[Detections RBAC] Update references to detections RBAC

[yctercero]

Summary

Related: #3589

In an effort to provide finer grained privileges to our users we have made the initial PR updates to move Rules, Alerts, and Exceptions Kibana privileges out from under Security > Security and into it's own Security > Rules. There will be follow up work done dev side to break out Rules privileges into subfeatures.

Changes made

• Attack Discovery
  • Added note about needing Rules - All
  • Updated screenshot
• Detection Rule Monitoring Dashboard
  • Added note about needing Rules - Read to view dashboards
• Detections Requirements
  • Updated the privileges table to specify Rules - * for serverless
  • Added badge for stack where required now
  • Added table that breaks down some info on serverless prebuilt roles
• Automatic Migration
  • Added note about needing Rules - All for serverless
• Notes
  • Added a sentence referring back to detection requirements so users can have an overview of how the privileges relate
• Timeline
  • Added a sentence referring back to detection requirements so users can have an overview of how the privileges relate

[github-actions]

🔍 Preview links for changed docs

• solutions/security/ai/attack-discovery.md
• solutions/security/dashboards/detection-rule-monitoring-dashboard.md
• solutions/security/detect-and-alert/detections-requirements.md
• solutions/security/get-started/automatic-migration.md
• solutions/security/investigate/notes.md
• solutions/security/investigate/timeline.md

[benironside]

Thanks so much for this Yara! I'm going to make a few small edits, and I'll hold off on approving because I think another security writer should take a look first

[e40pud]

@yctercero I believe Attack Discovery: All and Rules - Read is enough to use Attack discovery. Since Rules - Read allows user to modify alert documents that will be enough for all actions within the Attack discovery page to work correctly.

[nastasha-solomon]

Thanks for opening this, @yctercero! This is a great starting point for updating the docs that explain the required Kibana privs that roles must have to use certain Security features. I'm planning to make some organizational improvements to the "Detections requirements" page for 9.3, so I may need to open a new PR to re-add the changes you made in this PR if my changes introduce too many gnarly conflicts.

However, before I move forward with the organizational changes, I do want to understand the schedule for the phases that you outlined here. I'll drop my questions the #security-detections-response-rbac channel so we can discuss there.

[nastasha-solomon]

@yctercero should this be at least Read instead of All?

Suggested change

	* {applies_to}`serverless: ` The `Security > Rules: All` privilege.
	* {applies_to}`serverless: ` At least the `Security > Rules: Read` privilege.

[yctercero]

@denar50 @rylnd can you confirm which it should be? I think I took this based off a convo we had but I could be wrong.

[nastasha-solomon]

@yctercero left some additional edits and questions. 🙇🏼‍♀️

[nastasha-solomon]

@yctercero in Serverless, will users need the Attack Discovery: All privilege and the Rules: Read privilege to use Attack Discover? Or do they only need the Rules: Read privilege? The updated screenshot (security-attck-disc-rbac.png) makes me think both, but I don't want to assume.

[nastasha-solomon]

Suggested change

	The following table describes the required privileges to access the Detections feature, including rules, alerts, and exceptions. For more information on {{kib}} privileges, refer to [Feature access based on user privileges](/deploy-manage/manage-spaces.md#spaces-control-user-access).
	```yaml {applies_to}
	stack: ga
	serverless: ga

The following table describes the required privileges to access the Detections feature, including rules, alerts, and exceptions. For more information on {{kib}} privileges, refer to Feature access based on user privileges.

[nastasha-solomon]

Making the title and anchor a bit more descriptive so they're easier to understand.

Suggested change

	### Predefined roles [ers_roles]
	### Predefined {{serverless-full}} roles [predefined-serverless-roles-detections]

[nastasha-solomon]

Suggested change

	serverless: all
	serverless: ga

[nastasha-solomon]

Adding a brief explanation of the table's purpose.

Suggested change

	| Action | Predefined role |
	You can use following [predefined roles](/deploy-manage/users-roles/cloud-organization/user-roles.md#general-assign-user-roles-table) in {{serverless-short}} projects to access the Detections feature, including rules, alerts, and exceptions.

[nastasha-solomon]

@yctercero at some point, it could be helpful for users to know which built-in ESS roles allow them to access detection rules.

[nastasha-solomon]

Are timelines, notes, and cases considered a part of the "detections" feature set now? I'm just trying to understand why they've been added to this table.

[nastasha-solomon]

If we end up keeping this in the table, will need to link to the more details docs about case feature access at: https://www.elastic.co/docs/solutions/security/investigate/cases-requirements

[nastasha-solomon]

Suggested change

	You can control access to notes by setting the [{{kib}} privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md) for the **Notes** feature under **Security**. For more details on SIEM requirements, refer to [Detections requirements](/solutions/security/detect-and-alert/detections-requirements.md).
	You can control access to notes by setting the [{{kib}} privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md) for the **Notes** feature under **Security**.
	::::{note}
	Refer to [Detections requirements](/solutions/security/detect-and-alert/detections-requirements.md) to learn about other available SIEM features and how to give your role access to them.
	::::

[nastasha-solomon]

Suggested change

	You can control access to Timeline by setting the [{{kib}} privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md) for the **Timeline** feature under **Security**. For more details on SIEM requirements, refer to [Detections requirements](/solutions/security/detect-and-alert/detections-requirements.md).
	You can control access to Timeline by setting the [{{kib}} privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md) for the **Timeline** feature under **Security**.
	::::{note}
	Refer to [Detections requirements](/solutions/security/detect-and-alert/detections-requirements.md) to learn about other available SIEM features and how to give your role access to them.