From c5aa1580faf7ed3bf284b8a18659acd242acc9ca Mon Sep 17 00:00:00 2001
From: protectionsmachine
 <72879786+protectionsmachine@users.noreply.github.com>
Date: Fri, 23 Feb 2024 22:08:44 +0000
Subject: [PATCH 1/2] Update latest docs

---
 ...tempt-to-clear-kernel-ring-buffer.asciidoc | 112 +++++++++
 ...t-to-disable-iptables-or-firewall.asciidoc | 115 ++++++++++
 ...base32-encoding-decoding-activity.asciidoc | 120 ++++++++++
 ...s-and-directories-via-commandline.asciidoc | 126 ++++++++++
 ...tion-of-hidden-shared-object-file.asciidoc | 123 ++++++++++
 ...-timestomping-using-touch-command.asciidoc | 106 +++++++++
 ...ble-media-with-network-connection.asciidoc |  67 ++++++
 ...le-8-12-5-file-deletion-via-shred.asciidoc | 102 ++++++++
 ...odification-in-writable-directory.asciidoc | 112 +++++++++
 ...seen-newcredentials-logon-process.asciidoc |  66 ++++++
 ...ctive-logon-by-an-unusual-process.asciidoc |  95 ++++++++
 ...rnel-driver-load-by-non-root-user.asciidoc | 108 +++++++++
 ...rule-8-12-5-kernel-module-removal.asciidoc | 116 ++++++++++
 ...ux-init-pid-1-secret-dump-via-gdb.asciidoc | 104 +++++++++
 ...network-activity-detected-via-cat.asciidoc | 181 +++++++++++++++
 ...tential-defense-evasion-via-proot.asciidoc |  98 ++++++++
 ...5-potential-disabling-of-apparmor.asciidoc | 107 +++++++++
 ...-5-potential-disabling-of-selinux.asciidoc | 120 ++++++++++
 ...-hidden-process-via-mount-hidepid.asciidoc | 102 ++++++++
 ...ntial-dumping-via-proc-filesystem.asciidoc | 110 +++++++++
 ...x-credential-dumping-via-unshadow.asciidoc | 103 +++++++++
 ...ocal-account-brute-force-detected.asciidoc | 104 +++++++++
 ...-tunneling-and-or-port-forwarding.asciidoc | 193 ++++++++++++++++
 ...erading-as-business-app-installer.asciidoc | 217 ++++++++++++++++++
 ...tential-meterpreter-reverse-shell.asciidoc | 129 +++++++++++
 ...-pspy-process-monitoring-detected.asciidoc | 101 ++++++++
 ...remote-file-execution-via-msiexec.asciidoc | 106 +++++++++
 ...5-potential-reverse-shell-via-udp.asciidoc | 139 +++++++++++
 ...x-ftp-brute-force-attack-detected.asciidoc | 123 ++++++++++
 ...x-rdp-brute-force-attack-detected.asciidoc | 121 ++++++++++
 ...cap-chown-cap-fowner-capabilities.asciidoc | 108 +++++++++
 ...s-created-with-a-duplicated-token.asciidoc |  95 ++++++++
 ...mote-xsl-script-execution-via-com.asciidoc |  83 +++++++
 ...us-antimalware-scan-interface-dll.asciidoc | 141 ++++++++++++
 ...picious-execution-from-inet-cache.asciidoc |  82 +++++++
 ...spicious-passwd-file-event-action.asciidoc | 127 ++++++++++
 ...-utility-launched-via-proxychains.asciidoc | 183 +++++++++++++++
 ...-or-moved-to-suspicious-directory.asciidoc | 128 +++++++++++
 .../prebuilt-rules-8-12-5-appendix.asciidoc   |  44 ++++
 .../prebuilt-rules-8-12-5-summary.asciidoc    |  88 +++++++
 ...ebuilt-rules-downloadable-updates.asciidoc |   5 +
 .../prebuilt-rules-reference.asciidoc         | 128 ++++++-----
