[DOCS] CTI enhancements to the Overview page and Alert details pane

[nastasha-solomon]

Addresses #773 and #797.

• A preview of updates to the Elastic Security UI topic is here. (Scroll to the "Threat Intelligence card" section.)
• A preview of updates to the Manage detection alerts topic is here.

[joepeeples]

Just a few small edits/suggestions.

[ecezalp]

Attached some general suggestions. I think it's close, please let me know what you think

[ecezalp]

I remember @shimonmodi mentioning that we shouldn't use these phrases (indicator match enrichments and investigation time enrichments), but I am not entirely sure exactly what we agreed on instead - we might want to check with @shimonmodi and @devonakerr.

[rylnd]

For context, here is the latest copy for those pages: elastic/kibana#105701

[rylnd]

For context, here is the latest copy for those pages: elastic/kibana#105701

[MikePaquette]

Hi Team, I'm having a bit of trouble following the latest state of things. Can we find 30-min Wednesday to huddle to nail this all down in a call?

@joepeeples check out our Writing Style Guide, which covers the treatment of open source and so much more :-).

All, the rule type we're referencing is the "Indicator Match" rule type. I'm noticing that we're using "Indicator rule" throughout, which is inconsistent and confusing. (See below)

On Friday, Shimon and I discussed some preferred terminology for the two representations on the alert details flyout as follows:

• Threat match detected. (An indicator match rule you created found this threat intelligence observable.)
• Enriched with Threat Intelligence. (This field value has additional information available from threat intelligence sources.)

Could someone attempt to reconcile these terms with the docs above? Thanks!!

[nastasha-solomon]

Thanks for joining in, @MikePaquette!

In my initial draft, I was working from the assumption that the customer-facing terms that'd be used to describe CTI data would eventually be formalized and so I was using "indicator match enrichments" and "investigation time enrichments" as placeholders. Just from hearing discussions about this topic, and viewing yesterday's CTI Roadmap Sync meeting, it sounds as though this topic will continue to be an ongoing discussion--and might even continue past 7.14. To accommodate for this, I've removed all references to "indicator match enrichments" and "investigation time enrichments" in the new draft. I've also revised a good portion of it to mainly focus on describing what CTI details are, where users can find them, and how they're produced.

All this said, I'd be happy to incorporate any agreed-upon terminology if it helps to further explain this feature or is required for the feature docs. I really just need some guidance on how to effectively frame this feature in-lieu of formal terms.

[jmikell821]

@nastasha-solomon to avoid confusion and our eyes crossing, let's divide this into chunks. Merge this feedback in, then I'll review starting from the Table tab section.

[rylnd]

Added suggestions for terminology; thanks for the effort here!

[rylnd]

Changes LGTM! Thank you!

[jmikell821]

Small comment, then slight adjustment to the "Change an alert's status" section:

To view alerts with other statuses, click In progress or Closed.

Change to:

To filter alerts that are In progress or Closed, select the appropriate status in the upper-right corner of the Alerts table.

To change alert statuses, do one of the following:

Change to:

To change an alert's status, do one of the following:

[joepeeples]

A few comments on the "Manage detection alerts" page.