toc.yml

project: "Solutions and use cases"
toc:
  - file: index.md
  - file: search.md
    children:
      - file: search/get-started.md
        children:
          - file: search/search-connection-details.md
          - file: search/get-started/quickstarts.md
            children:
              - file: search/get-started/index-basics.md
              - file: search/get-started/keyword-search-python.md
              - file: search/get-started/semantic-search.md
      - file: search/ingest-for-search.md
        children:
          - file: search/search-pipelines.md
      - file: search/search-approaches.md
        children:
          - file: search/full-text.md
            children:
              - file: search/full-text/how-full-text-works.md
              - file: search/full-text/search-with-synonyms.md
                children:
                  - file: search/full-text/create-update-synonyms-api-example.md
              - file: search/full-text/text-analysis-during-search.md
              - file: search/full-text/search-relevance.md
                children:
                  - file: search/full-text/search-relevance/mixing-exact-search-with-stemming.md
                  - file: search/full-text/search-relevance/consistent-scoring.md
                  - file: search/full-text/search-relevance/static-scoring-signals.md
          - file: search/ai-search/ai-search.md
            children:
              - file: search/vector.md
                children:
                  - file: search/vector/dense-vector.md
                    children:
                      - file: search/vector/knn.md
                      - file: search/vector/bring-own-vectors.md
                  - file: search/vector/sparse-vector.md
                  - file: search/vector/dense-versus-sparse-ingest-pipelines.md
              - file: search/semantic-search.md
                children:
                  - file: search/semantic-search/semantic-search-semantic-text.md
                  - file: search/semantic-search/semantic-search-inference.md
                  - file: search/semantic-search/semantic-search-elser-ingest-pipelines.md
                  - file: search/semantic-search/cohere-es.md
              - file: search/using-openai-compatible-models.md
          - file: search/hybrid-search.md
            children:
              - file: search/hybrid-semantic-text.md
          - file: search/ranking.md
            children:
              - file: search/ranking/semantic-reranking.md
              - file: search/ranking/learning-to-rank-ltr.md
                children:
                  - file: search/ranking/learning-to-rank-model-training.md
                  - file: search/ranking/learning-to-rank-search-usage.md
      - file: search/querying-for-search.md
        children:
          - file: search/the-search-api.md
          - file: search/async-search-api.md
          - file: search/esql-for-search.md
          - file: search/retrievers-overview.md
          - file: search/search-templates.md
      - file: search/elastic-agent-builder.md
        children:
          - file: search/agent-builder/get-started.md
          - file: search/agent-builder/models.md
          - file: search/agent-builder/chat.md
          - file: search/agent-builder/agent-builder-agents.md
          - file: search/agent-builder/tools.md
            children:
              - file: search/agent-builder/tools/esql-tools.md
              - file: search/agent-builder/tools/index-search-tools.md
          - file: search/agent-builder/programmatic-access.md
            children:
              - file: search/agent-builder/kibana-api.md
              - file: search/agent-builder/a2a-server.md
              - file: search/agent-builder/mcp-server.md
          - file: search/agent-builder/monitor-usage.md
          - file: search/agent-builder/permissions.md
          - file: search/agent-builder/limitations-known-issues.md
      - file: search/rag.md
        children:
          - file: search/rag/playground.md
            children:
              - file: search/rag/playground-context.md
              - file: search/rag/playground-query.md
              - file: search/rag/playground-troubleshooting.md
          - file: search/mcp.md
      - file: search/site-or-app.md
        children:
          - file: search/site-or-app/clients.md
          - file: search/site-or-app/search-ui.md
          - file: search/search-applications.md
            children:
              - file: search/search-applications/search-application-api.md
              - file: search/search-applications/search-application-security.md
              - file: search/search-applications/search-application-client.md

      - file: search/apis-and-tools.md
      - file: search/ai-assistant.md
      - file: search/query-rules-ui.md
  - file: observability.md
    children:
      - file: observability/get-started.md
        children:
          - file: observability/get-started/quickstarts.md
            children:
              - file: observability/get-started/quickstart-monitor-hosts-with-opentelemetry.md
              - file: observability/get-started/quickstart-monitor-your-application-performance.md
              - file: observability/get-started/quickstart-unified-kubernetes-observability-with-elastic-distributions-of-opentelemetry-edot.md
              - file: observability/get-started/quickstart-elastic-cloud-otel-endpoint.md
              - file: observability/get-started/quickstart-create-synthetic-monitor.md
              - file: observability/get-started/quickstart-monitor-hosts-with-elastic-agent.md
              - file: observability/get-started/quickstart-monitor-kubernetes-cluster-with-elastic-agent.md
              - file: observability/get-started/quickstart-collect-data-with-aws-firehose.md
          - file: observability/get-started/opentelemetry/quickstart/index.md
