[Onboarding] Security quickstart guides #2017

jmikell821 · 2025-07-03T04:20:42Z

Contributes to https://github.com/elastic/docs-projects/issues/513.

Previews:

github-actions · 2025-07-03T04:22:12Z

🔍 Preview links for changed docs

theletterf · 2025-07-03T08:08:01Z

I'm loving it! One suggestion: I would put the substeps inside a dropdown directive to reduce cognitive load and make the procedure look leaner.

natasha-moore-elastic

Left some minor, mostly formatting suggestions – overall looks great!

solutions/security/get-started/quickstarts.md

solutions/security/get-started/get-started-detect-with-siem.md

solutions/security/get-started/get-started-endpoint-security.md

approksiu

Looks like a great start! Added suggestions for the rules section.

solutions/security/get-started/get-started-detect-with-siem.md

nastasha-solomon · 2025-07-07T20:24:09Z

solutions/security/get-started/get-started-detect-with-siem.md

+    To learn how to view and manage all detection rules, refer to [Manage detection rules](/solutions/security/detect-and-alert/manage-detection-rules.md). 
+::::
+
+::::{step} Visualize and examine alert details 


Part of me feels like this might be more appropriate under "Next steps" since all of the initial environment setup is complete. I also noticed that event analyzer is mentioned in step 3 here and later under "Next steps" here. If you decide to keep step 3 under the "Prerequisites" section, maybe remove the event analyzer mention from "Next steps"?

solutions/security/get-started/get-started-detect-with-siem.md

…nto gs-sec-siem-guide

natasha-moore-elastic

Mostly minor suggestions, looks good overall!

solutions/security/get-started.md

solutions/security/get-started/get-started-cloud-security.md

natasha-moore-elastic · 2025-07-15T12:20:48Z

solutions/security/get-started/get-started-cloud-security.md

+4. Give the integration a name and enter an optional description. 
+5. Next, choose your deployment option. An agent-based deployment requires you to deploy and manage {{agent}} in the cloud account you want to monitor, whereas an agentless deployment allows you to collect cloud posture data without having to manage the {{agent}} deployment in your cloud. For simplicity, select **Agentless**.
+6. Next, in the **Setup Access** section, choose your preferred authentication method — direct access keys (recommended) or temporary keys. For this guide, we'll use direct access keys. 
+7. Expand the Steps to Generate AWS Account Credentials, and follow the instructions. 


Suggested change

7. Expand the Steps to Generate AWS Account Credentials, and follow the instructions.

7. Expand the Steps to Generate AWS Account Credentials, and follow the instructions.

I would either bold or lowercase "Steps to Generate AWS Account Credentials"

solutions/security/get-started/get-started-cloud-security.md

solutions/security/get-started/get-started-detect-with-siem.md

solutions/security/get-started/get-started-endpoint-security.md

approksiu · 2025-07-15T18:04:02Z

solutions/security/get-started/get-started-detect-with-siem.md

+
+::::{step} Modify policy configuration settings
+
+After you install the {{agent}} with {{elastic-defend}}, the Endpoint Security ({{elastic-defend}}) detection rule is automatically enabled, which also enables several endpoint protections—such as preventions against malware, ransomware, memory threats, and other malicious behavior—on protected hosts. This means that not only does {{elastic-defend}} monitor for these behaviors and generates an alert if any are detected, but it also blocks it. Due to this maximum level of protection, we recommend modifying the policy to _detect_ instead of _prevent_ so that only an alert will be generated, and you can decide how to respond to the threat. Then, closely monitor which alerts and how many are generating over a specific time period before enabling higher protection, if needed. 


At the Defend installation, Endpoint Security (Elastic Defend) is automatically installed and enabled. The rule does not enable endpoint protections, those need to be set up by the user. The rules will just create SIEM alerts for either - detection or protection alerts.

solutions/security/get-started/get-started-detect-with-siem.md

approksiu · 2025-07-15T18:07:58Z

solutions/security/get-started/get-started-detect-with-siem.md

+
+    :::{note}
+    You must install _and_ enable the rule for it to start running; therefore, do not select the **Install _x_ rules** option.  
+    :::


I think "do not select the Install x rules option" is a bit too strong statement, I suggest saying something "to speed up the process for the quick start, select Install and Enable option. The alternative is to enable a rule once it is installed from Installed rules table.

I've edited this text in 13643c6. If it's not what you had in mind, lmk!

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

nastasha-solomon

Don't see any major issues to fix. The guides look great!

lcawl · 2025-07-16T11:43:11Z

I've taken a crack at #2017 (comment) in 414dd02. If it's not what you had in mind, @approksiu lmk and worst case we can comment it out for now.

approksiu

Looks good to me from the detection POV, just 1 dot is missing.

solutions/security/get-started/get-started-detect-with-siem.md

Makes a few slight changes to the GS landing page. Relates to #2017. Preview [here](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/2275/solutions/security/get-started).

jmikell821 added 3 commits June 30, 2025 13:26

Create get-started-detect-with-siem.md

01a1ed3

Update get-started-detect-with-siem.md

55a8a93

Changes to GS files.

1398ade

jmikell821 self-assigned this Jul 3, 2025

jmikell821 requested review from a team as code owners July 3, 2025 04:20

jmikell821 requested a review from a team July 3, 2025 04:39

jmikell821 added 2 commits July 3, 2025 22:35

Saving changes.

