Merge branch 'main' into issue-3491-exception-item-list

Author: nastasha-solomon

docs/cases/cases-index.asciidoc

@@ -1,3 +1,5 @@
+include::indicators-of-compromise.asciidoc[leveloffset=+1]
+
 include::cases-overview.asciidoc[leveloffset=+1]
 
 include::cases-req.asciidoc[leveloffset=+2]
@@ -6,4 +8,3 @@ include::cases-manage.asciidoc[leveloffset=+2]
 
 include::cases-manage-settings.asciidoc[leveloffset=+1]
 
-include::indicators-of-compromise.asciidoc[leveloffset=+1]

docs/cloud-native-security/cloud-native-security-index.asciidoc

@@ -65,5 +65,4 @@ include::d4c-policy-guide.asciidoc[leveloffset=+2]
 include::cloud-nat-sec-kubernetes-dashboard.asciidoc[leveloffset=+2]
 
 include::cloud-workload-protection.asciidoc[leveloffset=+1]
-include::session-view.asciidoc[leveloffset=+1]
 include::environment-variable-capture.asciidoc[leveloffset=+1]

docs/cloud-native-security/session-view.asciidoc

@@ -1,5 +1,5 @@
 [[session-view]]
-== Session View
+= Session View
 
 Session View is an investigation tool that allows you to examine Linux process data organized
 in a tree-like structure according to the Linux logical event model, with processes organized by parentage and time of execution.
@@ -13,9 +13,8 @@ and investigating session activity on your Linux infrastructure and understandin
 * Session View requires an https://www.elastic.co/pricing[Enterprise subscription].
 --
 
-[float]
-[[session-view-data]]
-====== Session View displays:
+Session View has the following features:
+
 * *Interactive and non-interactive processes:* Processes and services with or without a controlling terminal.
 * *User information:* The Linux user that executed each session or process, and any exec user changes.
 * *Process and event telemetry:* Process information included in the Linux logical event model.
@@ -27,7 +26,7 @@ NOTE: To view Linux session data from your Kubernetes infrastructure, you'll nee
 
 [float]
 [[enable-session-view]]
-=== Enable Session View data
+== Enable Session View data
 Session View uses process data collected by the {elastic-defend} integration,
 but this data is not always collected by default. To confirm that Session View data is enabled:
 
@@ -45,7 +44,7 @@ fields collected when this setting is enabled, refer to the https://github.com/e
 
 [float]
 [[open-session-view]]
-=== Open Session View
+== Open Session View
 Session View is accessible from the **Hosts**, **Alerts**, and **Timelines** pages, as well as the alert details flyout and the **Kubernetes** dashboard.
 Events and sessions that you can investigate in Session View have a rectangular
 *Open Session View* button in the *Actions* column. For example:
@@ -60,7 +59,7 @@ From either of these tabs, click the *Open Session View* button for an event or
 
 [discrete]
 [[session-view-ui]]
-=== Session View UI
+== Session View UI
 The Session View UI has the following features:
 
 [role="screenshot"]
@@ -109,7 +108,7 @@ image::images/session-view-output-badge.png[The Output badge,width=80%,height=80
 
 [[session-view-output]]
 [discrete]
-=== Terminal output view UI
+== Terminal output view UI
 
 .Requirements
 [sidebar]
@@ -148,7 +147,7 @@ TIP: Use Session view's *Fullscreen* button (located next to the *Close session
 
 [discrete]
 [[terminal-output-limitations]]
-==== Terminal output limitations for search and alerting
+=== Terminal output limitations for search and alerting
 You should understand several current limitations before building rules based on terminal output data:
 
 * Terminal output that appears in the `process.io.text` field includes https://gist.github.com/fnky/458719343aabd01cfb17a3a4f7296797[ANSI codes] that represent, among other things, text color, text weight, and escape sequences. This can prevent EKS queries from matching as expected. Queries of this data will have more success matching single words than more complex strings.