            children:
              - file: observability/get-started/opentelemetry/custom-metrics-quickstart.md
              - file: observability/get-started/opentelemetry/quickstart/self-managed/index.md
                children:
                  - file: observability/get-started/opentelemetry/quickstart/self-managed/k8s.md
                  - file: observability/get-started/opentelemetry/quickstart/self-managed/hosts_vms.md
                  - file: observability/get-started/opentelemetry/quickstart/self-managed/docker.md
              - file: observability/get-started/opentelemetry/quickstart/serverless/index.md
                children:
                  - file: observability/get-started/opentelemetry/quickstart/serverless/k8s.md
                  - file: observability/get-started/opentelemetry/quickstart/serverless/hosts_vms.md
                  - file: observability/get-started/opentelemetry/quickstart/serverless/docker.md
              - file: observability/get-started/opentelemetry/quickstart/ech/index.md
                children:
                  - file: observability/get-started/opentelemetry/quickstart/ech/k8s.md
                  - file: observability/get-started/opentelemetry/quickstart/ech/hosts_vms.md
                  - file: observability/get-started/opentelemetry/quickstart/ech/docker.md
          - file: observability/get-started/opentelemetry/use-cases/index.md
            children:
              - file: observability/get-started/opentelemetry/use-cases/kubernetes/index.md
                children:
                  - file: observability/get-started/opentelemetry/use-cases/kubernetes/prerequisites-compatibility.md
                  - file: observability/get-started/opentelemetry/use-cases/kubernetes/components.md
                  - file: observability/get-started/opentelemetry/use-cases/kubernetes/deployment.md
                  - file: observability/get-started/opentelemetry/use-cases/kubernetes/instrumenting-applications.md
                  - file: observability/get-started/opentelemetry/use-cases/kubernetes/upgrade.md
                  - file: observability/get-started/opentelemetry/use-cases/kubernetes/customization.md
              - folder: observability/get-started/opentelemetry/use-cases/llms
          - file: observability/get-started/other-tutorials/index.md
            children:
              - file: observability/get-started/other-tutorials/tutorial-monitor-java-application.md
          - file: observability/get-started/logs-essentials.md
      - file: observability/applications/index.md
        children:
          - file: observability/apm/index.md
            children:
              - file: observability/apm/get-started.md
              - file: observability/apm/data-types.md
                children:
                  - file: observability/apm/spans.md
                  - file: observability/apm/transactions.md
                    children:
                      - file: observability/apm/transaction-sampling.md
                  - file: observability/apm/traces.md
                  - file: observability/apm/errors.md
                  - file: observability/apm/metrics.md
                  - file: observability/apm/metadata.md
              - file: observability/apm/ingest/index.md
                children:
                  - folder: observability/apm/opentelemetry
                    file: index.md
                    children:
                      - file: upstream-opentelemetry-collectors-language-sdks.md
                      - file: collect-metrics.md
                      - file: edot-sdks-central-configuration.md
                      - file: limitations.md
                      - file: attributes.md
                      - file: data-stream-routing.md
                  - folder: observability/apm/apm-agents
                    file: index.md
                    children:
                      - file: central-configuration.md
                      - file: real-user-monitoring-rum.md
                      - file: create-upload-source-maps-rum.md
                  - file: observability/apm/ingest/apm-k8s-attacher.md
                  - file: observability/apm/ingest/monitor-aws-lambda-functions.md
                  - file: observability/apm/ingest/jaeger.md
              - file: observability/apm/view-analyze-data.md
                children:
                  - file: observability/apm/overviews.md
                    children:
                      - file: observability/apm/services.md
                      - file: observability/apm/traces-ui.md
                      - file: observability/apm/dependencies.md
                      - file: observability/apm/service-map.md
                      - file: observability/apm/service-overview.md
                      - file: observability/apm/mobile-service-overview.md
                  - file: observability/apm/drill-down-into-data.md
                    children:
                      - file: observability/apm/transactions-ui.md
                      - file: observability/apm/trace-sample-timeline.md
                      - file: observability/apm/errors-ui.md
                      - file: observability/apm/metrics-ui.md
                      - file: observability/apm/infrastructure.md
                      - file: observability/apm/logs.md
                  - file: observability/apm/filter-search-data.md
                    children:
                      - file: observability/apm/filter-data.md
                      - file: observability/apm/advanced-queries.md
                      - file: observability/apm/cross-cluster-search.md
                  - file: observability/apm/interpret-data.md
                    children:
                      - file: observability/apm/find-transaction-latency-failure-correlations.md
                      - file: observability/apm/track-deployments-with-annotations.md
