[8.16][serverless] adds Insights section to hosts and users details flyouts (#6080)

* updates host details flyout

* fixes image reference

* Updates User details flyout

* fix broken ref in serverless version

* Apply suggestions from code review

incorporates Nat's review

Co-authored-by: natasha-moore-elastic <[email protected]>

---------

Co-authored-by: natasha-moore-elastic <[email protected]>
(cherry picked from commit 98b6b97)

# Conflicts:
#	docs/serverless/explore/hosts-overview.asciidoc
#	docs/serverless/explore/users-page.asciidoc
#	docs/serverless/images/hosts-overview/-host-details-flyout.png
#	docs/serverless/images/users-page/-user-details-flyout.png

Author: benironside

docs/getting-started/images/users/user-details-flyout.png

@@ -64,6 +64,7 @@ The user details flyout includes the following sections:
 
 * <<user-risk-summary, User risk summary>>, which displays user risk data and inputs.
 * <<user-asset-criticality-section, Asset Criticality>>, which allows you to view and assign asset criticality.
+* <<user-insights, Insights>>, which displays misconfiguration findings for the user.
 * <<user-observed-data, Observed data>>, which displays user details.
 
 [role="screenshot"]
@@ -106,6 +107,12 @@ image::images/users/user-asset-criticality.png[Asset criticality]
 
 Click **Assign** to assign a criticality level to the selected user, or **Change** to change the currently assigned criticality level.
 
+[discrete]
+[[user-insights]]
+=== Insights
+
+The **Insights** section displays <<cspm-findings-page, Misconfiguration Findings>> for the user. Click **Misconfigurations** to expand the flyout and view this data.
+
 [discrete]
 [[user-observed-data]]
 === Observed data

docs/getting-started/users-page.asciidoc

@@ -67,6 +67,7 @@ The host details flyout includes the following sections:
 
 * <<host-risk-summary, Host risk summary>>, which displays host risk data and inputs.
 * <<host-asset-criticality-section, Asset Criticality>>, which allows you to view and assign asset criticality.
+* <<host-details-insights, Insights>>, which displays vulnerabilities findings for the host.
 * <<host-observed-data, Observed data>>, which displays host details.
 
 [role="screenshot"]
@@ -109,6 +110,14 @@ image::images/host-asset-criticality.png[Asset criticality]
 
 Click **Assign** to assign a criticality level to the selected host, or **Change** to change the currently assigned criticality level.
 
+[discrete]
+[[host-details-insights]]
+=== Insights
+
+The **Insights** section displays <<vuln-management-findings, Vulnerabilities Findings>> for the host. Click **Vulnerabilities** to expand the flyout and view this data.
+
+image::images/-host-details-insights-expanded.png[Host details flyout with the Vulnerabilities section expanded, 85%]
+
 [discrete]
 [[host-observed-data]]
 === Observed data