5e795ee

Adds file to TOC.

72ddabb

natasha-moore-elastic reviewed Jul 4, 2025

View reviewed changes

approksiu reviewed Jul 7, 2025

View reviewed changes

solutions/security/get-started/get-started-detect-with-siem.md Outdated Show resolved Hide resolved

solutions/security/get-started/get-started-detect-with-siem.md Outdated Show resolved Hide resolved

nastasha-solomon reviewed Jul 7, 2025

View reviewed changes

jmikell821 and others added 7 commits July 7, 2025 23:48

Merging feedback + adding some more content

e5a2ea9

Merge branch 'main' into gs-sec-siem-guide

366b047

Fixing ref link + more edits.

d620f71

Saving building blocks for cloud security

c07f7a3

Merge branch 'main' into gs-sec-siem-guide

f6764e8

Saving changes + updating main branch

3a58af1

Merge branch 'gs-sec-siem-guide' of github.com:elastic/docs-content i…

eb55753

…nto gs-sec-siem-guide

jmikell821 changed the title ~~[Onboarding] SIEM guide~~ [Onboarding] Security quickstart guides Jul 10, 2025

jmikell821 and others added 3 commits July 13, 2025 06:35

Saving...

fc4ca94

Some more edits...

698fe10

Merge branch 'main' into gs-sec-siem-guide

d8ca24b

natasha-moore-elastic approved these changes Jul 15, 2025

View reviewed changes

natasha-moore-elastic reviewed Jul 15, 2025

View reviewed changes

solutions/security/get-started/get-started-endpoint-security.md Outdated Show resolved Hide resolved

approksiu requested changes Jul 15, 2025

View reviewed changes

Update solutions/security/get-started.md

6e9a726

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

lcawl and others added 15 commits July 15, 2025 12:08

Update solutions/security/get-started/get-started-detect-with-siem.md

1da57ed

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/get-started/get-started-detect-with-siem.md

ac11df3

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/get-started/get-started-endpoint-security.md

1db831d

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/get-started/get-started-endpoint-security.md

c24626c

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/get-started/get-started-endpoint-security.md

a7a9d0f

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/get-started/get-started-cloud-security.md

60fb794

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/get-started/get-started-cloud-security.md

ae04263

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/get-started/get-started-cloud-security.md

e6acf64

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/get-started/get-started-cloud-security.md

807ae30

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/get-started/get-started-endpoint-security.md

3c85d8d

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/get-started/get-started-detect-with-siem.md

e9e1792

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/get-started/get-started-cloud-security.md

18eae0c

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/get-started/get-started-detect-with-siem.md

8b48968

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/get-started/get-started-detect-with-siem.md

06a7c1d

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

Update solutions/security/get-started/get-started-detect-with-siem.md

b9e32ea

Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com>

nastasha-solomon approved these changes Jul 15, 2025

View reviewed changes

lcawl added 4 commits July 16, 2025 04:11

Revert change in get-started-detect-with-siem.md

f9f2951

Merge branch 'main' into gs-sec-siem-guide

a314cc5

Remove note

13643c6

Address policy configuration feedback

414dd02

approksiu approved these changes Jul 17, 2025

View reviewed changes

solutions/security/get-started/get-started-detect-with-siem.md Outdated Show resolved Hide resolved

lcawl added 2 commits July 17, 2025 08:52

Fix typo

21bbbe1

Merge branch 'main' into gs-sec-siem-guide

a34a171

lcawl enabled auto-merge (squash) July 17, 2025 15:53

Merge branch 'main' into gs-sec-siem-guide

f596630

lcawl merged commit c6a7542 into main Jul 17, 2025
8 of 9 checks passed

lcawl deleted the gs-sec-siem-guide branch July 17, 2025 16:03

jmikell821 mentioned this pull request Jul 24, 2025

Updates Security Get Started landing page #2275

Merged

	7. Expand the Steps to Generate AWS Account Credentials, and follow the instructions.
	7. Expand the Steps to Generate AWS Account Credentials, and follow the instructions.


		::::{step} Modify policy configuration settings

		After you install the {{agent}} with {{elastic-defend}}, the Endpoint Security ({{elastic-defend}}) detection rule is automatically enabled, which also enables several endpoint protections—such as preventions against malware, ransomware, memory threats, and other malicious behavior—on protected hosts. This means that not only does {{elastic-defend}} monitor for these behaviors and generates an alert if any are detected, but it also blocks it. Due to this maximum level of protection, we recommend modifying the policy to _detect_ instead of _prevent_ so that only an alert will be generated, and you can decide how to respond to the threat. Then, closely monitor which alerts and how many are generating over a specific time period before enabling higher protection, if needed.

[Onboarding] Security quickstart guides #2017

[Onboarding] Security quickstart guides #2017

Uh oh!

Conversation

jmikell821 commented Jul 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jul 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

theletterf commented Jul 3, 2025

Uh oh!

natasha-moore-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

approksiu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nastasha-solomon Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

natasha-moore-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

natasha-moore-elastic Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

approksiu Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

approksiu Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

lcawl Jul 16, 2025

Choose a reason for hiding this comment

Uh oh!

nastasha-solomon left a comment

Choose a reason for hiding this comment

Uh oh!

lcawl commented Jul 16, 2025

Uh oh!

approksiu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jmikell821 commented Jul 3, 2025 •

edited

Loading

github-actions bot commented Jul 3, 2025 •

edited

Loading