diff --git a/x-pack/plugins/security_solution/public/resolver/view/resolver_no_process_events.tsx b/x-pack/plugins/security_solution/public/resolver/view/resolver_no_process_events.tsx
index 5a743896518c2..c172d351c7356 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/resolver_no_process_events.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/resolver_no_process_events.tsx
@@ -41,6 +41,14 @@ export const ResolverNoProcessEvents = () => (
       })}
     </EuiText>
     <EuiSpacer size="m" />
+    <EuiText size="s">
+      {i18n.translate('xpack.securitySolution.resolver.noProcessEvents.dataView', {
+        defaultMessage: `In case you selected a different data view,
+          make sure your data view contains all of the indices that are stored in the source event at "{field}".`,
+        values: { field: 'kibana.alert.rule.parameters.index' },
+      })}
+    </EuiText>
+    <EuiSpacer size="m" />
     <EuiText size="s">
       {i18n.translate('xpack.securitySolution.resolver.noProcessEvents.eventCategory', {
         defaultMessage: `You may also add the below to your timeline query to check for process events.