docs/management/hosts/hosts-overview.asciidoc

@@ -0,0 +1,136 @@
+[[security-hosts-overview]]
+= Hosts page
+
+// :description: Explore the Hosts page to analyze hosts and related security events.
+// :keywords: serverless, security, how-to, analyze
+
+preview:[]
+
+The Hosts page provides a comprehensive overview of all hosts and host-related security events. Key performance indicator (KPI) charts, data tables, and interactive widgets let you view specific data, drill down for deeper insights, and interact with Timeline for further investigation.
+
+[role="screenshot"]
+image::images/hosts-overview/-management-hosts-hosts-ov-pg.png[Hosts page]
+
+The Hosts page has the following sections:
+
+[discrete]
+[[host-KPI-charts]]
+== Host KPI (key performance indicator) charts
+
+KPI charts show metrics for hosts and unique IPs within the time range specified in the date picker. This data is visualized using linear or bar graphs.
+
+[TIP]
+====
+Hover inside a KPI chart to display the actions menu (image:images/icons/boxesHorizontal.svg[Actions menu icon]), where you can perform these actions: inspect, open in Lens, and add to a new or existing case.
+====
+
+[discrete]
+[[host-data-tables]]
+== Data tables
+
+Beneath the KPI charts are data tables, categorized by individual tabs, which are useful for viewing and investigating specific types of data. Select the relevant tab to view the following data:
+
+* **Events**: All host events. To display alerts received from external monitoring tools, scroll down to the Events table and select **Show only external alerts** on the right.
+* **All hosts**: High-level host details.
+* **Uncommon processes**: Uncommon processes running on hosts.
+* **Anomalies**: Anomalies discovered by machine learning jobs.
+* **Host risk**: The latest recorded host risk score for each host, and its host risk classification. This feature requires the Security Analytics Complete <<elasticsearch-manage-project,project feature>> and must be enabled to display the data. To learn more, refer to our <<security-entity-risk-scoring,entity risk scoring documentation>>.
+* **Sessions**: Linux process events that you can open in <<security-session-view,Session View>>, an investigation tool that allows you to examine Linux process data at a hierarchal level.
+
+The tables within the **Events** and **Sessions** tabs include inline actions and several customization options. To learn more about what you can do with the data in these tables, refer to <<security-alerts-manage,Manage detection alerts>>.
+
+[role="screenshot"]
+image::images/hosts-overview/-getting-started-users-events-table.png[Events table]
+
+[discrete]
+[[host-details-page]]
+== Host details page
+
+A host's details page displays all relevant information for the selected host. To view a host's details page, click its **Host name** link in the **All hosts** table.
+
+The host details page includes the following sections:
+
+* **Asset Criticality**: This section displays the host's current <<security-asset-criticality,asset criticality level>>.
+* **Summary**: Details such as the host ID, when the host was first and last seen, the associated IP addresses, and associated operating system. If the entity risk score feature is enabled, this section also displays host risk score data.
+* **Alert metrics**: The total number of alerts by severity, rule, and status (`Open`, `Acknowledged`, or `Closed`).
+* **Data tables**: The same data tables as on the main Hosts page, except with values for the selected host instead of all hosts.
+
+[role="screenshot"]
+image::images/hosts-overview/-management-hosts-hosts-detail-pg.png[Host's details page]
+
+[discrete]
+[[security-hosts-overview-host-details-flyout]]
+== Host details flyout
+
+In addition to the host details page, relevant host information is also available in the host details flyout throughout the {elastic-sec} app. You can access this flyout from the following places:
+
+* The Alerts page, by clicking on a host name in the Alerts table
