updates AD page

Author: benironside

docs/AI-for-security/attack-discovery.asciidoc

@@ -9,6 +9,12 @@
 
 preview::["This feature is in technical preview. It may change in the future, and you should exercise caution when using it in production environments. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of GA features."]
 
+.Requirements
+[sidebar]
+--
+To use Attack Discovery, you need the **Attack Discovery: All** {kibana-ref}/kibana-role-management.html#adding_kibana_privileges[{kib} privilege].
+--
+
 Attack discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible. This can help make the most of each security analyst's time, fight alert fatigue, and reduce your mean time to respond.
 
 For a demo, refer to the following video.
@@ -45,18 +51,18 @@ When you access Attack discovery for the first time, you'll need to select an LL
 .Recommended models
 [sidebar]
 --
-While Attack discovery is compatible with many different models, our testing found increased performance with Claude 3.5 Sonnet. In general, models with larger context windows are more effective for Attack discovery.
+While Attack discovery is compatible with many different models, refer to the <<llm-performance-matrix, Large language model performance matrix>> to see which models perform best.
 --
 +
-image::images/attck-disc-select-model-empty-state.png[]
+image::images/attck-disc-select-model-empty.png[]
 +
 . Once you've selected a connector, click **Generate** to start the analysis.
 
 It may take from a few seconds up to several minutes to generate discoveries, depending on the number of alerts and the model you selected. 
 
-IMPORTANT: Attack discovery is in technical preview and will only analyze opened and acknowleged alerts from the past 24 hours. By default it only analyzes up to 20 alerts within this timeframe, but you can expand this up to 100 by going to **AI Assistant → Settings (image:images/icon-settings.png[Settings icon,17,17]) → Knowledge Base** and updating the **Alerts** setting.
+IMPORTANT: y default it analyzes up to 100 alerts within this timeframe, but you can expand this up to 500 by clicking the settings icon  (image:images/icon-settings.png[Settings icon,17,17]) next to the model selection menu and adjusting the **Alerts** slider. Note that sending more alerts than your chosen LLM can handle may result in an error.
 
-image::images/knowledge-base-settings.png["AI Assistant's settings menu open to the Knowledge Base tab",75%]
+image::images/attack-disc-alert-number-menu.png["Attack Discovery's settings menu",75%]
 
 IMPORTANT: Attack discovery uses the same data anonymization settings as <<security-assistant, Elastic AI Assistant>>. To configure which alert fields are sent to the LLM and which of those fields are obfuscated, use the Elastic AI Assistant settings. Consider the privacy policies of third-party LLMs before sending them sensitive data.
 
@@ -72,7 +78,7 @@ Each discovery includes the following information describing the potential threa
 . The number of associated alerts and which parts of the https://attack.mitre.org/[MITRE ATT&CK matrix] they correspond to.
 . The implicated entities (users and hosts), and what suspicious activity was observed for each.
 
-image::images/attack-discovery-full-card.png[Attack discovery detail view]
+image::images/attck-disc-example-disc.png[Attack discovery detail view]
 
 [[attack-discovery-workflows]]
 [discrete]

docs/AI-for-security/images/attack-discovery-full-card.png

@@ -12,6 +12,10 @@ status: in review
 This feature is in technical preview. It may change in the future, and you should exercise caution when using it in production environments. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of GA features.
 </DocCallOut>
 
+<DocCallOut title="Requirements">
+To use Attack Discovery, you need the **Attack Discovery: All** privilege.
+</DocCallOut>
+
 Attack discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible. This can help make the most of each security analyst's time, fight alert fatigue, and reduce your mean time to respond.
 
 For a demo, refer to the following video.
@@ -34,7 +38,7 @@ When you access Attack discovery for the first time, you'll need to select an LL
 2. Select an existing connector from the dropdown menu, or add a new one. 
 
 <DocCallOut title="Recommended models">
-While Attack discovery is compatible with many different models, our testing found increased performance with Claude 3.5 Sonnet. In general, models with larger context windows are more effective for Attack discovery.
+While Attack discovery is compatible with many different models, refer to the <DocLink slug="/serverless/security/llm-performance-matrix"> Large language model performance matrix </DocLink> to see which models perform best.
 </DocCallOut>
 
 ![Attack discovery empty state](../images/attack-discovery/attck-disc-select-model-empty-state.png) 
@@ -65,7 +69,7 @@ Each discovery includes the following information describing the potential threa
 - The number of associated alerts and which parts of the [MITRE ATT&CK matrix](https://attack.mitre.org/) they correspond to.
 - The implicated entities (users and hosts), and what suspicious activity was observed for each.
 
-![Attack discovery detail view](../images/attack-discovery/attack-discovery-full-card.png)
+![Attack discovery detail view](../images/attack-discovery/attck-disc-example-disc.png)
 
 <div id="workflows"></div>
 ## Incorporate discoveries with other workflows