Updated docs

Author: Buildkite CI

html/branches.yaml

@@ -7744,7 +7744,7 @@ kibana:
   link-check-kibana/packages/kbn-doc-links/src/get_doc_links.ts/8.7: 1ef406535eec5cf8d8e5daa13078fd8088981129
   link-check-kibana/packages/kbn-doc-links/src/get_doc_links.ts/8.8: d6e2f1a2f7ea63982d037a589c930db77b32e3db
   link-check-kibana/packages/kbn-doc-links/src/get_doc_links.ts/8.9: 3d21f90217ee79ce0abdd7455a3f85cbd6caf393
-  link-check-kibana/packages/kbn-doc-links/src/get_doc_links.ts/main: 33cf6ab5c41ea821292671b424968f4e7fde695f
+  link-check-kibana/packages/kbn-doc-links/src/get_doc_links.ts/main: 913b494d187574a3606e9a4fc8c9cf4ec33cec47
   link-check-kibana/src/core/public/doc_links/doc_links_service.ts/7.13: 31f366f46a7afb1eccef6f5c0e66d78f59dc4c23
   link-check-kibana/src/core/public/doc_links/doc_links_service.ts/7.14: 92e0f9d9b53a5465cd29895e00c770946718583a
   link-check-kibana/src/core/public/doc_links/doc_links_service.ts/7.15: 051a78852f52d43bcb7d8d943b369b9098eada85
@@ -8064,7 +8064,7 @@ security-docs:
   Elastic Security/docs/8.10: 3fca3d6cbe2c11ab1486af95a22994d4c031d45d
   Elastic Security/docs/8.11: 1ca90de5a96408aeac4f9b0d8836fe89e36d449c
   Elastic Security/docs/8.12: d8fb8771d94399bff97b17d2115982c306a9ff65
-  Elastic Security/docs/8.13: ada8de7970e0998a5d48fec3975300cb52271288
+  Elastic Security/docs/8.13: 26e024ac49009bf2acf036b94b57dd2adb702001
   Elastic Security/docs/8.14: bb18a7ccb49cb78d8217cef209f017620e839621
   Elastic Security/docs/8.2: 208edbfcc412504c88a3342a669f337a843d4dc0
   Elastic Security/docs/8.3: 61162a2f80b0b0616a20cd0a8d22d02702885f82

html/en/security/8.13/abnormal-process-id-or-lock-file-created.html

@@ -196,7 +196,7 @@ <h2 class="title"><a id="abnormal-process-id-or-lock-file-created"></a>Abnormal
 <p><span class="strong strong"><strong>Rule license</strong></span>: Elastic License v2</p>
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_investigation_guide_57"></a>Investigation guide<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/abnormal-process-id-or-lock-file-created.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_investigation_guide_58"></a>Investigation guide<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/abnormal-process-id-or-lock-file-created.asciidoc">edit</a></h3>
 </div></div></div>
 <p><span class="strong strong"><strong>Triage and analysis</strong></span></p>
 <p><span class="strong strong"><strong>Investigating Abnormal Process ID or Lock File Created</strong></span></p>
@@ -285,7 +285,7 @@ <h3 class="title"><a id="_investigation_guide_57"></a>Investigation guide<a clas
 
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_setup_59"></a>Setup<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/abnormal-process-id-or-lock-file-created.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_setup_60"></a>Setup<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/abnormal-process-id-or-lock-file-created.asciidoc">edit</a></h3>
 </div></div></div>
 <p><span class="strong strong"><strong>Setup</strong></span></p>
 <p>This rule requires data coming in from Elastic Defend.</p>
@@ -343,7 +343,7 @@ <h3 class="title"><a id="_setup_59"></a>Setup<a class="edit_me" rel="nofollow" t
 
