Move partial content to main page (they're now only used once)

Author: pedrosousa

src/content/docs/waf/analytics/security-events.mdx

@@ -5,7 +5,7 @@ sidebar:
   order: 2
 ---
 
-import { FeatureTable, GlossaryTooltip, Render } from "~/components";
+import { FeatureTable, GlossaryTooltip } from "~/components";
 
 Security Events allows you to review <GlossaryTooltip term="mitigated request">mitigated requests</GlossaryTooltip> and helps you tailor your security configurations.
 
@@ -36,11 +36,31 @@ You can apply multiple filters and exclusions to narrow the scope of Security Ev
 
 ![Example of adding a new filter in Security Events for the Block action](~/assets/images/waf/events-add-filter.png)
 
-<Render file="analytics-filter-report-duration" />
+### Add filters
+
+You can adjust the scope of analytics by manually entering filter conditions. Alternatively, select **Filter** or **Exclude** to filter by a field value. These buttons appear when you hover the analytics data legend.
+
+To manually add a filter:
+
+1. Select **Add filter**.
+2. Select a field, an operator, and a value. For example, to filter events by IP address, select _IP_ for **Action**, select _equals_ for the operator, and enter the IP address.
+3. Select **Apply**.
+
+Take the following into account when entering filter values:
+
+- Do not add quotes around values.
+- Do not enter the `AS` prefix when entering ASN numbers. For example, enter `1423` instead of `AS1423`.
+- Wildcards are not supported.
+
+### Adjust report duration
+
+To adjust report duration, select the desired duration from the dropdown in **Security Events**. The default value is `Previous 24 hours`.
+
+The available report duration values depend on your Cloudflare plan. Refer to [Availability](#availability) for details.
 
 ## Create custom rule from current filters
 
-<Render file="analytics-create-firewall-rule" />
+To create a [custom rule](/waf/custom-rules/create-dashboard/) based on your current filters and exclusions, select **Create custom rule** in **Security Events**.
 
 ## Events summary
 
@@ -68,13 +88,46 @@ A deleted custom/firewall rule or rate limiting rule will show as `Rule unavaila
 
 ## Sampled logs
 
-<Render file="analytics-activity-log" />
+**Sampled logs** summarizes security events by date to show the action taken and the applied Cloudflare security feature.
+
+![Example list of events in Sampled logs, with one of the events expanded to show its details](~/assets/images/waf/events-sampled-logs.png)
+
+Security events are shown by individual event rather than by request. For example, if a single request triggers three different security features, the security events will show three individual events in **Sampled logs**.
+
+Expand each event to check its details, and define filters and exclusions based on the event's field values. Select the **Filter** or **Exclude** button when hovering a field to add the field value to the filters or exclusions list of the displayed analytics. To download the event data in JSON format, select **Export event JSON**.
+
+### Displayed columns
 
-<Render file="analytics-export-data" />
+To configure the columns displayed in **Sampled logs**, select **Edit columns**. This gives you flexibility depending on the type of analysis that you need to perform.
+
+For example, if you are diagnosing a bot-related issue, you may want to display the **User agent** and the **Country** columns. On the other hand, if you are trying to identify a DDoS attack, you may want to display the **IP address**, **ASN**, and **Path** columns.
+
+### Event actions
+
+For details on most actions that appear in **Sampled logs**, refer to [Actions](/ruleset-engine/rules-language/actions/).
+
+Besides the actions you can select when configuring rules in Cloudflare security products, you may also find events with the following associated actions:
+
+- _Connection Close_
+- _Force Connection Close_
+
+For details on these actions, refer to [HTTP DDoS Attack Protection parameters](/ddos-protection/managed-rulesets/http/override-parameters/#action).
+
+The [_Managed Challenge (Recommended)_](/waf/reference/cloudflare-challenges/#managed-challenge-recommended) action that may appear in **Sampled logs** is available in the following security features and products: WAF custom rules, rate limiting rules, Bot Fight Mode, IP Access rules, User Agent Blocking rules, and firewall rules (deprecated).
+
+### Export event log data
+
+You can export a set of up to 500 raw events from **Sampled logs** in JSON format. Export event data to combine and analyze Cloudflare data with your own stored in a separate system or database, such as a <GlossaryTooltip term="SIEM">SIEM system</GlossaryTooltip>. The data you export will reflect any filters you have applied.
+
+To export the displayed events (up to 500), select **Export** in **Sampled logs**.
 
 ## Share Security Events filters
 
-<Render file="analytics-share-url" />
+When you add a filter and specify a report duration (time window) in Security Events, the Cloudflare dashboard URL changes to reflect the parameters you configured. You can share that URL with other users so that they can analyze the same information that you see.
+
+For example, after adding a filter for `Action equals Managed Challenge` and setting the report duration to 72 hours, the URL should look like the following:
+
+`https://dash.cloudflare.com/{account_id}/example.net/security/events?action=managed_challenge&time-window=4320`
 
 ## Print or download PDF report