docs/detections/detections-index.asciidoc

@@ -41,8 +41,6 @@ include::alert-suppression.asciidoc[leveloffset=+1]
 
 include::alerts-reduce.asciidoc[]
 
-include::visual-event-analyzer.asciidoc[]
-
 include::query-alert-indices.asciidoc[]
 
 include::prebuilt-rules/tune-rule-signals.asciidoc[]

docs/detections/detections-req.asciidoc

@@ -36,7 +36,8 @@ and restarting {kib}, you must restart all detection rules.
 [discrete]
 [[enable-detections-ui]]
 == Enable and access detections
-To use the Detections feature, it must be enabled and your role must have access to rules and alerts. If your role does not have the cluster and index privileges needed to enable this feature, you can request someone who has these privileges to visit your Kibana space, which will turn it on for you. The following table describes the required privileges to access the Detections page, including rules and alerts.
+
+To use the Detections feature, it must be enabled, your role must have access to rules and alerts, and your {kib} space must have **Data View Management** {kibana-ref}/xpack-spaces.html#spaces-control-feature-visibility[feature visibility]. If your role does not have the cluster and index privileges needed to enable this feature, you can request someone who has these privileges to visit your Kibana space, which will turn it on for you. The following table describes the required privileges to access the Detections feature, including rules and alerts.
 
 NOTE: For instructions about using Machine Learning jobs and rules, refer to <<ml-requirements, Machine learning job and rule requirements>>.
 
@@ -65,7 +66,7 @@ a|The `manage`, `write`,`read`, and `view_index_metadata` index privileges for t
 
 |Enable the Detections feature in all Kibana spaces
 
-*NOTE*: To turn on the Detections feature, visit the Detections page for each appropriate Kibana space.
+*NOTE*: To turn on the Detections feature, visit the Rules and Alerts pages for each appropriate Kibana space.
 
 |The `manage` privilege
 a|The `manage`, `write`,`read`, and `view_index_metadata` index privileges for the following system indices and data streams:

docs/detections/rules-cross-cluster-search.asciidoc

@@ -9,9 +9,11 @@
 
 This section explains the general process for setting up cross-cluster search in detection rules. For specific instructions on each part of the process, refer to the linked documentation.
 
-NOTE: This procedure uses TLS certificate authentication to add remote clusters. {stack} 8.10.0 introduces an alternate method using {ref}/remote-clusters-api-key.html[API key authentication], but it is not yet supported for detection rules.
+. On the local cluster, establish trust and set up a connection to the remote cluster, using one of the following methods. With either method, note the unique name that you give to the remote cluster, because you'll need to use it throughout this process.
 
-. On the local cluster, {ref}/remote-clusters-cert.html[establish trust and set up a connection] to the remote cluster. Note the unique name that you give to the remote cluster, because you'll need to use it throughout this process.
+* {ref}/remote-clusters-api-key.html[Add remote clusters using API key authentication] — Clusters must be on {stack} version 8.14 or later. 
+
+* {ref}/remote-clusters-cert.html[Add remote clusters using TLS certificate authentication]
 
 . On both the local and remote clusters, {ref}/remote-clusters-cert.html#clusters-privileges-ccs-kibana-cert[create a
 role for cross-cluster search privileges], and make sure the two roles have
@@ -56,7 +58,9 @@ IMPORTANT: The rule preview uses the current user's cross-cluster search privile
 [[update-api-key]]
 === Update a rule's API key
 
-When a user creates a new rule or saves edits to an existing rule, their current privileges are saved to {kibana-ref}/alerting-setup.html#alerting-authorization[the rule's API key]. If that user's privileges change in the future, the rule *_does not_* automatically update with the user's latest privileges — you must update the rule's API key to update its privileges.
+Each detection rule has its own {kibana-ref}/alerting-setup.html#alerting-authorization[API key], which determines the data and actions the rule is allowed to access. When a user creates a new rule or changes an existing rule, their current privileges are saved to the rule's API key. If that user's privileges change in the future, the rule *_does not_* automatically update with the user's latest privileges — you must update the rule's API key if you want to update its privileges.
+
+IMPORTANT: A rule's API key is different from the API key you might have created for <<set-up-ccs-rules,authentication between local and remote clusters>>.
 