 .../prebuilt-rules/rule-desc-index.asciidoc   |   1 +
 ...l-process-id-or-lock-file-created.asciidoc |  58 ++++-
 .../abnormally-large-dns-response.asciidoc    |  35 +--
 ...ess-of-stored-browser-credentials.asciidoc |  35 +++
 ...ess-to-a-sensitive-ldap-attribute.asciidoc |  19 ++
 ...-keychain-credentials-directories.asciidoc |  35 +++
 ...ured-with-never-expiring-password.asciidoc |  25 +-
 ...covery-command-via-system-account.asciidoc |  34 ++-
 .../account-password-reset-remotely.asciidoc  |   3 -
 ...-hidden-file-attribute-via-attrib.asciidoc |  25 +-
 .../adfind-command-activity.asciidoc          |  40 +++-
 ...vileges-assigned-to-an-okta-group.asciidoc |   8 +-
 ...tor-role-assigned-to-an-okta-user.asciidoc |   8 +-
 ...insdholder-sdprop-exclusion-added.asciidoc |  48 +++-
 .../adobe-hijack-persistence.asciidoc         |  36 ++-
 ...us-process-for-a-linux-population.asciidoc |  23 +-
 ...-process-for-a-windows-population.asciidoc |  29 ++-
 ...nomalous-windows-process-creation.asciidoc |  29 ++-
 ...on-followed-by-network-connection.asciidoc |  35 +++
 ...ion-with-administrator-privileges.asciidoc |  35 +++
 ...-added-to-google-workspace-domain.asciidoc |  34 ++-
 ...rom-blocklist-in-google-workspace.asciidoc |  34 ++-
 ...tempt-to-clear-kernel-ring-buffer.asciidoc |  46 +++-
 .../attempt-to-create-okta-api-token.asciidoc |   8 +-
 ...to-deactivate-an-okta-application.asciidoc |  28 ++-
 ...o-deactivate-an-okta-network-zone.asciidoc |  28 ++-
 ...to-deactivate-an-okta-policy-rule.asciidoc |  30 ++-
 ...empt-to-deactivate-an-okta-policy.asciidoc |  30 ++-
 ...mpt-to-delete-an-okta-application.asciidoc |   8 +-
 ...pt-to-delete-an-okta-network-zone.asciidoc |  28 ++-
 ...mpt-to-delete-an-okta-policy-rule.asciidoc |  30 ++-
 .../attempt-to-delete-an-okta-policy.asciidoc |  30 ++-
 .../attempt-to-disable-gatekeeper.asciidoc    |  35 +++
 ...t-to-disable-iptables-or-firewall.asciidoc |  41 +++-
 ...attempt-to-disable-syslog-service.asciidoc |  51 ++++
 ...ttempt-to-enable-the-root-account.asciidoc |  35 +++
 ...tempt-to-install-root-certificate.asciidoc |  35 +++
 ...mpt-to-modify-an-okta-application.asciidoc |   8 +-
 ...pt-to-modify-an-okta-network-zone.asciidoc |  30 ++-
 ...mpt-to-modify-an-okta-policy-rule.asciidoc |  30 ++-
 .../attempt-to-modify-an-okta-policy.asciidoc |  28 ++-
 ...-mount-smb-share-via-command-line.asciidoc |  35 +++
 ...-remove-file-quarantine-attribute.asciidoc |  35 +++
 ...-factors-for-an-okta-user-account.asciidoc |   8 +-
 .../attempt-to-revoke-okta-api-token.asciidoc |  28 ++-
 ...ndpoint-security-kernel-extension.asciidoc |  35 +++
 .../attempted-bypass-of-okta-mfa.asciidoc     |  30 ++-
 ...orce-a-microsoft-365-user-account.asciidoc |   8 +-
 ...-brute-force-an-okta-user-account.asciidoc |  28 ++-
 ...authorization-plugin-modification.asciidoc |  35 +++
 .../aws-cloudtrail-log-created.asciidoc       |   8 +-