                      - file: observability/apm/explore-mobile-sessions.md
                      - file: observability/apm/observe-lambda-functions.md
                  - file: observability/apm/machine-learning.md
                  - file: observability/apm/apm-agent-explorer.md
                  - file: observability/apm/applications-ui-settings.md
              - file: observability/apm/act-on-data.md
                children:
                  - file: observability/apm/create-apm-rules-alerts.md
                  - file: observability/apm/create-custom-links.md
              - file: observability/apm/use-apm-securely.md
                children:
                  - file: observability/apm/secure-data.md
                    children:
                      - file: observability/apm/control-access-to-apm-data.md
                      - file: observability/apm/built-in-data-filters.md
                      - file: observability/apm/custom-filters.md
                      - file: observability/apm/delete-sensitive-data.md
                  - file: observability/apm/secure-communication-with-apm-agents.md
                    children:
                      - file: observability/apm/apm-agent-tls-communication.md
                      - file: observability/apm/api-keys.md
                      - file: observability/apm/secret-token.md
                      - file: observability/apm/anonymous-authentication.md
                  - file: observability/apm/secure-communication-with-elastic-stack.md
                    children:
                      - file: observability/apm/create-assign-feature-roles-to-apm-server-users.md
                      - file: observability/apm/grant-access-using-api-keys.md
                  - file: observability/apm/secure-access-to-applications-ui.md
                    children:
                      - file: observability/apm/ui-user-reader.md
                      - file: observability/apm/ui-user-annotation.md
                      - file: observability/apm/ui-user-api.md
                      - file: observability/apm/ui-user-central-config.md
                      - file: observability/apm/ui-user-storage-explorer.md
              - file: observability/apm/manage-storage.md
                children:
                  - file: observability/apm/storage-explorer.md
                  - file: observability/apm/data-streams.md
                  - file: observability/apm/index-lifecycle-management.md
                  - file: observability/apm/view-elasticsearch-index-template.md
                  - file: observability/apm/parse-data-using-ingest-pipelines.md
                  - file: observability/apm/storage-sizing-guide.md
                  - file: observability/apm/reduce-storage.md
                  - file: observability/apm/explore-data-in-elasticsearch.md
              - folder: observability/apm/apm-server
                file: index.md
                children:
                  - file: setup.md
                    children:
                      - file: fleet-managed.md
                      - file: binary.md
                  - file: configure.md
                    children:
                      - file: general-configuration-options.md
                      - file: configure-anonymous-authentication.md
                      - file: apm-agent-authorization.md
                      - file: apm-agent-central-configuration.md
                      - file: configure-apm-instrumentation.md
                      - file: configure-kibana-endpoint.md
                      - file: configure-logging.md
                      - file: configure-output.md
                        children:
                          - file: configure-output-for-elasticsearch-service-on-elastic-cloud.md
                          - file: configure-elasticsearch-output.md
                          - file: configure-logstash-output.md
                          - file: configure-kafka-output.md
                          - file: configure-redis-output.md
                          - file: configure-console-output.md
                      - file: configure-project-paths.md
                      - file: configure-real-user-monitoring-rum.md
                      - file: ssl-tls-settings.md
                        children:
                          - file: ssl-tls-output-settings.md
                          - file: ssl-tls-input-settings.md
                      - file: tail-based-sampling.md
                      - file: use-environment-variables-in-configuration.md
                      - file: advanced-setup.md
                        children:
                          - file: installation-layout.md
                          - file: secrets-keystore-for-secure-settings.md
                          - file: command-reference.md
                          - file: tune-data-ingestion.md
                          - file: high-availability.md
                          - file: systemd.md
                  - file: monitor.md
                    children:
                      - file: monitor-fleet-managed.md
                      - file: monitor-binary.md
                        children:
                          - file: use-internal-collection-to-send-monitoring-data.md
                          - file: use-metricbeat-to-send-monitoring-data.md
                          - file: use-select-metrics-emitted-directly-to-monitoring-cluster.md
              - file: observability/apm/apis.md
                children:
                  - file: observability/apm/apm-ui-api.md
                  - file: observability/apm/apm-server/api.md
                    children:
                      - file: observability/apm/apm-server/information-api.md
                      - file: observability/apm/elastic-apm-events-intake-api.md
                      - file: observability/apm/elastic-apm-agent-configuration-api.md
