Big update. Adds four new pages, two new images, and makes minor upda…

…tes to existing pages.

docs/assistant/ai-alert-triage.asciidoc

@@ -1,5 +1,5 @@
 [[assistant-triage]]
-= Triage alerts with Elastic AI Assistant
+= Triage alerts with AI Assistant
 Elastic AI Assistant can help you enhance and streamline your alert triage workflows by assessing multiple recent alerts in your environment, and helping you interpret an alert and its context. 
 
 When you view an alert in {elastic-sec}, details such as related documents, hosts, and users appear alongside a synopsis of the events that triggered the alert. This data provides a starting point for understanding a potential threat. AI Assistant can answer questions about this data and offer insights and actionable recommendations to remediate the issue.

docs/assistant/ai-esql-queries.asciidoc

@@ -0,0 +1,29 @@
+[[esql-queries-assistant]]
+= Generate, customize, and learn about {esql} queries with AI Assistant
+
+:frontmatter-description: Elastic AI Assistant can help you write ES|QL queries.
+:frontmatter-tags-products: [security]
+:frontmatter-tags-content-type: [guide]
+:frontmatter-tags-user-goals: [get-started]
+
+This page describes some of the ways Elastic AI Assistant can help you leverage the Elasticsearch Query Language, {esql}. 
+
+With AI Assistant's {esql} knowledge base enabled, it benefits from specialized training data that enables it to answer questions related to {esql} at an expert level. 
+
+IMPORTANT: To enable AI Assistant's {esql} query capabilities, follow the <<ai-assistant-knowledge-base, setup instructions>>. 
+
+AI Assistant can help with {esql} in many ways, including:
+
+* **Education and training**: AI Assistant can serve as a powerful {esql} learning tool. Ask it for examples, explanations of complex queries, and best practices.
+* **Writing new queries**: Prompt AI Assistant to provide a query that accomplishes a particular task, and it will generate a query matching your description. For example: `Write a query to identify documents with curl.exe usage and calculate the sum of destination.bytes` or `What query would return all user logins to [a host] in the last six hours?`
+* **Providing feedback on existing queries**: To prompt AI Assistant to make changes to, refactor, or assess an existing query, provide it with the query you want to work on and ask it for improvements.
+* **Optimizing query performance**: AI Assistant can help optimize query performance to support the analysis of large data sets.
+* **Customizing queries for your environment**: Since each environment is unique, you may need to customize queries from other contexts. AI Assistant can suggest necessary modifications based on contextual information you provide. 
+* **Troubleshooting**: Having trouble with a query or getting unexpected results? Ask AI Assistant to help you troubleshoot.
+
+In these ways and others, AI Assistant can enable you to make use of {esql}'s advanced search capabilities to accomplish goals across {elastic-sec}. 
+
+[discrete]
+== Related documentation
+Get started with <<security-assistant, AI Assistant>>, or learn more about {ref}/esql-kibana.html[{esql}].
+

docs/assistant/assistant-use-cases.asciidoc

@@ -0,0 +1,10 @@
+[[assistant-use-cases]]
+= AI Assistant use cases
+
+Elastic AI Assistant's flexibility means you can use it for many different purposes. This section describes several possible uses for AI Assistant within {elastic-sec}:
+
+* <<attack-discovery-ai-assistant-incident-reporting>>
+* <<assistant-triage>>
+* <<esql-queries-assistant>>
+
+For general information about AI Assistant, refer to <<security-assistant, AI Assistant>>.

docs/assistant/llm-connector-guides.asciidoc

@@ -0,0 +1,11 @@
+[[llm-connector-guides]]
+= Large language model (LLM) connector setup guides
+
+This section contains instructions for setting up LLM connectors in {elastic-sec}. Setting up this type of connector enables you to use <<security-assistant, Elastic AI Assistant>> and <<attack-discovery, Attack discovery>>. 
+
+Setup guides are available for the following LLM providers:
+
+* <<assistant-connect-to-azure-openai, Azure OpenAI>>
+* <<assistant-connect-to-bedrock, Amazon Bedrock>>
+* <<assistant-connect-to-openai, OpenAI>>
+

docs/assistant/security-assistant.asciidoc

@@ -8,7 +8,7 @@
 
 The Elastic AI Assistant utilizes generative AI to bolster your cybersecurity operations team. It allows users to interact with {elastic-sec} for tasks such as alert investigation, incident response, and query generation or conversion using natural language and much more.
 
-AI Assistant can connect to multiple LLM providers so you can select the best model for your needs.
+AI Assistant can connect to multiple large language model (LLM) providers so you can select the best model for your needs. For information about setting up a connector, refer to <<llm-connector-guides,LLM connector setup guides>>
 
 [role="screenshot"]
 image::images/assistant-basic-view.png[Image of AI Assistant chat window,90%]
@@ -193,8 +193,14 @@ In addition to practical advice, AI Assistant can offer conceptual advice, tips,
 * “I need to monitor for unusual file creation patterns that could indicate ransomware activity. How would I construct this query using EQL?”
 
