[Onboarding] SIEM guide

[jmikell821]

Contributes to https://github.com/elastic/docs-projects/issues/513.

Previews:

• SIEM guide

NOT READY FOR PRIME TIME JUST YET.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/get-started/get-started-detect-with-siem.md
• solutions/security/get-started/quickstarts.md

[theletterf]

I'm loving it! One suggestion: I would put the substeps inside a dropdown directive to reduce cognitive load and make the procedure look leaner.

[natasha-moore-elastic]

Left some minor, mostly formatting suggestions – overall looks great!

[natasha-moore-elastic]

Should this say "security strategies" or something similar, instead of search?

[natasha-moore-elastic]

Suggested change

	Elastic Security is a unified security solution that brings together SIEM, endpoint security, and cloud security into a single platform. This makes it easier to protect, investigate, and respond to security events from all areas within your environment.
	{{elastic-sec}} is a unified security solution that brings together SIEM, endpoint security, and cloud security into a single platform. This makes it easier to protect, investigate, and respond to security events from all areas within your environment.

[natasha-moore-elastic]

Suggested change

	::::{step} Add Elastic detection prebuilt rules
	::::{step} Add Elastic prebuilt detection rules

[natasha-moore-elastic]

Suggested change

	Detection rules allow you to proactively monitor your environment by searching for source events, matches, sequences, or machine learning job anomaly results that meet their criteria. When a rule’s criteria are met, {{elastic-sec}} generates an alert. While you can create your own rules tailored for your environment, Elastic ships out-of-the-box prebuilt rules that you can install.
	Detection rules allow you to proactively monitor your environment by searching for source events, matches, sequences, or {{ml}} job anomaly results that meet their criteria. When a rule’s criteria are met, {{elastic-sec}} generates an alert. While you can create your own rules tailored for your environment, Elastic ships out-of-the-box prebuilt rules that you can install.

[natasha-moore-elastic]

I think we might be missing a step between 1 and 2. Step 1 said to scroll down to the Configure rules and alerts section on the Get Started page, but step 2 seems to be describing the Rules page.

[natasha-moore-elastic]

Suggested change

	In this guide below, you’ll learn how to use {{elastic-sec}} to protect your hosts from malware, ransomware, and other threats.
	In this guide, you’ll learn how to use {{elastic-sec}} to protect your hosts from malware, ransomware, and other threats.

[natasha-moore-elastic]

Suggested change

	3. Give the Elastic Defend integration a name and optional description.
	3. Give the {{elastic-defend}} integration a name and optional description.

[natasha-moore-elastic]

Suggested change

	5. (Optional) Return to the **Add agen**t flyout, and observe the **Confirm agent enrollment** and **Confirm incoming data** steps automatically checking the host connection. It may take a few minutes for data to arrive in {{es}}.
	5. (Optional) Return to the **Add agent** flyout, and observe the **Confirm agent enrollment** and **Confirm incoming data** steps automatically checking the host connection. It may take a few minutes for data to arrive in {{es}}.

[natasha-moore-elastic]

Suggested change

	After you install the {{agent}} with {{elastic-defend}}, several endpoint protections — such as preventions against malware, ransomware, memory threats, and other malicious behavior are automatically enabled on protected hosts. However, you can update the policy configuration to meet your organization’s security needs.
	After you install the {{agent}} with {{elastic-defend}}, several endpoint protections—such as preventions against malware, ransomware, memory threats, and other malicious behavior are automatically enabled on protected hosts. However, you can update the policy configuration to meet your organization’s security needs.

[natasha-moore-elastic]

Just checking if all of these steps are meant to be prerequisites?