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_rule_query_64"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/abnormal-process-id-or-lock-file-created.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_rule_query_65"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/abnormal-process-id-or-lock-file-created.asciidoc">edit</a></h3>
 </div></div></div>
 <div class="pre_wrapper lang-js">
 <div class="console_code_copy" title="Copy to clipboard"></div>

html/en/security/8.13/abnormally-large-dns-response.html

@@ -187,7 +187,7 @@ <h2 class="title"><a id="abnormally-large-dns-response"></a>Abnormally Large DNS
 <p><span class="strong strong"><strong>Rule license</strong></span>: Elastic License v2</p>
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_investigation_guide_58"></a>Investigation guide<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/abnormally-large-dns-response.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_investigation_guide_59"></a>Investigation guide<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/abnormally-large-dns-response.asciidoc">edit</a></h3>
 </div></div></div>
 <p><span class="strong strong"><strong>Triage and analysis</strong></span></p>
 <p><span class="strong strong"><strong>Investigating Abnormally Large DNS Response</strong></span></p>
@@ -258,7 +258,7 @@ <h3 class="title"><a id="_investigation_guide_58"></a>Investigation guide<a clas
 
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_rule_query_65"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/abnormally-large-dns-response.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_rule_query_66"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/abnormally-large-dns-response.asciidoc">edit</a></h3>
 </div></div></div>
 <div class="pre_wrapper lang-js">
 <div class="console_code_copy" title="Copy to clipboard"></div>

html/en/security/8.13/accepted-default-telnet-port-connection.html

@@ -177,7 +177,7 @@ <h2 class="title"><a id="accepted-default-telnet-port-connection"></a>Accepted D
 <p><span class="strong strong"><strong>Rule license</strong></span>: Elastic License v2</p>
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_rule_query_66"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/accepted-default-telnet-port-connection.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_rule_query_67"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/accepted-default-telnet-port-connection.asciidoc">edit</a></h3>
 </div></div></div>
 <div class="pre_wrapper lang-js">
 <div class="console_code_copy" title="Copy to clipboard"></div>

html/en/security/8.13/access-to-a-sensitive-ldap-attribute.html

@@ -193,7 +193,7 @@ <h2 class="title"><a id="access-to-a-sensitive-ldap-attribute"></a>Access to a S
 <p><span class="strong strong"><strong>Rule license</strong></span>: Elastic License v2</p>
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_setup_61"></a>Setup<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/access-to-a-sensitive-ldap-attribute.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_setup_62"></a>Setup<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/access-to-a-sensitive-ldap-attribute.asciidoc">edit</a></h3>
 </div></div></div>
 <p><span class="strong strong"><strong>Setup</strong></span></p>
 <p>The <em>Audit Directory Service Access</em> logging policy must be configured for (Success, Failure).
@@ -210,7 +210,7 @@ <h3 class="title"><a id="_setup_61"></a>Setup<a class="edit_me" rel="nofollow" t
 
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_rule_query_68"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/access-to-a-sensitive-ldap-attribute.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_rule_query_69"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/access-to-a-sensitive-ldap-attribute.asciidoc">edit</a></h3>
 </div></div></div>
 <div class="pre_wrapper lang-js">
 <div class="console_code_copy" title="Copy to clipboard"></div>

html/en/security/8.13/access-to-keychain-credentials-directories.html

@@ -178,7 +178,7 @@ <h2 class="title"><a id="access-to-keychain-credentials-directories"></a>Access
 <p><span class="strong strong"><strong>Rule license</strong></span>: Elastic License v2</p>
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_setup_60"></a>Setup<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_setup_61"></a>Setup<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc">edit</a></h3>
 </div></div></div>
 <p><span class="strong strong"><strong>Setup</strong></span></p>
 <p>This rule requires data coming in from Elastic Defend.</p>
@@ -236,7 +236,7 @@ <h3 class="title"><a id="_setup_60"></a>Setup<a class="edit_me" rel="nofollow" t
 