                      - file: observability/apm/opentelemetry-intake-api.md
                      - file: observability/apm/jaeger-event-intake.md
                  - file: observability/apm/managed-intake-service-event-api.md
              - file: observability/apm/upgrade.md
                children:
                  - file: observability/apm/apm-agent-compatibility.md
                  - file: observability/apm/upgrade-to-version-9.md
                    children:
                      - file: observability/apm/upgrade-self-installation-of-apm-server-standalone-to-9.md
                      - file: observability/apm/upgrade-self-installation-of-apm-integration-to-9.md
                      - file: observability/apm/upgrade-elastic-cloud-apm-server-standalone-to-9.md
                      - file: observability/apm/upgrade-elastic-cloud-with-apm-integration-to-9.md
                  - file: observability/apm/switch-to-elastic-apm-integration.md
                    children:
                      - file: observability/apm/switch-self-installation-to-apm-integration.md
                      - file: observability/apm/switch-an-elastic-cloud-cluster-to-apm-integration.md
          - file: observability/synthetics/index.md
            children:
              - file: observability/synthetics/get-started.md
                children:
                  - file: observability/synthetics/create-monitors-with-projects.md
                  - file: observability/synthetics/create-monitors-ui.md
              - file: observability/synthetics/scripting-browser-monitors.md
                children:
                  - file: observability/synthetics/write-synthetic-test.md
                  - file: observability/synthetics/configure-individual-browser-monitors.md
                  - file: observability/synthetics/use-synthetics-recorder.md
              - file: observability/synthetics/configure-lightweight-monitors.md
              - file: observability/synthetics/manage-monitors.md
              - file: observability/synthetics/work-with-params-secrets.md
              - file: observability/synthetics/analyze-data.md
              - file: observability/synthetics/monitor-resources-on-private-networks.md
              - file: observability/synthetics/cli.md
              - file: observability/synthetics/configure-projects.md
              - file: observability/synthetics/mfa-for-browser-monitors.md
              - file: observability/synthetics/configure-settings.md
              - file: observability/synthetics/grant-access-to-secured-resources.md
                children:
                  - file: observability/synthetics/setup-role.md
                  - file: observability/synthetics/writer-role.md
                  - file: observability/synthetics/reader-role.md
              - file: observability/synthetics/manage-data-retention.md
              - file: observability/synthetics/network-security.md
              - file: observability/synthetics/migrate-from-elastic-synthetics-integration.md
              - file: observability/synthetics/scale-architect-synthetics-deployment.md
              - file: observability/synthetics/support-matrix.md
              - file: observability/synthetics/encryption-security.md
          - file: observability/applications/user-experience.md
            children:
              - file: observability/applications/otel-rum.md
          - file: observability/applications/llm-observability.md
          - file: observability/uptime/index.md
            children:
              - file: observability/uptime/get-started.md
              - file: observability/uptime/analyze.md
                children:
                  - file: observability/uptime/view-monitor-status.md
                  - file: observability/uptime/analyze-monitors.md
                  - file: observability/uptime/inspect-duration-anomalies.md
              - file: observability/uptime/configure-settings.md
          - file: observability/otlp-visualize.md
      - file: observability/cicd.md
      - file: observability/cloud.md
        children:
          - file: observability/cloud/amazon-web-services-aws-monitoring.md
            children:
              - file: observability/cloud/ingestion-options.md
              - file: observability/cloud/monitor-amazon-web-services-aws-with-elastic-agent.md
                children:
                  - file: observability/cloud/monitor-amazon-cloud-compute-ec2.md
                  - file: observability/cloud/monitor-amazon-kinesis-data-streams.md
                  - file: observability/cloud/monitor-amazon-simple-storage-service-s3.md
                  - file: observability/cloud/monitor-amazon-simple-queue-service-sqs.md
              - file: observability/cloud/monitor-amazon-web-services-aws-with-beats.md
              - file: observability/cloud/monitor-amazon-web-services-aws-with-amazon-data-firehose.md
                children:
                  - file: observability/cloud/monitor-virtual-private-cloud-vpc-flow-logs.md
                  - file: observability/cloud/monitor-cloudtrail-logs.md
                  - file: observability/cloud/monitor-aws-network-firewall-logs.md
                  - file: observability/cloud/monitor-web-application-firewall-waf-logs.md
                  - file: observability/cloud/monitor-cloudwatch-logs.md
              - file: observability/cloud/monitor-amazon-web-services-aws-with-elastic-serverless-forwarder.md
          - file: observability/cloud/azure-monitoring.md
            children:
              - file: observability/cloud/monitor-microsoft-azure-with-elastic-agent.md
              - file: observability/cloud/monitor-microsoft-azure-with-beats.md
              - file: observability/cloud/monitor-microsoft-azure-with-azure-native-isv-service.md
