elastic · justinkambic · May 26, 2020 · May 11, 2020 · May 11, 2020 · May 11, 2020
diff --git a/docs/uptime/alerting.asciidoc b/docs/uptime/alerting.asciidoc
@@ -0,0 +1,30 @@
+[role="xpack"]
+[[uptime-alerting]]
+
+== Uptime alerting
+
+The Uptime app integrates with Kibana's {kibana-ref}/alerting-getting-started.html[alerting and actions]
+feature. It provides a set of built-in actions and Uptime specific threshold alerts for you to use
+and enables central management of all alerts from <<management, Kibana Management>>.
+
+[float]
+=== Monitor status alerts
+
+To receive alerts when a monitor goes down, use the alerting menu at the top of the 
+overview page. Use a query in the alert flyout to determine which monitors to check
+with your alert. If you already have a query in the overview page search bar it will
+be carried over into this box.
+
+[role="screenshot"]
+image::uptime/images/monitor-status-alert-flyout.png[Create monitor status alert flyout]
+
+[float]
+=== TLS alerts
+
+Uptime also provides the ability to create an alert that will notify you when one or
+more of your monitors have a TLS certificate that will expire within some threshold,
+or when its age exceeds a limit. The values for these thresholds are configurable on
+the <<uptime-settings, Settings page>>.
+
+[role="screenshot"]
+image::uptime/images/tls-alert-flyout.png[Create TLS alert flyout]
diff --git a/docs/uptime/certificates.asciidoc b/docs/uptime/certificates.asciidoc
@@ -0,0 +1,15 @@
+[role="xpack"]
+[[uptime-certificates]]
+
+== Certificates
+
+[role="screenshot"]
+image::uptime/images/certificates-page.png[Certificates]
+
+The certificates page allows you to visualize TLS certificate data in your indices. In addition to the
+common name, associated monitors, issuer information, and SHA fingerprints, Uptime also assigns a status
+derived from the threshold values in the <<uptime-settings, Settings page>>.
+
+Several of the columns on this page are sortable. You can use the search bar at the top of the view
+to find values in most of the TLS-related fields in your Uptime indices. Additionally, you can
+create a TLS alert using the `Alerts` dropdown at the top of the page.
diff --git a/docs/uptime/images/alert-flyout.png b/docs/uptime/images/alert-flyout.png
diff --git a/docs/uptime/images/certificates-page.png b/docs/uptime/images/certificates-page.png
diff --git a/docs/uptime/images/check-history.png b/docs/uptime/images/check-history.png
diff --git a/docs/uptime/images/crosshair-example.png b/docs/uptime/images/crosshair-example.png
diff --git a/docs/uptime/images/filter-bar.png b/docs/uptime/images/filter-bar.png
diff --git a/docs/uptime/images/monitor-list.png b/docs/uptime/images/monitor-list.png
diff --git a/docs/uptime/images/monitor-status-alert-flyout.png b/docs/uptime/images/monitor-status-alert-flyout.png
diff --git a/docs/uptime/images/observability_integrations.png b/docs/uptime/images/observability_integrations.png
diff --git a/docs/uptime/images/settings.png b/docs/uptime/images/settings.png
diff --git a/docs/uptime/images/snapshot-view.png b/docs/uptime/images/snapshot-view.png
diff --git a/docs/uptime/images/status-bar.png b/docs/uptime/images/status-bar.png
diff --git a/docs/uptime/images/tls-alert-flyout.png b/docs/uptime/images/tls-alert-flyout.png
diff --git a/docs/uptime/index.asciidoc b/docs/uptime/index.asciidoc
@@ -13,9 +13,13 @@ To get started with Elastic Uptime, refer to {uptime-guide}/install-uptime.html[
 * <<uptime-overview>>
 * <<uptime-monitor>>
 * <<uptime-settings>>
+* <<uptime-certificates>>
+* <<uptime-alerting>>
 
 --
 
 include::overview.asciidoc[]
 include::monitor.asciidoc[]
 include::settings.asciidoc[]
+include::certificates.asciidoc[]
+include::alerting.asciidoc[]
diff --git a/docs/uptime/overview.asciidoc b/docs/uptime/overview.asciidoc
@@ -49,17 +49,6 @@ way to navigate to a more in-depth visualization for interesting hosts or endpoi
 This table includes information like the most recent status, when the monitor was last checked, its
 ID and URL, its IP address, and a dedicated sparkline showing its check status over time.
 
-[float]
-=== Creating and managing alerts
-
-[role="screenshot"]
-image::uptime/images/alert-flyout.png[Create alert flyout]
-
-To receive alerts when a monitor goes down, use the alerting menu at the top of the 
-overview page. Use a query in the alert flyout to determine which monitors to check
-with your alert. If you already have a query in the overview page search bar it will
-be carried over into this box.
-
 [float]
 === Observability integrations
 

diff --git a/docs/uptime/settings.asciidoc b/docs/uptime/settings.asciidoc
@@ -4,7 +4,9 @@
 == Settings
 
 [role="screenshot"]
-image::uptime/images/settings.png[Filter bar]
+image::uptime/images/settings.png[Settings page]
+
+=== Indices
 
 The Uptime settings page lets you change which Heartbeat indices are displayed
 by the uptime app. Users must have the 'all' permission to modify items on this page.
@@ -25,3 +27,22 @@ to manually query Elasticsearch for data outside this pattern!
 See the <<uptime-security,Uptime Elasticsearch Security>>
 and {heartbeat-ref}/securing-heartbeat.html[Heartbeat security]
 docs for more information.
+
+=== Certificate thresholds
+
+You can modify settings in this section to control how Uptime will visualize your TLS values in the Certificates page.
+These settings also determine which certificates will be selected by any TLS alert you define.
+
+There are two fields, `age` and `expiration`. Use the `age` threshold to specify when Uptime should warn
+you about certificates that have been valid for too long. Use the `expiration` threshold to make Uptime warn you
+about certificates that have approaching expiration dates.
+
+For example, a common security requirement is to make sure that none of your organization's TLS certificates have been
+valid for longer than one year. Modifying the `Age limit` field's value to 365 days will help you keep track of which
+certificates you may want to refresh.
+
+Likewise, to see which of your TLS certificates are close to expiring ahead of time, specify
+an `Expiration threshold` on this page. When the count of a certificate's remaining valid days falls
+below this threshold, Uptime will consider it in a warning state. If you have defined a TLS alert, you will
+receive a notification from Uptime about the certificate.
+