Docs fix — style: path /solutions/security/ai — 18 pages

Generated by `gh-aw-docs-style-sweep` for `elastic/docs-content` on 2026-W25.

Path /solutions/security/ai · 18 total in scope · subtree corpus 18 pages.

## Findings (38)

```yaml
- file: solutions/security/ai/ai-assistant-knowledge-base.md
line: 83
category: word-choice
severity: medium
evidence: "'just' — Elastic.DontUse"
suggested_fix: "Remove 'just': answer questions about multiple alerts rather than about individual alerts you choose to send it."
- file: solutions/security/ai/ai-assistant.md
line: 52
category: word-choice
severity: medium
evidence: "'disable' — Elastic.WordChoice: prefer 'turn off' unless in UI"
suggested_fix: "Enable or turn off AI Assistant and other AI-powered features in your environment."
- file: solutions/security/ai/ai-assistant.md
line: 59
category: word-choice
severity: medium
evidence: "'prior to' — Elastic.Wordiness: prefer 'before'"
suggested_fix: "before use"
- file: solutions/security/ai/ai-assistant.md
line: 436
category: word-choice
severity: medium
evidence: "'just' — Elastic.DontUse"
suggested_fix: '"Provide comments explaining the query you gave."'
- file: solutions/security/ai/attacks-page.md
line: 148
category: ui-writing
severity: medium
evidence: "'>' menu separator — Elastic.MenuArrowsBold: use '→'"
suggested_fix: "**Take actions** → **Assign attack** → select users"
- file: solutions/security/ai/attacks-page.md
line: 149
category: ui-writing
severity: medium
evidence: "'>' menu separator — Elastic.MenuArrowsBold: use '→'"
suggested_fix: "**Take actions** → **Unassign attack**"
- file: solutions/security/ai/identify-investigate-document-threats.md
line: 39
category: accessibility
severity: medium
evidence: "'In the example above' — Elastic.DirectionalLanguage: use 'in the preceding [element]'"
suggested_fix: "In the preceding example, Attack discovery found connections between thirteen alerts..."
- file: solutions/security/ai/identify-investigate-document-threats.md
line: 49
category: word-choice
severity: medium
evidence: "'dialogue' in :alt: — Elastic.BritishSpellings: use 'dialog'"
suggested_fix: ":alt: A dialog with AI Assistant that has the attack discovery as context"
- file: solutions/security/ai/identify-investigate-document-threats.md
line: 55
category: word-choice
severity: medium
evidence: "'dialogue' in :alt: — Elastic.BritishSpellings: use 'dialog'"
suggested_fix: ":alt: An AI Assistant dialog in which the user asks for a purpose-built {{esql}} query"
- file: solutions/security/ai/identify-investigate-document-threats.md
line: 73
category: word-choice
severity: medium
evidence: "'dialogue' in :alt: — Elastic.BritishSpellings: use 'dialog'"
suggested_fix: ":alt: An AI Assistant dialog in which the assistant translates from English to Japanese"
- file: solutions/security/ai/triage-alerts.md
line: 59
category: word-choice
severity: medium
evidence: "'dialogue' in :alt: — Elastic.BritishSpellings: use 'dialog'"
suggested_fix: ":alt: An AI Assistant dialog with the add to existing case button highlighted"
- file: solutions/security/ai/triage-attack-discovery-findings.md
line: 206
category: word-choice
severity: medium
evidence: "'vice versa' — Elastic.Latinisms: use 'and the reverse'"
suggested_fix: "...so host columns are null for user rows and the reverse."
- file: solutions/security/ai/agent-builder/agent-builder.md
line: 51
category: word-choice
severity: low
evidence: "'clone' — Elastic.Clone: use only for GitHub repos or linked copies; otherwise use 'copy'"
suggested_fix: "You can copy the agent to create a version with access to additional tools."
- file: solutions/security/ai/agent-builder/agent-builder.md
line: 91
category: word-choice
severity: low
evidence: "'Eliminate' — Elastic.Wordiness: prefer 'remove'"
- file: solutions/security/ai/ai-assistant-knowledge-base.md
line: 19
category: word-choice
severity: low
evidence: "'newer version' — Elastic.Versions: use 'later version'"
suggested_fix: "later version"
- file: solutions/security/ai/ai-assistant-knowledge-base.md
line: 64
category: word-choice
severity: low
evidence: "'may' — Elastic.WordChoice: prefer 'can' or 'might'"
- file: solutions/security/ai/ai-assistant-knowledge-base.md
line: 92
category: word-choice
severity: low
evidence: "'a large number of' — Elastic.Wordiness: prefer 'many'"
- file: solutions/security/ai/ai-assistant-knowledge-base.md
line: 102
category: voice-tone
severity: low
evidence: "'my' in example prompt — Elastic.FirstPerson: caution with first-person pronouns"
- file: solutions/security/ai/ai-assistant-knowledge-base.md
line: 146
category: word-choice
severity: low
evidence: "'inform' — Elastic.Wordiness: prefer 'tell'"