+* The Entity Analytics dashboard, by clicking on a host name in the Host Risk Scores table
+* The **Events** tab on the Users and user details pages, by clicking on a host name in the Events table
+* The **User risk** tab on the user details page, by clicking on a host name in the Top risk score contributors table
+* The **Events** tab on the Hosts and host details pages, by clicking on a host name in the Events table
+* The **Host risk** tab on the host details page, by clicking on a host name in the Top risk score contributors table
+
+The host details flyout includes the following sections:
+
+* <<security-hosts-overview-host-risk-summary,Host risk summary>>, which displays host risk data and inputs.
+* <<security-hosts-overview-asset-criticality,Asset Criticality>>, which allows you to view and assign asset criticality.
+* <<host-details-insights, Insights>>, which displays vulnerabilities findings for the host.
+* <<security-hosts-overview-observed-data,Observed data>>, which displays host details.
+
+[role="screenshot"]
+image::images/hosts-overview/-host-details-flyout.png[Host details flyout]
+
+[discrete]
+[[security-hosts-overview-host-risk-summary]]
+=== Host risk summary
+
+.Requirements
+[NOTE]
+====
+The **Host risk summary** section is only available if the <<security-turn-on-risk-engine,risk scoring engine is turned on>>.
+====
+
+The **Host risk summary** section contains a risk summary visualization and table.
+
+The risk summary visualization shows the host risk score and host risk level. Hover over the visualization to display the **Options** menu (image:images/icons/boxesHorizontal.svg[Options menu]). Use this menu to inspect the visualization's queries, add it to a new or existing case, save it to your Visualize Library, or open it in Lens for customization.
+
+The risk summary table shows the category, score, and number of risk inputs that determine the host risk score. Hover over the table to display the **Inspect** button (image:images/icons/inspect.svg[Inspect]), which allows you to inspect the table's queries.
+
+To expand the **Host risk summary** section, click **View risk contributions**. The left panel displays additional details about the host's risk inputs:
+
+* The asset criticality level and contribution score from the latest risk scoring calculation.
+* The top 10 alerts that contributed to the latest risk scoring calculation, and each alert's contribution score.
+
+If more than 10 alerts contributed to the risk scoring calculation, the remaining alerts' aggregate contribution score is displayed below the **Alerts** table.
+
+[role="screenshot"]
+image::images/hosts-overview/-host-risk-inputs.png[Host risk inputs]
+
+[discrete]
+[[security-hosts-overview-asset-criticality]]
+=== Asset Criticality
+
+The **Asset Criticality** section displays the selected host's <<security-asset-criticality,asset criticality level>>. Asset criticality contributes to the overall <<security-entity-risk-scoring,host risk score>>. The criticality level defines how impactful the host is when calculating the risk score.
+
+[role="screenshot"]
+image::images/hosts-overview/-host-asset-criticality.png[Asset criticality]
+
+Click **Assign** to assign a criticality level to the selected host, or **Change** to change the currently assigned criticality level.
+
+[discrete]
+[[host-details-insights]]
+=== Insights
+
+The **Insights** section displays <<security-vuln-management-findings, Vulnerabilities Findings>> for the host. Click **Vulnerabilities** to expand the flyout and view this data.
+
+image::images/hosts-overview/-host-details-insights-expanded.png[Host details flyout with the Vulnerabilities section expanded, 85%]
+
+[discrete]
+[[security-hosts-overview-observed-data]]
+=== Observed data
+
+This section displays details such as the host ID, when the host was first and last seen, the associated IP addresses and operating system, and the relevant Endpoint integration policy information.
+
+[role="screenshot"]
+image::images/hosts-overview/-host-observed-data.png[Host observed data]

