Space awareness for Elastic Defend

[benironside]

Fixes #1514

Updates the Spaces for Elastic Security and Elastic Defend feature privileges pages. Adds information about the space-awareness capabilities for Defend and other Security-specific Fleet features.

The biggest change is the creation of the Spaces and Elastic Security FAQ

Refer to this comment to preview the rendered docs

[github-actions]

🔍 Preview links for changed docs:

• solutions/security/configure-elastic-defend/elastic-defend-feature-privileges.md
• solutions/security/get-started/spaces-elastic-security.md

🔔 The preview site may take up to 3 minutes to finish building. These links will become live once it completes.

[florent-leborgne]

Suggesting to use our built-in metadata system for outlining version-related changes.

Otherwise LGTM 👍

[karenzone]

LGTM!

[bmorelli25]

@benironside can we merge this?

[benironside]

@bmorelli25 no, after my meeting with Caitlin there's something else I need to add. Working on it now.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/get-started/spaces-defend-faq.md
• solutions/security/configure-elastic-defend/elastic-defend-feature-privileges.md
• solutions/security/get-started/spaces-elastic-security.md

[paul-tavares]

Some initial feedback. I see that @natasha-moore-elastic has provided several comments to the FAQ page - some of which I was also going to provide - so I did not review that page. I will wait for the revised version to be available and will then do a full review on it.

[paul-tavares]

Thanks for all the updates. I did a full review this time and left comments.

A few general observations that you may want to consider (all of these general comments came out of my review of the FAQ):

• There seems to be inconsistencies on how we refer to Elastic Defend. We use "Endpoint" in some cases and "Elastic Defend" in others. Narrowing this down to just using one way to refer to it (IMO) would be best
• References to "Agent policies" are being reference in multiple ways: in some cases we call them "Elastic Agent policies" in others we call them only "Agent policies" and we also seem to refer to "agent" in with both capital A and lower case a.
  • I also noticed that we refer to them as "Elastic Agent policies". and wonder if the reference should be "Fleet Agent policies".
• Same goes for "integration" policies. In this case, we don't seem to be capitalizing the I in `integration" and we also just refer to it as "integration" instead of (maybe) "Fleet Integration policies".
• This may not be a valid comment, but I'll mention it: The use of 1st person grammar is used through and I'm wondering would all sound better when reading if we instead changed it to use 3rd person grammar instead
  • example of cases where 1st person is used: "You can see..."; "You can force..."; "you may need..."; "If you shared an integration policy..."
  • These could be reworded as: "The user can see"; "A user can force", "a user may need..."; "If an integration is policy is shared"

If possible, it would be best if we could use consistent names when referencing these in our docs as it will help with ensuring users are not further confused by the complex data models that are being used between Fleet and Security.

[paul-tavares]

Hi @benironside . Thanks for all the changes and the work done on these docs. Just did another full review and it all LGTM. I know you may still be working on some of the inconsistencies I pointed out in a earlier review, but from my standpoint those were optional and to your discretion, so I'm approving 👍

[karenzone]

General comments:

• Descriptive headings make for easier scanning/reading than back-to-back notes and admonitions. On this page, for example. Maybe that's something that we can look at going forward.
• Use present tense where possible.

These observations are for consideration and are NOT blocking, so for now, LGTM!