- file: solutions/security/ai/ai-assistant-knowledge-base.md
line: 207
category: word-choice
severity: low
evidence: "'inform' — Elastic.Wordiness: prefer 'tell'"
- file: solutions/security/ai/ai-assistant.md
line: 59
category: word-choice
severity: low
evidence: "'may' — Elastic.WordChoice: prefer 'can' or 'might'"
- file: solutions/security/ai/ai-assistant.md
line: 90
category: word-choice
severity: low
evidence: "'easily' — Elastic.WordChoice: prefer 'efficiently'"
- file: solutions/security/ai/ai-assistant.md
line: 152
category: word-choice
severity: low
evidence: "'easily' — Elastic.WordChoice: prefer 'efficiently'"
- file: solutions/security/ai/ai-assistant.md
line: 400
category: word-choice
severity: low
evidence: "'may' — Elastic.WordChoice: prefer 'can' or 'might'"
- file: solutions/security/ai/ai-assistant.md
line: 433
category: word-choice
severity: low
evidence: "'may' — Elastic.WordChoice: prefer 'can' or 'might'"
- file: solutions/security/ai/ai-assistant.md
line: 436
category: voice-tone
severity: low
evidence: "'me' in example prompt — Elastic.FirstPerson: caution with first-person pronouns"
- file: solutions/security/ai/attack-discovery.md
line: 165
category: word-choice
severity: low
evidence: "'may' — Elastic.WordChoice: prefer 'can' or 'might'"
- file: solutions/security/ai/attack-discovery.md
line: 167
category: word-choice
severity: low
evidence: "'Take action' — Elastic.Wordiness: prefer 'act'"
- file: solutions/security/ai/attacks-page.md
line: 20
category: grammar
severity: low
evidence: "';' — Elastic.Semicolons: use judiciously"
suggested_fix: "You can also schedule recurring Attack Discovery runs from either page. Schedules created on one page appear on the other."
- file: solutions/security/ai/ease/ease-alerts.md
line: 34
category: word-choice
severity: low
evidence: "'may' — Elastic.WordChoice: prefer 'can' or 'might'"
- file: solutions/security/ai/ease/ease-intro.md
line: 12
category: word-choice
severity: low
evidence: "'easy' — Elastic.WordChoice: prefer 'efficient'"
- file: solutions/security/ai/generate-customize-learn-about-esorql-queries.md
line: 24
category: word-choice
severity: low
evidence: "'make use of' — Elastic.Wordiness: prefer 'use'"
- file: solutions/security/ai/identify-investigate-document-threats.md
line: 28
category: word-choice
severity: low
evidence: "'may' — Elastic.WordChoice: prefer 'can' or 'might'"
- file: solutions/security/ai/triage-alerts.md
line: 115
category: grammar
severity: low
evidence: "';' — Elastic.Semicolons: use judiciously"
suggested_fix: "The interactive flow above is one way to triage. You can also encode the same job as a declarative automation that runs without an analyst in the loop:"
- file: solutions/security/ai/triage-attack-discovery-findings.md
line: 269
category: word-choice
severity: low
evidence: "'Take action' — Elastic.Wordiness: prefer 'act'"
- file: solutions/security/ai/usecase-knowledge-base-walkthrough.md
line: 37
category: word-choice
severity: low
evidence: "'easy' — Elastic.WordChoice: prefer 'efficient'"
- file: solutions/security/ai/usecase-knowledge-base-walkthrough.md
line: 59
category: word-choice
severity: low
evidence: "'inform' — Elastic.Wordiness: prefer 'tell'"
- file: solutions/security/ai/usecase-knowledge-base-walkthrough.md
line: 67
category: formatting
severity: low
evidence: "'Video demo: investigate...' — Elastic.HeadingColons: capitalize first word after colon in heading"
suggested_fix: "## Video demo: Investigate an Attack Discovery using AI Assistant's Knowledge Base"
```

## Done when
- All listed lines pass the Elastic style guide rules cited.
- A PR addressing this issue is merged.

## Notes
- `Elastic.MappedPages` frontmatter warnings excluded; require TW coordination, not style fixes.
- `Elastic.Semicolons` false positive at `ai-assistant.md:81` excluded (semicolons are keyboard shortcut notation: `Cmd + ;`).
- First-person findings at lines 102 and 436 appear inside example user prompts, not doc prose.

> Generated by [Docs style sweep agent](https://github.com/elastic/docs-content/actions/runs/27855798696) · 232 AIC · ⌖ 25.7 AIC · ⊞ 26.7K · [◷](https://github.com/search?q=repo%3Aelastic%2Fdocs-content+is%3Aissue+%22gh-aw-workflow-call-id%3A+elastic%2Fdocs-content%2Fgh-aw-docs-style-sweep%22&type=issues)

Start with the listed files under `solutions/security/ai/` and compare each finding with its cited Elastic style rule; the issue includes line numbers and suggested fixes for many findings. Done means all 38 listed findings are addressed, the listed lines pass the cited rules, and a pull request is merged.

Written by the indexing model from the issue text.