Merge remote-tracking branch 'upstream/master' into reporting/securit…

…y-escape-formulas

docs/user/reporting/chromium-sandbox.asciidoc

@@ -11,12 +11,12 @@ sandboxing techniques differ for each operating system.
 The Linux sandbox depends on user namespaces, which were introduced with the 3.8 Linux kernel. However, many
 distributions don't have user namespaces enabled by default, or they require the CAP_SYS_ADMIN capability. {reporting}
 will automatically disable the sandbox when it is running on Debian and CentOS as additional steps are required to enable
-unprivileged usernamespaces. In these situations, you'll see the following message in your {kib} logs:
-`Enabling the Chromium sandbox provides an additional layer of protection`.
+unprivileged usernamespaces. In these situations, you'll see the following message in your {kib} startup logs:
+`Chromium sandbox provides an additional layer of protection, but is not supported for your OS.
+Automatically setting 'xpack.reporting.capture.browser.chromium.disableSandbox: true'.`
 
-If your kernel is 3.8 or newer, it's
-recommended to enable usernamespaces and set `xpack.reporting.capture.browser.chromium.disableSandbox: false` in your
-`kibana.yml` to enable the sandbox.
+Reporting will automatically enable the Chromium sandbox at startup when a supported OS is detected. However, if your kernel is 3.8 or newer, it's
+recommended to set `xpack.reporting.capture.browser.chromium.disableSandbox: false` in your `kibana.yml` to explicitly enable usernamespaces.
 
 ==== Docker
 When running {kib} in a Docker container, all container processes are run within a usernamespace with seccomp-bpf and