              - file: observability/cloud/monitor-microsoft-azure-openai.md
          - file: observability/cloud/monitor-google-cloud-platform-gcp.md
            children:
              - file: observability/cloud/gcp-dataflow-templates.md
      - file: observability/infra-and-hosts.md
        children:
          - file: observability/infra-and-hosts/analyze-infrastructure-host-metrics.md
            children:
              - file: observability/infra-and-hosts/get-started-with-system-metrics.md
              - file: observability/infra-and-hosts/view-infrastructure-metrics-by-resource-type.md
              - file: observability/infra-and-hosts/discover-metrics.md
              - file: observability/infra-and-hosts/explore-infrastructure-metrics-over-time.md
              - file: observability/infra-and-hosts/analyze-compare-hosts.md
              - file: observability/infra-and-hosts/detect-metric-anomalies.md
              - file: observability/infra-and-hosts/configure-settings.md
          - file: observability/infra-and-hosts/universal-profiling.md
            children:
              - file: observability/infra-and-hosts/get-started-with-universal-profiling.md
              - file: observability/infra-and-hosts/manage-data-storage.md
                children:
                  - file: observability/infra-and-hosts/universal-profiling-index-life-cycle-management.md
                  - file: observability/infra-and-hosts/configure-probabilistic-profiling.md
              - file: observability/infra-and-hosts/advanced-configuration.md
                children:
                  - file: observability/infra-and-hosts/tag-data-for-querying.md
                  - file: observability/infra-and-hosts/add-symbols-for-native-frames.md
                  - file: observability/infra-and-hosts/use-proxy-with-universal-profiling-agent.md
                  - file: observability/infra-and-hosts/override-kernel-version-check.md
                  - file: observability/infra-and-hosts/environment-variables-to-configure-universal-profiling-agent.md
                  - file: observability/infra-and-hosts/configuration-file-of-universal-profiling-agent.md
              - file: observability/infra-and-hosts/upgrade-universal-profiling.md
              - file: observability/infra-and-hosts/run-universal-profiling-on-self-hosted-elastic-stack.md
              - file: observability/infra-and-hosts/install-backend.md
                children:
                  - file: observability/infra-and-hosts/step-1-update-stack.md
                  - file: observability/infra-and-hosts/step-2-enable-universal-profiling-in-kibana.md
                  - file: observability/infra-and-hosts/step-3-set-up-universal-profiling-in-kibana.md
                  - file: observability/infra-and-hosts/step-4-run-backend-applications.md
                  - file: observability/infra-and-hosts/step-5-next-steps.md
              - file: observability/infra-and-hosts/operate-universal-profiling-backend.md
          - file: observability/infra-and-hosts/tutorial-observe-kubernetes-deployments.md
          - file: observability/infra-and-hosts/tutorial-observe-nginx-instances.md
            children:
              - file: observability/infra-and-hosts/understanding-no-results-found-message.md
      - file: observability/logs.md
        children:
          - file: observability/logs/get-started-with-system-logs.md
          - file: observability/logs/stream-any-log-file.md
          - file: observability/logs/stream-any-log-file-using-edot-collector.md
          - file: observability/logs/stream-application-logs.md
            children:
              - file: observability/logs/plaintext-application-logs.md
              - file: observability/logs/ecs-formatted-application-logs.md
              - file: observability/logs/apm-agent-log-sending.md
          - file: observability/logs/parse-route-logs.md
          - file: observability/logs/filter-aggregate-logs.md
          - file: observability/logs/explore-logs.md
            children:
              - file: observability/logs/discover-logs.md
              - file: observability/logs/categorize-log-entries.md
              - file: observability/logs/inspect-log-anomalies.md
          - file: observability/logs/run-pattern-analysis-on-log-data.md
          - file: observability/logs/log-data-sources.md
          - file: observability/logs/add-service-name-to-logs.md
          - file: observability/logs/logs-index-template-reference.md
            children:
              - file: observability/logs/logs-index-template-defaults.md
      - file: observability/streams/streams.md
        children:
        - file: observability/streams/management/retention.md
        - file: observability/streams/management/extract.md
          children:
            - file: observability/streams/management/extract/date.md
            - file: observability/streams/management/extract/dissect.md
            - file: observability/streams/management/extract/grok.md
            - file: observability/streams/management/extract/set.md
            - file: observability/streams/management/extract/rename.md
            - file: observability/streams/management/extract/append.md
            - file: observability/streams/management/extract/manual-pipeline-configuration.md
        - file: observability/streams/management/partitioning.md
        - file: observability/streams/management/schema.md
        - file: observability/streams/management/data-quality.md
        - file: observability/streams/management/significant-events.md
        - file: observability/streams/management/advanced.md
        - file: observability/streams/wired-streams.md
      - file: observability/incident-management.md
        children:
          - file: observability/incident-management/alerting.md
            children:
              - file: observability/incident-management/create-manage-rules.md
