diff --git a/docs/siem/images/detections-ui.png b/docs/siem/images/detections-ui.png new file mode 100644 index 00000000000000..3139ffea0767d8 Binary files /dev/null and b/docs/siem/images/detections-ui.png differ diff --git a/docs/siem/images/hosts-ui.png b/docs/siem/images/hosts-ui.png index 2569df8f419b8d..be9fd29246b51d 100644 Binary files a/docs/siem/images/hosts-ui.png and b/docs/siem/images/hosts-ui.png differ diff --git a/docs/siem/images/network-ui.png b/docs/siem/images/network-ui.png index 406ac854cd0a25..de8ce89273a022 100644 Binary files a/docs/siem/images/network-ui.png and b/docs/siem/images/network-ui.png differ diff --git a/docs/siem/images/overview-ui.png b/docs/siem/images/overview-ui.png index a34b2fea061c99..6ac02104d6123e 100644 Binary files a/docs/siem/images/overview-ui.png and b/docs/siem/images/overview-ui.png differ diff --git a/docs/siem/siem-ui.asciidoc b/docs/siem/siem-ui.asciidoc index 7294cfbc414f49..f01575a21b9f67 100644 --- a/docs/siem/siem-ui.asciidoc +++ b/docs/siem/siem-ui.asciidoc @@ -33,6 +33,23 @@ investigation. [role="screenshot"] image::siem/images/network-ui.png[] +[float] +[[detections-ui]] +=== Detections + +The Detections feature automatically searches for threats and creates +signals when they are detected. Signal detection rules define the conditions +for creating signals. The SIEM app comes with prebuilt rules that search for +suspicious activity on your network and hosts. Additionally, you can +create your own rules. + +See {siem-guide}/detection-engine-overview.html[Detections] in the SIEM +Guide for information on managing detection rules and signals via the UI +or the Detections API. + +[role="screenshot"] +image::siem/images/detections-ui.png[] + [float] [[timelines-ui]] === Timeline