 To update a rule's API key, log into the local cluster as a user with the privileges you want to apply to the rule, then do either of the following:
 

docs/detections/visual-event-analyzer.asciidoc

@@ -1,14 +1,14 @@
 [[visual-event-analyzer]]
 [role="xpack"]
-== Visual event analyzer
+= Visual event analyzer
 
 {elastic-sec} allows any event detected by {elastic-endpoint} to be analyzed using a process-based visual analyzer, which shows a graphical timeline of processes that led up to the alert and the events that occurred immediately after. Examining events in the visual event analyzer is useful to determine the origin of potentially malicious activity and other areas in your environment that may be compromised. It also enables security analysts to drill down into all related hosts, processes, and other events to aid in their investigations.
 
 TIP: If you're experiencing performance degradation, you can <<exclude-cold-frozen-tiers, exclude cold and frozen tier data>> from analyzer queries.
 
 [float]
 [[find-events-analyze]]
-=== Find events to analyze
+== Find events to analyze
 
 You can only visualize events triggered by hosts configured with the {elastic-defend} integration or any `sysmon` data from `winlogbeat`.
 
@@ -47,7 +47,7 @@ TIP: You can also analyze events from <<timelines-ui,Timelines>>.
 
 [discrete]
 [[visual-analyzer-ui]]
-=== Visual event analyzer UI
+== Visual event analyzer UI
 
 Within the visual analyzer, each cube represents a process, such as an executable file or network event. Click and drag in the analyzer to explore the hierarchy of all process relationships.
 
@@ -98,7 +98,7 @@ image::images/graphical-view.png[]
 
 [discrete]
 [[process-and-event-details]]
-=== Process and event details
+== Process and event details
 
 To learn more about each related process, select the process in the left panel or the graphical view. The left panel displays process details such as:
 

docs/es-overview.asciidoc

@@ -1,10 +1,10 @@
 [[es-overview]]
 [chapter, role="xpack"]
-= Elastic Security overview
+= {elastic-sec} overview
 
 {elastic-sec} combines threat detection analytics, cloud native security, and endpoint protection capabilities in a single solution, so you can quickly detect, investigate, and respond to threats and vulnerabilities across your environment.
 
-Elastic Security provides:
+{elastic-sec} provides:
 
 * A detection engine that identifies a wide range of threats
 * A workspace for event triage, investigation, and case management
@@ -16,7 +16,7 @@ Elastic Security provides:
 === Learn more
 
 * <<getting-started, Get started>>: Learn about system requirements, workspaces, configuration, and data ingestion.
-* <<es-ui-overview, Elastic Security UI overview>>: Navigate {elastic-sec}'s various tools and interfaces.
+* <<es-ui-overview, {elastic-sec} UI overview>>: Navigate {elastic-sec}'s various tools and interfaces.
 * <<about-rules, Detection rules>>: Use {elastic-sec}'s detection engine with custom and prebuilt rules.
 * <<cloud-native-security-overview, Cloud native security>>: Enable cloud native security capabilities such as Cloud and Kubernetes security posture management, cloud native vulnerability management, and cloud workload protection for Kubernetes and VMs.
 * <<install-endpoint, Install {elastic-defend}>>: Enable key endpoint protection capabilities like event collection and malicious activity prevention.

docs/events/index.asciidoc

@@ -0,0 +1,11 @@
+[[investigations-tools]]
+
+= Investigation tools
+
+The following sections describe tools for investigating security events and tracking security issues directly in the {security-app}.
+
+include::timeline-ui-overview.asciidoc[leveloffset=+1]
+include::timeline-templates.asciidoc[leveloffset=+2]
+include::../detections/visual-event-analyzer.asciidoc[leveloffset=+1]
+include::../cloud-native-security/session-view.asciidoc[leveloffset=+1]
+include::../osquery/osquery-index.asciidoc[leveloffset=+1]