[Onboarding] SIEM guide #2017
[Onboarding] SIEM guide #2017
Conversation
|
I'm loving it! One suggestion: I would put the substeps inside a |
solutions/security/get-started/get-started-endpoint-security.md
Outdated
Show resolved
Hide resolved
solutions/security/get-started/get-started-endpoint-security.md
Outdated
Show resolved
Hide resolved
solutions/security/get-started/get-started-endpoint-security.md
Outdated
Show resolved
Hide resolved
solutions/security/get-started/get-started-endpoint-security.md
Outdated
Show resolved
Hide resolved
solutions/security/get-started/get-started-endpoint-security.md
Outdated
Show resolved
Hide resolved
| 1. On the Get Started page, scroll down to the **Configure rules and alerts** section. | ||
| 2. At the top of the page, click **Add Elastic rules**. The badge next to it shows the number of prebuilt rules available for installation. | ||
|
|
||
| The next pages displays the list of rules. Click on a rule name to view its details before you install it. |
There was a problem hiding this comment.
Could we add here a screenshot with the details of the rule that the user wants to install?
There was a problem hiding this comment.
I would move the rule details into the next step - makes sense to first find some relevant rules, and then look at the details. Rules previee contain information about Related integrations and we show if those are installed and Setup guide provides additional information about prerequisites.
There was a problem hiding this comment.
@approksiu I don't see the rule preview option for the out-of-box SIEM rules. But I'll add the sentence about viewing the details in the next step.
| To learn how to view and manage all detection rules, refer to [Manage detection rules](/solutions/security/detect-and-alert/manage-detection-rules.md). | ||
| :::: | ||
|
|
||
| ::::{step} Visualize and examine alert details |
There was a problem hiding this comment.
Part of me feels like this might be more appropriate under "Next steps" since all of the initial environment setup is complete. I also noticed that event analyzer is mentioned in step 3 here and later under "Next steps" here. If you decide to keep step 3 under the "Prerequisites" section, maybe remove the event analyzer mention from "Next steps"?
Contributes to https://github.com/elastic/docs-projects/issues/513.
Previews: