elastic · justinkambic · May 26, 2020 · May 11, 2020 · May 11, 2020 · May 11, 2020
diff --git a/docs/uptime/alerting.asciidoc b/docs/uptime/alerting.asciidoc
@@ -0,0 +1,26 @@
+[role="xpack"]
+[[uptime-alerting]]
+
+== Uptime alerting
+
+[float]
+=== Monitor status alerts
+
+[role="screenshot"]
+image::uptime/images/monitor-status-alert-flyout.png[Create monitor status alert flyout]
+
+To receive alerts when a monitor goes down, use the alerting menu at the top of the 
+overview page. Use a query in the alert flyout to determine which monitors to check
+with your alert. If you already have a query in the overview page search bar it will
+be carried over into this box.
+
+[float]
+=== TLS alerts
+
+[role="screenshot"]
+image::uptime/images/tls-alert-flyout.png[Create TLS alert flyout]
+
+Uptime also provides the ability to create an alert that will notify you when one or
+more of your monitors have a TLS certificate that will expire within some threshold,
+or when its age exceeds a limit. The values for these thresholds are configurable on
+the <<uptime-settings, Settings page>>.
diff --git a/docs/uptime/certificates.asciidoc b/docs/uptime/certificates.asciidoc
@@ -0,0 +1,15 @@
+[role="xpack"]
+[[uptime-certificates]]
+
+== Certificates
+
+[role="screenshot"]
+image::uptime/images/certificates-page.png[Certificates]
+
+Uptime has a certificates page, which will visualize all of the TLS certificates Heartbeat
+is monitoring in your indices. In addition to the common name, associated monitors, issuer
+information, and SHA fingerprints, Uptime will also assign a status based on the values stored
+in the <<uptime-settings, Settings page>>.
+
+Several of the columns on this page are sortable, and the search bar at the top of the view
+allows you to search on most of the TLS-related fields in your Uptime indices. Additionally, the `Alerts` dropdown at the top of the page will allow you to define a TLS alert.
diff --git a/docs/uptime/images/alert-flyout.png b/docs/uptime/images/alert-flyout.png
diff --git a/docs/uptime/images/certificates-page.png b/docs/uptime/images/certificates-page.png
diff --git a/docs/uptime/images/check-history.png b/docs/uptime/images/check-history.png
diff --git a/docs/uptime/images/crosshair-example.png b/docs/uptime/images/crosshair-example.png
diff --git a/docs/uptime/images/filter-bar.png b/docs/uptime/images/filter-bar.png
diff --git a/docs/uptime/images/monitor-list.png b/docs/uptime/images/monitor-list.png
diff --git a/docs/uptime/images/monitor-status-alert-flyout.png b/docs/uptime/images/monitor-status-alert-flyout.png
diff --git a/docs/uptime/images/observability_integrations.png b/docs/uptime/images/observability_integrations.png
diff --git a/docs/uptime/images/settings.png b/docs/uptime/images/settings.png
diff --git a/docs/uptime/images/snapshot-view.png b/docs/uptime/images/snapshot-view.png
diff --git a/docs/uptime/images/status-bar.png b/docs/uptime/images/status-bar.png
diff --git a/docs/uptime/images/tls-alert-flyout.png b/docs/uptime/images/tls-alert-flyout.png
diff --git a/docs/uptime/index.asciidoc b/docs/uptime/index.asciidoc
@@ -13,9 +13,13 @@ To get started with Elastic Uptime, refer to {uptime-guide}/install-uptime.html[
 * <<uptime-overview>>
 * <<uptime-monitor>>
 * <<uptime-settings>>
+* <<uptime-certificates>>
+* <<uptime-alerting>>
 
 --
 
 include::overview.asciidoc[]
 include::monitor.asciidoc[]
 include::settings.asciidoc[]
+include::certificates.asciidoc[]
+include::alerting.asciidoc[]
diff --git a/docs/uptime/overview.asciidoc b/docs/uptime/overview.asciidoc
@@ -49,17 +49,6 @@ way to navigate to a more in-depth visualization for interesting hosts or endpoi
 This table includes information like the most recent status, when the monitor was last checked, its
 ID and URL, its IP address, and a dedicated sparkline showing its check status over time.
 
-[float]
-=== Creating and managing alerts
-
-[role="screenshot"]
-image::uptime/images/alert-flyout.png[Create alert flyout]
-
-To receive alerts when a monitor goes down, use the alerting menu at the top of the 
-overview page. Use a query in the alert flyout to determine which monitors to check
-with your alert. If you already have a query in the overview page search bar it will
-be carried over into this box.
-
 [float]
 === Observability integrations
 

diff --git a/docs/uptime/settings.asciidoc b/docs/uptime/settings.asciidoc
@@ -4,7 +4,9 @@
 == Settings
 
 [role="screenshot"]
-image::uptime/images/settings.png[Filter bar]
+image::uptime/images/settings.png[Settings page]
+
+=== Indices
 
 The Uptime settings page lets you change which Heartbeat indices are displayed
 by the uptime app. Users must have the 'all' permission to modify items on this page.
@@ -25,3 +27,20 @@ to manually query Elasticsearch for data outside this pattern!
 See the <<uptime-security,Uptime Elasticsearch Security>>
 and {heartbeat-ref}/securing-heartbeat.html[Heartbeat security]
 docs for more information.
+
+=== Certificate thresholds
+
+The settings page also allows you to specify thresholds for all the TLS certificates monitored
+in your environment. There is a field for maximum age, and the minimum number of days before
+expiration before Uptime should consider a monitor to be in warning state.
+
+For example, you may want to make sure that none of your organization's TLS certificates have been
+valid for longer than one year. This is becoming a common security requirement. Modifying the `Age limit`
-For example, you may want to make sure that none of your organization's TLS certificates have been
-valid for longer than one year. This is becoming a common security requirement. Modifying the `Age limit`
+For example, a common security requirement is to make sure that none of your organization's TLS certificates have been valid for longer than one year. Modifying the `Age limit`
-For example, you may want to make sure that none of your organization's TLS certificates have been
-valid for longer than one year. This is becoming a common security requirement. Modifying the `Age limit`
+For example, a common security requirement is to make sure that none of your organization's TLS certificates have been valid for longer than one year. Modifying the `Age limit`
+field's value to 365 days will help you keep track of which certificates you may want to refresh.
+
+Likewise, if you want to see which of your TLS certificates are close to expiring ahead of time, specify
+an `Expiration threshold` on this page. When the count of a certificate's remaining valid days falls
+below this threshold, Uptime will consider it in a warning state.
+
+The thresholds specified on this page affect how your certificates are visualized on the Certificates page,
+and which certificates Uptime will warn about when running a TLS alert.