                children:
                  - file: observability/incident-management/create-an-anomaly-detection-rule.md
                  - file: observability/incident-management/create-an-apm-anomaly-rule.md
                  - file: observability/incident-management/create-custom-threshold-rule.md
                  - file: observability/incident-management/create-a-degraded-docs-rule.md
                  - file: observability/incident-management/create-an-elasticsearch-query-rule.md
                  - file: observability/incident-management/create-an-error-count-threshold-rule.md
                  - file: observability/incident-management/create-failed-transaction-rate-threshold-rule.md
                  - file: observability/incident-management/create-a-failed-docs-rule.md
                  - file: observability/incident-management/create-an-inventory-rule.md
                  - file: observability/incident-management/create-latency-threshold-rule.md
                  - file: observability/incident-management/create-log-threshold-rule.md
                  - file: observability/incident-management/create-metric-threshold-rule.md
                  - file: observability/incident-management/create-monitor-status-rule.md
                  - file: observability/incident-management/create-tls-certificate-rule.md
                  - file: observability/incident-management/create-an-uptime-duration-anomaly-rule.md
                  - file: observability/incident-management/create-an-slo-burn-rate-rule.md
              - file: observability/incident-management/aggregation-options.md
                children:
                  - file: observability/incident-management/rate-aggregation.md
              - file: observability/incident-management/view-alerts.md
                children:
                  - file: observability/incident-management/triage-slo-burn-rate-breaches.md
                  - file: observability/incident-management/triage-threshold-breaches.md
          - file: observability/incident-management/cases.md
            children:
              - file: observability/incident-management/configure-access-to-cases.md
              - file: observability/incident-management/create-manage-cases.md
              - file: observability/incident-management/configure-case-settings.md
          - file: observability/incident-management/service-level-objectives-slos.md
            children:
              - file: observability/incident-management/configure-service-level-objective-slo-access.md
              - file: observability/incident-management/create-an-slo.md
              - file: observability/incident-management/slo-management.md
      - file: observability/data-set-quality-monitoring.md
      - file: observability/observability-ai-assistant.md
        children:
          - file: observability/llm-performance-matrix.md
      - file: observability/observability-serverless-feature-tiers.md
  - file: security.md
    children:
      - file: security/get-started.md
        children:
          - file: security/get-started/quickstarts.md
            children:
              - file: security/get-started/get-started-detect-with-siem.md
              - file: security/get-started/get-started-endpoint-security.md
              - file: security/get-started/get-started-cloud-security.md
          - file: security/get-started/elastic-security-requirements.md
          - file: security/get-started/elastic-security-ui.md
          - file: security/get-started/ingest-data-to-elastic-security.md
            children:
              - file: security/get-started/enable-threat-intelligence-integrations.md
              - file: security/get-started/automatic-migration.md
              - file: security/get-started/automatic-import.md
              - file: security/get-started/content-connectors.md
              - file: security/get-started/agentless-integrations.md
                children:
                  - file: security/get-started/cloud-connector-deployment.md
                  - file: security/get-started/agentless-integrations-faq.md
          - file: security/get-started/spaces-elastic-security.md
            children:
              - file: security/get-started/spaces-defend-faq.md
          - file: security/get-started/data-views-elastic-security.md
          - file: security/get-started/create-runtime-fields-in-elastic-security.md
          - file: security/get-started/configure-advanced-settings.md
      - file: security/esql-for-security.md
        children:
          - file: security/esql-for-security/esql-threat-hunting-tutorial.md
      - file: security/ai.md
        children:
          - file: security/ai/ease/ease-intro.md
            children:
              - file: security/ai/ease/ease-alerts.md
              - file: security/ai/ease/ease-upgrade.md
          - file: security/ai/ai-assistant.md
            children:
              - file: security/ai/ai-assistant-knowledge-base.md
              - file: security/ai/usecase-knowledge-base-walkthrough.md
          - file: security/ai/attack-discovery.md
          - file: security/ai/large-language-model-performance-matrix.md
          - file: security/ai/use-cases.md
            children:
              - file: security/ai/triage-alerts.md
              - file: security/ai/identify-investigate-document-threats.md
              - file: security/ai/generate-customize-learn-about-esorql-queries.md
          - file: security/ai/ease/ease-value-report.md
      - file: security/detect-and-alert.md
        children:
          - file: security/detect-and-alert/detections-requirements.md
          - file: security/detect-and-alert/using-logsdb-index-mode-with-elastic-security.md
          - file: security/detect-and-alert/about-detection-rules.md
          - file: security/detect-and-alert/create-detection-rule.md