 .../aws-cloudtrail-log-deleted.asciidoc       |  30 ++-
 .../aws-cloudtrail-log-suspended.asciidoc     |  30 ++-
 .../aws-cloudtrail-log-updated.asciidoc       |  30 ++-
 .../aws-cloudwatch-alarm-deletion.asciidoc    |  30 ++-
 ...aws-cloudwatch-log-group-deletion.asciidoc |  30 ++-
 ...ws-cloudwatch-log-stream-deletion.asciidoc |  30 ++-
 .../aws-config-resource-deletion.asciidoc     |  30 ++-
 ...ws-configuration-recorder-stopped.asciidoc |   8 +-
 ...letion-of-rds-instance-or-cluster.asciidoc |   8 +-
 .../aws-ec2-encryption-disabled.asciidoc      |   8 +-
 ...l-network-packet-capture-detected.asciidoc |   8 +-
 ...work-access-control-list-creation.asciidoc |   8 +-
 ...work-access-control-list-deletion.asciidoc |   8 +-
 .../aws-ec2-snapshot-activity.asciidoc        |  30 ++-
 .../aws-ec2-vm-export-failure.asciidoc        |   8 +-
 ...-efs-file-system-or-mount-deleted.asciidoc |   8 +-
 ...lasticache-security-group-created.asciidoc |   8 +-
 ...ecurity-group-modified-or-deleted.asciidoc |   8 +-
 ...ntbridge-rule-disabled-or-deleted.asciidoc |   8 +-
 .../aws-execution-via-system-manager.asciidoc |  30 ++-
 .../aws-guardduty-detector-deletion.asciidoc  |   8 +-
 ...aws-iam-assume-role-policy-update.asciidoc |  32 ++-
 ...brute-force-of-assume-role-policy.asciidoc |  30 ++-
 ...ws-iam-deactivation-of-mfa-device.asciidoc |  32 ++-
 .../aws-iam-group-creation.asciidoc           |   8 +-
 .../aws-iam-group-deletion.asciidoc           |   8 +-
 ...s-iam-password-recovery-requested.asciidoc |   8 +-
 .../aws-iam-user-addition-to-group.asciidoc   |  30 ++-
 ...isabled-or-scheduled-for-deletion.asciidoc |   8 +-
 ...brute-force-of-root-user-identity.asciidoc |   8 +-
 ...aws-management-console-root-login.asciidoc |  32 ++-
 .../aws-rds-cluster-creation.asciidoc         |   8 +-
 ...aws-rds-instance-cluster-stoppage.asciidoc |   8 +-
 .../aws-rds-instance-creation.asciidoc        |   8 +-
 .../aws-rds-security-group-creation.asciidoc  |   8 +-
 .../aws-rds-security-group-deletion.asciidoc  |   8 +-
 .../aws-rds-snapshot-export.asciidoc          |   8 +-
 .../aws-rds-snapshot-restored.asciidoc        |   8 +-
 .../aws-redshift-cluster-creation.asciidoc    |   8 +-
 .../aws-root-login-without-mfa.asciidoc       |  34 ++-
 ...-53-domain-transfer-lock-disabled.asciidoc |   8 +-
 ...in-transferred-to-another-account.asciidoc |   8 +-
 .../aws-route-table-created.asciidoc          |   8 +-
 ...s-route-table-modified-or-deleted.asciidoc |   8 +-
 ...hosted-zone-associated-with-a-vpc.asciidoc |   8 +-
 ...-s3-bucket-configuration-deletion.asciidoc |   8 +-
 .../rule-details/aws-saml-activity.asciidoc   |   8 +-
 ...up-configuration-change-detection.asciidoc |   8 +-
 ...oken-service-sts-assumerole-usage.asciidoc |   8 +-
 .../aws-sts-getsessiontoken-abuse.asciidoc    |   8 +-
 .../aws-vpc-flow-logs-deletion.asciidoc       |  30 ++-
