[Security] Privmon – AD integration groups update

[natasha-moore-elastic]

Summary

Resolves #4503:

• Updates the information on supported Active Directory privileged groups for privileged user monitoring
• Explains that 9.3+ uses SID-based group matching
• Adds a note for existing users on how to migrate to SID-based matching
• Addresses https://github.com/elastic/sdh-security-team/issues/1516 by adding a note clarifying that 9.2 matches on literal English group name strings, which may not work with localized Active Directory configurations

Preview

Set up and manage privileged user monitoring > Add a supported integration

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

Tool(s) and model(s) used:
Cursor, claude-4.5-sonnet

[github-actions]

Vale Linting Results

Summary: 2 suggestions found

💡 Suggestions (2)

File	Line	Rule	Message
solutions/security/advanced-entity-analytics/privileged-user-monitoring-setup.md	83	Elastic.FutureTense	'won't be' might be in future tense. Write in the present tense to describe the state of the product as it is now.
solutions/security/advanced-entity-analytics/privileged-user-monitoring-setup.md	92	Elastic.FutureTense	'will be' might be in future tense. Write in the present tense to describe the state of the product as it is now.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/advanced-entity-analytics/privileged-user-monitoring-setup.md

[benironside]

Great work, copy looks perfect to me. The only things I would suggest is moving the content from line 50 to line 46, so it's not in the switcher, I think that would give a little more context about this big list. I'd also consider using a stepper for the two steps on line 44 and 86. I know it's only two steps, but after the list I found myself a bit disoriented about where in the process I was.

[natasha-moore-elastic]

moving the content from line 50 to line 46, so it's not in the switcher

That content actually applies only to 9.3/serverless, so I don't think moving it out of the switcher would work in this case.

I'd also consider using a stepper for the two steps on line 44 and 86. I

Good idea! 💡 I've added a stepper now, and it definitely adds more visual clarity. 👍

[CAWilson94]

Thanks for this! Looking good 🚀