docs/management/hosts/images/-host-details-insights-expanded.png

@@ -0,0 +1,129 @@
+[[security-users-page]]
+= Users page
+
+// :description: Analyze authentication and user behavior within your environment.
+// :keywords: serverless, security, how-to, analyze
+
+preview:[]
+
+The Users page provides a comprehensive overview of user data to help you understand authentication and user behavior within your environment. Key performance indicator (KPI) charts, data tables, and interactive widgets let you view specific data and drill down for deeper insights.
+
+[role="screenshot"]
+image::images/users-page/-getting-started-users-users-page.png[User's page]
+
+The Users page has the following sections:
+
+[discrete]
+[[security-users-page-user-kpi-key-performance-indicator-charts]]
+== User KPI (key performance indicator) charts
+
+KPI charts show the total number of users and successful and failed user authentications within the time range specified in the date picker. Data in the KPI charts is visualized through linear and bar graphs.
+
+[TIP]
+====
+Hover inside a KPI chart to display the actions menu (image:images/icons/boxesHorizontal.svg[Actions menu icon]), where you can perform these actions: inspect, open in Lens, and add to a new or existing case.
+====
+
+[discrete]
+[[security-users-page-data-tables]]
+== Data tables
+
+Beneath the KPI charts are data tables, which are useful for viewing and investigating specific types of data. Select the relevant tab to view the following details:
+
+* **Events**: Ingested events that contain the `user.name` field. You can stack by the `event.action`, `event.dataset`, or `event.module` field. To display alerts received from external monitoring tools, scroll down to the Events table and select **Show only external alerts** on the right.
+* **All users**: A chronological list of unique user names, when they were last active, and the associated domains.
+* **Authentications**: A chronological list of user authentication events and associated details, such as the number of successes and failures, and the host name of the last successful destination.
+* **Anomalies**: Unusual activity discovered by machine learning jobs that contain user data.
+* **User risk**: The latest recorded user risk score for each user, and its user risk classification. This feature requires the Security Analytics Complete <<elasticsearch-manage-project,project feature>> and must be enabled to display the data. To learn more, refer to our <<security-entity-risk-scoring,entity risk scoring documentation>>.
+
+The Events table includes inline actions and several customization options. To learn more about what you can do with the data in these tables, refer to <<security-alerts-manage,Manage detection alerts>>.
+
+[discrete]
+[[security-users-page-user-details-page]]
+== User details page
+
+A user's details page displays all relevant information for the selected user. To view a user's details page, click its **User name** link from the **All users** table.
+
+The user details page includes the following sections:
+
+* **Asset Criticality**: This section displays the user's current <<security-asset-criticality,asset criticality level>>.
+* **Summary**: Details such as the user ID, when the user was first and last seen, the associated IP address(es), and operating system. If the entity risk score feature is enabled, this section also displays user risk score data.
+* **Alert metrics**: The total number of alerts by severity, rule, and status (`Open`, `Acknowledged`, or `Closed`).
+* **Data tables**: The same data tables as on the main Users page, except with values for the selected user instead of for all users.
+
+image::images/users-page/-getting-started-users-user-details-pg.png[User details page]
+
+[discrete]
+[[security-users-page-user-details-flyout]]
+== User details flyout
+
+In addition to the user details page, relevant user information is also available in the user details flyout throughout the {elastic-sec} app. You can access this flyout from the following places:
+
+* The Alerts page, by clicking on a user name in the Alerts table
+* The Entity Analytics dashboard, by clicking on a user name in the User Risk Scores table
+* The **Events** tab on the Users and user details pages, by clicking on a user name in the Events table
+* The **User risk** tab on the user details page, by clicking on a user name in the Top risk score contributors table
+* The **Events** tab on the Hosts and host details pages, by clicking on a user name in the Events table
+* The **Host risk** tab on the host details page, by clicking on a user name in the Top risk score contributors table
+
+The user details flyout includes the following sections:
+
+* <<security-users-page-user-risk-summary,User risk summary>>, which displays user risk data and inputs.
+* <<security-users-page-asset-criticality,Asset Criticality>>, which allows you to view and assign asset criticality.
+* <<user-insights, Insights>>, which displays misconfiguration findings for the user.
+* <<security-users-page-observed-data,Observed data>>, which displays user details.
+
+[role="screenshot"]
+image::images/users-page/-user-details-flyout.png[User details flyout]
+
+[discrete]
+[[security-users-page-user-risk-summary]]
+=== User risk summary
+
+.Requirement
+[NOTE]
+====
+The **User risk summary** section is only available if the <<security-turn-on-risk-engine,risk scoring engine is turned on>>.
+====
+
+The **User risk summary** section contains a risk summary visualization and table.
+
+The risk summary visualization shows the user risk score and user risk level. Hover over the visualization to display the **Options** menu (image:images/icons/boxesHorizontal.svg[Options menu]). Use this menu to inspect the visualization's queries, add it to a new or existing case, save it to your Visualize Library, or open it in Lens for customization.
+
+The risk summary table shows the category, score, and number of risk inputs that determine the user risk score. Hover over the table to display the **Inspect** button (image:images/icons/inspect.svg[Inspect]), which allows you to inspect the table's queries.
+
+To expand the **User risk summary** section, click **View risk contributions**. The left panel displays additional details about the user's risk inputs:
+
+* The asset criticality level and contribution score from the latest risk scoring calculation.
+* The top 10 alerts that contributed to the latest risk scoring calculation, and each alert's contribution score.
+
+If more than 10 alerts contributed to the risk scoring calculation, the remaining alerts' aggregate contribution score is displayed below the **Alerts** table.
+
+[role="screenshot"]
+image::images/users-page/-user-risk-inputs.png[User risk inputs]
+
+[discrete]
+[[security-users-page-asset-criticality]]
+=== Asset Criticality
+
+The **Asset Criticality** section displays the selected user's <<security-asset-criticality,asset criticality level>>. Asset criticality contributes to the overall <<security-entity-risk-scoring,user risk score>>. The criticality level defines how impactful the user is when calculating the risk score.
+
+[role="screenshot"]
+image::images/users-page/-user-asset-criticality.png[Asset criticality]
+
+Click **Assign** to assign a criticality level to the selected user, or **Change** to change the currently assigned criticality level.
+
+[discrete]
+[[user-insights]]
+=== Insights
+
+The **Insights** section displays <<security-cspm-findings-page, Misconfiguration Findings>> for the user. Click **Misconfigurations** to expand the flyout and view this data.
+
+[discrete]
+[[security-users-page-observed-data]]
+=== Observed data
+
+This section displays details such as the user ID, when the user was first and last seen, and the associated IP addresses and operating system.
+
+[role="screenshot"]
+image::images/users-page/-user-observed-data.png[User observed data]