[Security] Add guide for configuring DNS histogram on Network page

[natasha-moore-elastic]

Contributes to elastic/security-docs#5584.

8.x PR: elastic/security-docs#7058

[github-actions]

🔍 Preview links for changed docs

• solutions/security/explore/configure-dns-histogram.md
• solutions/security/explore/network-page.md

[mdbirnstiehl]

A couple of small suggestions, but otherwise LGTM.

[angorayc]

Hi @nastasha-solomon ,
Nice documentation. Thank you.
Could you please also mention in the docs, this is for users who have Elastic Defend integration installed but have no dns.question.registered_domain available. By setting the ingest pipeline with the designated name, it will be picked by the integration and generate the dns.question.registered_domain from the dns.question.name.

[natasha-moore-elastic]

Hey @angorayc, thanks for having a look.

Could you please also mention in the docs, this is for users who have Elastic Defend integration installed but have no dns.question.registered_domain available. By setting the ingest pipeline with the designated name, it will be picked by the integration and generate the dns.question.registered_domain from the dns.question.name.

In the intro paragraph, we have this sentence:

"Depending on your Kibana setup—for example, if you're using Elastic Defend—you may need to add the dns.question.registered_domain field so that DNS data appears correctly. "

Just to clarify, are you saying that this guide is relevant only for users using Elastic Defend? If so, we can edit this sentence to be more explicit:

"If you're using Elastic Defend, you'll need to add the dns.question.registered_domain field so that DNS data appears correctly. "

Let me know if that makes more sense.

[angorayc]

Hey @angorayc, thanks for having a look.

Could you please also mention in the docs, this is for users who have Elastic Defend integration installed but have no dns.question.registered_domain available. By setting the ingest pipeline with the designated name, it will be picked by the integration and generate the dns.question.registered_domain from the dns.question.name.

In the intro paragraph, we have this sentence:

"Depending on your Kibana setup—for example, if you're using Elastic Defend—you may need to add the dns.question.registered_domain field so that DNS data appears correctly. "

Just to clarify, are you saying that this guide is relevant only for users using Elastic Defend? If so, we can edit this sentence to be more explicit:

"If you're using Elastic Defend, you'll need to add the dns.question.registered_domain field so that DNS data appears correctly. "

Let me know if that makes more sense.

It's a bit tricky.
Not all the user who has Elastic Defend installed would experience dns.question.registered_domain missing. These steps we are documenting is especially for users with Elastic Defend installed and and dns.question.registered_domain missing scenario.

For users with other integration installed, they will have to configure their integration to pick up the ingest pipeline we created.

[natasha-moore-elastic]

It's a bit tricky. Not all the user who has Elastic Defend installed would experience dns.question.registered_domain missing. These steps we are documenting is especially for users with Elastic Defend installed and and dns.question.registered_domain missing scenario.

Ah, got it. I updated the wording a bit to make this clearer. Let me know if that sounds good.