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_rule_query_67"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_rule_query_68"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc">edit</a></h3>
 </div></div></div>
 <div class="pre_wrapper lang-js">
 <div class="console_code_copy" title="Copy to clipboard"></div>

html/en/security/8.13/accessing-outlook-data-files.html

@@ -171,7 +171,7 @@ <h2 class="title"><a id="accessing-outlook-data-files"></a>Accessing Outlook Dat
 <p><span class="strong strong"><strong>Rule license</strong></span>: Elastic License v2</p>
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_rule_query_69"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/accessing-outlook-data-files.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_rule_query_70"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/accessing-outlook-data-files.asciidoc">edit</a></h3>
 </div></div></div>
 <div class="pre_wrapper lang-js">
 <div class="console_code_copy" title="Copy to clipboard"></div>

html/en/security/8.13/account-configured-with-never-expiring-password.html

@@ -190,7 +190,7 @@ <h2 class="title"><a id="account-configured-with-never-expiring-password"></a>Ac
 <p><span class="strong strong"><strong>Rule license</strong></span>: Elastic License v2</p>
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_investigation_guide_59"></a>Investigation guide<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_investigation_guide_60"></a>Investigation guide<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc">edit</a></h3>
 </div></div></div>
 <p><span class="strong strong"><strong>Triage and analysis</strong></span></p>
 <p><span class="strong strong"><strong>Investigating Account Configured with Never-Expiring Password</strong></span></p>
@@ -257,7 +257,7 @@ <h3 class="title"><a id="_investigation_guide_59"></a>Investigation guide<a clas
 
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_rule_query_70"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_rule_query_71"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc">edit</a></h3>
 </div></div></div>
 <div class="pre_wrapper lang-js">
 <div class="console_code_copy" title="Copy to clipboard"></div>

html/en/security/8.13/account-discovery-command-via-system-account.html

@@ -183,7 +183,7 @@ <h2 class="title"><a id="account-discovery-command-via-system-account"></a>Accou
 <p><span class="strong strong"><strong>Rule license</strong></span>: Elastic License v2</p>
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_investigation_guide_60"></a>Investigation guide<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_investigation_guide_61"></a>Investigation guide<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc">edit</a></h3>
 </div></div></div>
 <p><span class="strong strong"><strong>Triage and analysis</strong></span></p>
 <p><span class="strong strong"><strong>Investigating Account Discovery Command via SYSTEM Account</strong></span></p>
@@ -244,7 +244,7 @@ <h3 class="title"><a id="_investigation_guide_60"></a>Investigation guide<a clas
 
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_setup_62"></a>Setup<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_setup_63"></a>Setup<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc">edit</a></h3>
 </div></div></div>
 <p><span class="strong strong"><strong>Setup</strong></span></p>
 <p>If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions &lt;8.2,
@@ -256,7 +256,7 @@ <h3 class="title"><a id="_setup_62"></a>Setup<a class="edit_me" rel="nofollow" t
 
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_rule_query_71"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_rule_query_72"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc">edit</a></h3>
 </div></div></div>
 <div class="pre_wrapper lang-js">
 <div class="console_code_copy" title="Copy to clipboard"></div>

html/en/security/8.13/account-or-group-discovery-via-built-in-tools.html

@@ -189,7 +189,7 @@ <h2 class="title"><a id="account-or-group-discovery-via-built-in-tools"></a>Acco
 <p><span class="strong strong"><strong>Rule license</strong></span>: Elastic License v2</p>
 <div class="section">
 <div class="titlepage"><div><div>
-<h3 class="title"><a id="_rule_query_73"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/account-or-group-discovery-via-built-in-tools.asciidoc">edit</a></h3>
+<h3 class="title"><a id="_rule_query_74"></a>Rule query<a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/security-docs/edit/8.13/docs/detections/prebuilt-rules/rule-details/account-or-group-discovery-via-built-in-tools.asciidoc">edit</a></h3>
 </div></div></div>
 <div class="pre_wrapper lang-js">
 <div class="console_code_copy" title="Copy to clipboard"></div>