 
-include::ai-alert-triage.asciidoc[leveloffset=+1]
 include::llm-performance-matrix.asciidoc[leveloffset=+1]
-include::azure-openai-setup.asciidoc[leveloffset=+1]
-include::connect-to-openai.asciidoc[leveloffset=+1]
-include::connect-to-bedrock.asciidoc[leveloffset=+1]
+
+include::assistant-use-cases.asciidoc[leveloffset=+1]
+include::ai-alert-triage.asciidoc[leveloffset=+2]
+include::use-attack-discovery-ai-assistant-incident-reporting.asciidoc[leveloffset=+2]
+include::ai-esql-queries.asciidoc[leveloffset=+2]
+
+include::llm-connector-guides.asciidoc[leveloffset=+1]
+include::azure-openai-setup.asciidoc[leveloffset=+2]
+include::connect-to-openai.asciidoc[leveloffset=+2]
+include::connect-to-bedrock.asciidoc[leveloffset=+2]

docs/assistant/use-attack-discovery-ai-assistant-incident-reporting.asciidoc

@@ -0,0 +1,64 @@
+[[attack-discovery-ai-assistant-incident-reporting]]
+= Identify, investigate, and document threats with AI Assistant
+
+:frontmatter-description: Elastic AI Assistant can help you write ES|QL queries.
+:frontmatter-tags-products: [security]
+:frontmatter-tags-content-type: [guide]
+:frontmatter-tags-user-goals: [get-started]
+
+Together, <<security-assistant, Elastic AI Assistant>> and <<attack-discovery,Attack discovery>> can help you address and mitigate threats, investigate incidents, and generate incident reports in various languages. These tools can make it easier to monitor, analyze, and document security threats.
+
+This guide describes how you can:
+. <<use-case-incident-reporting-use-attack-discovery-to-identify-threats, Use Attack discovery to identify threats>>
+. <<use-case-incident-reporting-use-ai-assistant-to-analyze-a-threat, Use AI Assistant to analyze a threat>>
+. <<use-case-incident-reporting-create-a-case-using-ai-assistant,Create a case using AI Assistant>>
+. <<use-case-incident-reporting-translate,Translate incident information to a different human language using AI Assistant>>
+
+
+[discrete]
+[[use-case-incident-reporting-use-attack-discovery-to-identify-threats]]
+== Use Attack discovery to identify threats
+Attack discovery can detect a wide range of threats by finding relationships among alerts that may indicate a coordinated attack. This enables you to comprehend how threats move through and affect your systems. Attack discovery generates detailed overviews of potential threats, which can serve as foundations for further analysis. <<attack-discovery,Learn how to get started with Attack discovery>>.
+
+image::images/attck-disc-11-alerts-disc.png[An Attack discovery card showing an attack with 11 related alerts,90%]
+
+In the screenshot above, Attack discovery found connections between eleven alerts, and used them to identify and describe an attack chain.
+
+After Attack discovery outlines your threat landscape, Elastic AI Assistant can help you quickly explore a threat in detail. 
+
+[discrete]
+[[use-case-incident-reporting-use-ai-assistant-to-analyze-a-threat]]
+== Use AI Assistant to analyze a threat
+
+From a discovery on the Attack discovery page, you can click **View in AI Assistant** to start a chat that includes the discovery as context. 
+
+AI Assistant can quickly compile and present key data and provide suggestions to help you generate an incident report and plan an effective response. You can prompt AI Assistant to supply relevant data or suggestions with questions like “How can I remediate this threat?” or “What ES|QL query would isolate actions taken by this user?” 
+
+image::images/attck-disc-esql-query-gen-example.png[An AI Assistant dialogue in which the user asks for a purpose-built {esql} query,90%]
+
+The screenshot above shows an {esql} query generated by AI Assistant in response to a user prompt. <<esql-queries-assistant,Learn more about using AI Assistant for {esql}>>.
+
+You can add the information and insights provided by Attack discovery and AI Assistant to {elastic-sec}'s case management system to help quickly generate incident reports. 
+
+[discrete]
+[[use-case-incident-reporting-create-a-case-using-ai-assistant]]
+== Create a case using AI Assistant
+
+From the AI Assistant dialogue, click **Add to case** (image:images/icon-add-to-case.png[Add to case icon,19,16]) next to a message to add the information in that message to a case. If you add a message with an Attack discovery to a case, AI Assistant automatically adds the attack summary and all associated alerts to the case. You can also add AI Assistant messages containing remediation steps and relevant data to the case. 
+
+Cases help centralize relevant details in one place for easy sharing with stakeholders. <<cases-overview, Learn more about Cases>>. 
+
+[discrete]
+[[use-case-incident-reporting-translate]]
+== Translate incident information to a different human language using AI Assistant
+AI Assistant can translate its findings into other human languages, helping to enable collaboration within global security teams and distributed Security Operations Centers (SOCs), and making it easier to operate in multilingual organizations. 
+
+After AI Assistant provides information in one language, you can ask it to translate its responses. For example, if it provides you remediation steps for an incident, you can instruct it to “Translate these remediation steps into Japanese.” You can then add the translated output to a case. This can help all team members, regardless of their primary language, receive the same detailed information and insights.
+
+In our internal testing, AI Assistant translations preserved the accuracy and utility of the original content. 
+
+
+[discrete]
+== Related documentation
+
+Learn about <<