[DOCS] Threat Intelligence - Indicators Page and Indicator Details

docs/events/index.asciidoc

@@ -2,7 +2,8 @@
 
 = Investigate
 
-The following sections describe how to use Timelines and the Timeline graphical interface to investigate events, and how to use cases to open and track security issues directly in the {security-app}.
+The following sections describe tools for investigating security events and tracking security issues directly in the {security-app}.
 
 include::timeline-ui-overview.asciidoc[leveloffset=+1]
 include::timeline-templates.asciidoc[leveloffset=+1]
+include::indicators-of-compromise.asciidoc[leveloffset=+1]

docs/events/indicators-of-compromise.asciidoc

@@ -0,0 +1,87 @@
+[[indicators-of-compromise]]
+= Indicators of compromise
+
+The Indicators page collects data from enabled threat intelligence feeds and provides a centralized view of indicators, also known as indicators of compromise (IoCs). This topic helps you set up the Indicators page  and explains how to work with IoCs.
+
+[role="screenshot"]
+image::images/indicators-table.png[Shows the Indicators table on the Intelligence page]
+
+.Requirements
+[sidebar]
+--
+You must have _one_ of the following installed on the hosts you want to monitor:
+
+* *{agent}* - Install a {fleet-guide}/install-fleet-managed-elastic-agent.html[{fleet}-managed {agent}] and ensure the agent's {fleet-guide}/view-elastic-agent-status.html[status] is `Healthy`. Refer to {fleet-guide}/fleet-troubleshooting.html[{fleet} Troubleshooting] if it isn't.
+* *{filebeat}* - Install {filebeat-ref}/filebeat-installation-configuration.html[{filebeat}] version 8.x. Earlier {filebeat} versions are incompatible with ECS and will prevent indicator data from displaying in the Indicators table.
+--
+
+[discrete]
+[[ti-indicators]]
+== Threat intelligence and indicators
+Threat intelligence is a research function that helps analyze current and emerging threats, and recommends appropriate actions to strengthen a company's security posture. Threat intelligence requires proactivity to be useful, such as gathering, analyzing, and investigating various threat and vulnerability data sources.
+
+An indicator, also referred to as an indicator of compromise (IoC), is a piece of information associated with a known threat or reported vulnerability. There are many types of indicators, including URLs, files, domains, email addresses, and more. Within SOC teams, threat intelligence analysts use indicators to detect, assess, and respond to threats.
+
+[discrete]
+[[setup-intelligence-page]]
+== Set up the Indicators page
+
+Install a threat intelligence integration to add indicators to the Intelligence page.
+
+NOTE: If you've already installed a threat intelligence integration, you don't need to complete the following steps. Indicator data will automatically display in the Indicators table.
+
+. Choose one of the following:
+* From the {security-app} main menu, go to *Intelligence* -> *Add Integrations*.
+* From the {kib} main menu, click *Add integrations*. Scroll down the list of integration categories and select *Threat Intelligence* to filter by threat intelligence integrations.
+. Select a threat intelligence integration, then complete the integration's guided installation.
++
+NOTE: For more information about available fields, go to the https://docs.elastic.co/integrations[Elastic integration documentation] and search for a specific threat intelligence integration.
+
+. Return to the Intelligence page in {elastic-sec}. Refresh the page if indicator data isn't displaying.
+
+[discrete]
+[[troubleshoot-intel-page]]
+=== Troubleshooting
+If indicator data is not appearing in the Indicators table after you installed a threat intelligence integration:
+
+* Verify that the index holding indicator documents is included in the <<update-sec-indices,default {elastic-sec} indices>> (`securitySolution:defaultIndex`). The index holding indicator documents will differ based on the way you're collecting indicator data:
+** *{agent} integrations* - If you are collecting indicator data from {agent} threat intelligence integrations, indicator documents are stored in the `logs_ti*` index pattern.
+** *{filebeat} integrations* - If you are collecting indicator data from {filebeat} threat intelligence integrations, indicator documents are stored in the `filebeat-*` index pattern.
+* Make sure the indicator data you're ingesting is mapped to {ecs-ref}[Elastic Common Schema (ECS)].
+
+[discrete]
+[[intelligence-page-ui]]
+== Intelligence page UI
+
+After you add indicators to the Indicators page, you can <<examine-indicator-details, examine>>, search, filter, and take action on indicator data. Indicators also appear in the Trend view, which shows the occurrence of indicators over time.
+
+[role="screenshot"]
+image::images/interact-with-indicators-table.gif[width=90%][height=90%][Shows how to interact with the Intelligence page]
+
+[discrete]
+[[examine-indicator-details]]
+=== Examine indicator details
+Learn more about an IoC by clicking *View details*, then opening the Indicator details flyout. The flyout contains these informational tabs:
+
+* *Overview*: Provides a summary of the indicator, including the indicator's name, the threat intelligence feed it came from, the indicator type, and additional relevant data.
++
+NOTE: Some threat intelligence feeds provide  https://www.cisa.gov/tlp#:~:text=Introduction,shared%20with%20the%20appropriate%20audience[Traffic Light Protocol (TLP) markings]. The `TLP Marking` field will be empty if the data is not available. The `Confidence` field will also be empty if the data is not available.
+
+* *Table*: The indicator data in table format.
+* *JSON*: The indicator data in JSON format.
++
+[role="screenshot"]
+image::images/indicator-details-flyout.png[Shows the Indicator details flyout, 600]
+
+[discrete]
+[[find-related-sec-events]]
+== Find related security events
+
+Investigating an indicator in <<timelines-ui,Timeline>> helps you find related security events in your environment. You can add an indicator to Timeline from the Indicators table or the Indicator details flyout.
+
+[role="screenshot"]
+image::images/indicator-in-timeline.png[Shows the results of an indicator being investigated in Timeline]
+
+When you add an indicator to Timeline, a new Timeline opens with a pre-populated KQL query. The query contains the indicator field and value pair that you selected. Timeline also automatically includes the field and value pair of the mapped source event.
+
+For example, if you added the file hash indicator `threat.indicator.file.hash.sha256 : c207213257a63589b1e1bd2f459b47becd000c1af8ea7983dd9541aff145c3ba` to Timeline, Timeline automatically updates the KQL query to include the mapped source event field and value `file.hash.sha256 : c207213257a63589b1e1bd2f459b47becd000c1af8ea7983dd9541aff145c3ba`. Using a KQL query that includes both the indicator and source event allows Timeline to find all events and alerts that have matching field and value pairs. 

docs/getting-started/security-ui.asciidoc

@@ -99,6 +99,14 @@ image::images/network-ui.png[Shows the Network page]
 [role="screenshot"]
 image::images/users/users-page.png[Shows the Users page]
 
+[float]
+=== Intelligence
+
+Access and interact with indicator data in a centralized location. Learn more at <<indicators-of-compromise>>.
+
+[role="screenshot"]
+image::images/indicators-table.png[Shows the Intelligence page] 
+
 [float]
 === Get started