            children:
              - file: security/detect-and-alert/cross-cluster-search-detection-rules.md
              - file: security/detect-and-alert/launch-timeline-from-investigation-guides.md
              - file: security/detect-and-alert/exclude-cold-frozen-data-from-individual-rules.md
          - file: security/detect-and-alert/install-manage-elastic-prebuilt-rules.md
            children:
              - file: security/detect-and-alert/prebuilt-rules-update-modified-unmodified.md
          - file: security/detect-and-alert/manage-detection-rules.md
          - file: security/detect-and-alert/monitor-rule-executions.md
          - file: security/detect-and-alert/rule-exceptions.md
            children:
              - file: security/detect-and-alert/create-manage-value-lists.md
              - file: security/detect-and-alert/add-manage-exceptions.md
              - file: security/detect-and-alert/create-manage-shared-exception-lists.md
          - file: security/detect-and-alert/about-building-block-rules.md
          - file: security/detect-and-alert/mitre-attandckr-coverage.md
          - file: security/detect-and-alert/manage-detection-alerts.md
            children:
              - file: security/detect-and-alert/visualize-detection-alerts.md
              - file: security/detect-and-alert/view-detection-alert-details.md
              - file: security/detect-and-alert/add-detection-alerts-to-cases.md
              - file: security/detect-and-alert/suppress-detection-alerts.md
          - file: security/detect-and-alert/reduce-notifications-alerts.md
          - file: security/detect-and-alert/query-alert-indices.md
          - file: security/detect-and-alert/tune-detection-rules.md
      - file: security/configure-elastic-defend.md
        children:
          - file: security/configure-elastic-defend/elastic-defend-requirements.md
          - file: security/configure-elastic-defend/install-elastic-defend.md
            children:
              - hidden: security/configure-elastic-defend/enable-access-for-macos-monterey.md
              - hidden: security/configure-elastic-defend/enable-access-for-macos-ventura-higher.md
              - file: security/configure-elastic-defend/enable-access-for-macos.md
              - file: security/configure-elastic-defend/deploy-on-macos-with-mdm.md
              - file: security/configure-elastic-defend/prevent-elastic-agent-uninstallation.md
          - file: security/configure-elastic-defend/elastic-defend-feature-privileges.md
          - file: security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend.md
            children:
              - file: security/configure-elastic-defend/configure-updates-for-protection-artifacts.md
              - file: security/configure-elastic-defend/turn-off-diagnostic-data-for-elastic-defend.md
              - file: security/configure-elastic-defend/configure-self-healing-rollback-for-windows-endpoints.md
              - file: security/configure-elastic-defend/configure-linux-file-system-monitoring.md
              - file: security/configure-elastic-defend/configure-data-volume-for-elastic-endpoint.md
              - file: security/configure-elastic-defend/create-an-elastic-defend-policy-using-api.md
          - file: security/configure-elastic-defend/configure-offline-endpoints-air-gapped-environments.md
          - file: security/configure-elastic-defend/uninstall-elastic-agent.md
      - file: security/manage-elastic-defend.md
        children:
          - file: security/manage-elastic-defend/endpoints.md
          - file: security/manage-elastic-defend/policies.md
          - file: security/manage-elastic-defend/trusted-applications.md
          - file: security/manage-elastic-defend/trusted-devices.md
          - file: security/manage-elastic-defend/event-filters.md
          - file: security/manage-elastic-defend/host-isolation-exceptions.md
          - file: security/manage-elastic-defend/blocklist.md
          - file: security/manage-elastic-defend/optimize-elastic-defend.md
          - file: security/manage-elastic-defend/event-capture-elastic-defend.md
          - file: security/manage-elastic-defend/endpoint-protection-rules.md
          - file: security/manage-elastic-defend/automatic-troubleshooting.md
          - file: security/manage-elastic-defend/allowlist-elastic-endpoint-in-third-party-antivirus-apps.md
          - file: security/manage-elastic-defend/elastic-endpoint-self-protection-features.md
      - file: security/endpoint-response-actions.md
        children:
          - file: security/endpoint-response-actions/automated-response-actions.md
          - file: security/endpoint-response-actions/isolate-host.md
          - file: security/endpoint-response-actions/response-actions-history.md
          - file: security/endpoint-response-actions/third-party-response-actions.md
          - file: security/endpoint-response-actions/configure-third-party-response-actions.md
      - file: security/cloud.md
        children:
          - file: security/cloud/security-posture-management-overview.md
          - file: security/cloud/enable-cloud-security-features.md
          - file: security/cloud/cloud-security-posture-management.md
            children:
              - file: security/cloud/get-started-with-cspm-for-aws.md
              - file: security/cloud/get-started-with-cspm-for-gcp.md
              - file: security/cloud/get-started-with-cspm-for-azure.md
              - file: security/cloud/cspm-privilege-requirements.md
              - file: security/cloud/findings-page.md
              - file: security/cloud/benchmarks.md
              - file: security/cloud/cspm-dashboard.md
              - file: security/cloud/cspm-frequently-asked-questions-faq.md
          - file: security/cloud/kubernetes-security-posture-management.md
            children:
              - file: security/cloud/get-started-with-kspm.md
              - file: security/cloud/findings-page-2.md
              - file: security/cloud/kspm-benchmarks.md
              - file: security/cloud/kspm-dashboard.md
              - file: security/cloud/kspm-frequently-asked-questions.md
          - file: security/cloud/asset-disc.md
            children:
              - file: security/cloud/asset-disc-aws.md
              - file: security/cloud/asset-disc-gcp.md
              - file: security/cloud/asset-disc-azure.md
          - file: security/cloud/cloud-native-vulnerability-management.md
            children:
              - file: security/cloud/get-started-with-cnvm.md
              - file: security/cloud/cnvm-privilege-requirements.md
              - file: security/cloud/findings-page-3.md
              - file: security/cloud/cnvm-dashboard.md
              - file: security/cloud/cnvm-frequently-asked-questions-faq.md
          - file: security/cloud/cloud-workload-protection-for-vms.md
            children:
              - file: security/cloud/capture-environment-variables.md
      - file: security/integrations/ingest-third-party-security-data.md
        children:
          - file: security/integrations/aws-config.md
          - file: security/integrations/aws-inspector.md
          - file: security/integrations/aws-security-hub.md
          - file: security/integrations/cncf-falco.md
          - file: security/integrations/google-security-command-center.md
          - file: security/integrations/microsoft-defender-for-cloud.md
          - file: security/integrations/microsoft-defender-for-endpoint.md
          - file: security/integrations/microsoft-defender-xdr.md
          - file: security/integrations/prisma-cloud.md
          - file: security/integrations/qualys.md
          - file: security/integrations/rapid7.md
          - file: security/integrations/tenablevm.md
          - file: security/integrations/wiz.md
      - file: security/investigate.md
        children:
          - file: security/investigate/timeline.md
            children:
              - file: security/investigate/timeline-templates.md
          - file: security/investigate/visual-event-analyzer.md
          - file: security/investigate/session-view.md
          - file: security/investigate/osquery.md
            children:
              - file: security/investigate/manage-integration.md
              - file: security/investigate/osquery-faq.md
              - file: security/investigate/add-osquery-response-actions.md
              - file: security/investigate/run-osquery-from-investigation-guides.md
              - file: security/investigate/run-osquery-from-alerts.md
              - file: security/investigate/examine-osquery-results.md
              - file: security/investigate/use-placeholder-fields-in-osquery-queries.md
          - file: security/investigate/notes.md
          - file: security/investigate/indicators-of-compromise.md
          - file: security/investigate/cases.md
            children:
              - file: security/investigate/cases-requirements.md
              - file: security/investigate/open-manage-cases.md
              - file: security/investigate/configure-case-settings.md
      - file: security/dashboards.md
        children:
          - file: security/dashboards/overview-dashboard.md
          - file: security/dashboards/detection-response-dashboard.md
          - file: security/dashboards/cloud-security-posture-dashboard.md
          - file: security/dashboards/entity-analytics-dashboard.md
          - file: security/dashboards/data-quality-dashboard.md
          - file: security/dashboards/cloud-native-vulnerability-management-dashboard.md
          - file: security/dashboards/detection-rule-monitoring-dashboard.md
          - file: security/dashboards/endpoint-detection-response-dashboard.md
      - file: security/explore.md
        children:
          - file: security/explore/hosts-page.md
          - file: security/explore/network-page.md
            children:
              - file: security/explore/configure-network-map-data.md
              - file: security/explore/configure-dns-histogram.md
          - file: security/explore/users-page.md
      - file: security/advanced-entity-analytics.md
        children:
          - file: security/advanced-entity-analytics/overview.md
          - file: security/advanced-entity-analytics/entity-risk-scoring.md
            children:
              - file: security/advanced-entity-analytics/entity-risk-scoring-requirements.md
              - file: security/advanced-entity-analytics/turn-on-risk-scoring-engine.md
              - file: security/advanced-entity-analytics/view-entity-details.md
              - file: security/advanced-entity-analytics/asset-criticality.md
              - file: security/advanced-entity-analytics/entity-store.md
              - file: security/advanced-entity-analytics/view-analyze-risk-score-data.md
          - file: security/advanced-entity-analytics/advanced-behavioral-detections.md
            children:
              - file: security/advanced-entity-analytics/machine-learning-job-rule-requirements.md
              - file: security/advanced-entity-analytics/anomaly-detection.md
              - file: security/advanced-entity-analytics/optimizing-anomaly-results.md
              - file: security/advanced-entity-analytics/behavioral-detection-use-cases.md
          - file: security/advanced-entity-analytics/privileged-user-monitoring.md
            children:
              - file: security/advanced-entity-analytics/privileged-user-monitoring-requirements.md
              - file: security/advanced-entity-analytics/privileged-user-monitoring-setup.md
              - file: security/advanced-entity-analytics/monitor-privileged-user-activitites.md
      - file: security/asset-management.md
      - file: security/apis.md