Documents reputation service

[natasha-moore-elastic]

• Resolves Reputation Service option added to Malicious Behavior Policy card #3810

Preview: Configure an integration policy for Elastic Defend | Malicious behavior protection

[github-actions]

Documentation previews:

• ✨ HTML diff
• 📙 Elastic Security Guide

[szwarckonrad]

I believe it might be worth highlighting that only cloud users will see this option; for any other installation type, this option simply won't be there :). The sentence Select whether you want to use Reputation service for additional malware analysis. This is a cloud service that can identify malicious activity and false positives... makes it sound like the service itself is cloud-based, rather than indicating the availability of the feature. What do you think?

[natasha-moore-elastic]

I believe it might be worth highlighting that only cloud users will see this option; for any other installation type, this option simply won't be there :). The sentence Select whether you want to use Reputation service for additional malware analysis. This is a cloud service that can identify malicious activity and false positives... makes it sound like the service itself is cloud-based, rather than indicating the availability of the feature. What do you think?

That makes sense, thanks @szwarckonrad! How does this sound:

Select whether you want to use Reputation service for additional malware analysis. This service identifes malicious activity and false positives, and enriches alerts using data from various sources...

...

NOTE: Reputation service is available to Elastic Cloud users only and requires an active Platinum or Enterprise subscription.

[szwarckonrad]

Sounds good to me!

[natasha-moore-elastic]

Sounds good to me!

👍
Resolved in 26437fa.

[szwarckonrad]

@kevinlog
Could you have a look?

[kevinlog]

thanks for the ping @szwarckonrad - this looks good to me. I think @roxana-gheorghe should but the main approver of how the feature is described to users.

[roxana-gheorghe]

I think we should avoid the confusion between Elastic Cloud and Cloud Security, the current offering on our website.
Can we say something like:

NOTE: Reputation service requires an active Platinum or Enterprise subscription and is available to Cloud users only.

or

NOTE: Reputation service requires an active Platinum or Enterprise subscription and is not available to Self-managed users.

[natasha-moore-elastic]

I think we should avoid the confusion between Elastic Cloud and Cloud Security, the current offering on our website. Can we say something like:

NOTE: Reputation service requires an active Platinum or Enterprise subscription and is available to Cloud users only.

or

NOTE: Reputation service requires an active Platinum or Enterprise subscription and is not available to Self-managed users.

Thanks for this @roxana-gheorghe!
@elastic/security-docs, could you let me know how we would typically refer to this in the docs?

[natasha-moore-elastic]

I think we should avoid the confusion between Elastic Cloud and Cloud Security, the current offering on our website. Can we say something like:

NOTE: Reputation service requires an active Platinum or Enterprise subscription and is available to Cloud users only.

or

NOTE: Reputation service requires an active Platinum or Enterprise subscription and is not available to Self-managed users.

Hey @roxana-gheorghe, I've modified the note slightly to hopefully make this clearer:
NOTE: Reputation service requires an active Platinum or Enterprise subscription and is available on cloud deployments only.
Let me know if that sounds good to you.

[benironside]

LGTM