab lists the total number of processes (`system.process.summary.total`) running on the host,
along with the total number of processes in these various states:
@@ -55,12 +64,12 @@ The number of top processes is controlled by `process.include_top_n.by_cpu` and
| **Memory** | The percentage of memory (`system.process.memory.rss.pct`) the process occupied in main memory (RAM). |
| **State** | The current state of the process and the total number of processes (`system.process.state`). Expected values are: `running`, `sleeping`, `dead`, `stopped`, `idle`, `zombie`, and `unknown`. |
+
+
-
-
The **Logs** tab displays logs relating to the host that you have selected. By default, the logs tab displays the following columns.
| | |
@@ -70,13 +79,13 @@ The **Logs** tab displays logs relating to the host that you have selected. By d
To view the logs in the ((logs-app)) for a detailed analysis, click **Open in Logs**.
+
+
-
-
-The **Anomalies** table displays a list of each single metric ((anomaly-detect)) job for the specific host. By default, anomaly
+The **Anomalies** tab displays a list of each single metric ((anomaly-detect)) job for the specific host. By default, anomaly
jobs are sorted by time, showing the most recent jobs first.
Along with the name of each anomaly job, detected anomalies with a severity score equal to 50 or higher are listed. These
@@ -86,6 +95,8 @@ the actual value and the expected ("typical") value of the host metric in the an
To drill down and analyze the metric anomaly, select **Actions** → **Open in Anomaly Explorer**.
You can also select **Actions** → **Show in Inventory** to view the host Inventory page, filtered by the specific metric.
+
+
{/* TODO: Find out if OSQuery tab will be included in serverless. It does not currently appear in serverless builds */}