 ...-waf-access-control-list-deletion.asciidoc |   8 +-
 ...s-waf-rule-or-rule-group-deletion.asciidoc |   8 +-
 ...ctive-directory-high-risk-sign-in.asciidoc |  35 ++-
 ...-high-risk-user-sign-in-heuristic.asciidoc |  32 ++-
 ...tive-directory-powershell-sign-in.asciidoc |  30 ++-
 ...lobal-administrator-role-assigned.asciidoc |   8 +-
 ...pression-rule-created-or-modified.asciidoc |   8 +-
 ...plication-credential-modification.asciidoc |   8 +-
 .../azure-automation-account-created.asciidoc |   8 +-
 ...ation-runbook-created-or-modified.asciidoc |   8 +-
 .../azure-automation-runbook-deleted.asciidoc |   8 +-
 .../azure-automation-webhook-created.asciidoc |   8 +-
 ...ntainer-access-level-modification.asciidoc |   8 +-
 ...ure-blob-permissions-modification.asciidoc |   8 +-
 ...mand-execution-on-virtual-machine.asciidoc |   8 +-
 ...onditional-access-policy-modified.asciidoc |   8 +-
 ...zure-diagnostic-settings-deletion.asciidoc |   8 +-
 ...orization-rule-created-or-updated.asciidoc |   8 +-
 .../azure-event-hub-deletion.asciidoc         |   8 +-
 ...re-external-guest-user-invitation.asciidoc |   8 +-
 .../azure-firewall-policy-deletion.asciidoc   |   8 +-
 ...ation-firewall-waf-policy-deleted.asciidoc |   8 +-
 ...l-network-packet-capture-detected.asciidoc |   8 +-
 ...strator-role-addition-to-pim-user.asciidoc |   8 +-
 .../azure-key-vault-modified.asciidoc         |   8 +-
 .../azure-kubernetes-events-deleted.asciidoc  |   8 +-
 .../azure-kubernetes-pods-deleted.asciidoc    |   8 +-
 ...e-kubernetes-rolebindings-created.asciidoc |   8 +-
 .../azure-network-watcher-deletion.asciidoc   |   8 +-
 ...identity-management-role-modified.asciidoc |  30 ++-
 .../azure-resource-group-deletion.asciidoc    |   8 +-
 .../azure-service-principal-addition.asciidoc |  30 ++-
 ...rvice-principal-credentials-added.asciidoc |   8 +-
 ...e-storage-account-key-regenerated.asciidoc |   8 +-
 ...etwork-device-modified-or-deleted.asciidoc |   8 +-
 ...base32-encoding-decoding-activity.asciidoc |  63 ++++-
 ...uted-from-shared-memory-directory.asciidoc |  35 +++
 .../bpf-filter-applied-using-tc.asciidoc      |  35 +++
 .../bypass-uac-via-event-viewer.asciidoc      |  38 ++-
 .../cap-sys-admin-assigned-to-binary.asciidoc |  35 +++
 .../chkconfig-service-add.asciidoc            |  66 +++++-
 .../clearing-windows-console-history.asciidoc |  34 ++-
 .../clearing-windows-event-logs.asciidoc      |  34 ++-
 ...strike-command-and-control-beacon.asciidoc |   7 +-
 ...dification-through-built-in-tools.asciidoc |  29 ++-
 ...icy-modification-through-registry.asciidoc |  29 ++-
 ...-execution-via-solarwinds-process.asciidoc |  11 +
 ...command-prompt-network-connection.asciidoc |  25 +-
 ...ell-activity-started-via-rundll32.asciidoc |  11 +
 .../component-object-model-hijacking.asciidoc |  34 ++-
 ...wned-by-suspicious-parent-process.asciidoc |  38 ++-
 ...ed-free-ssl-certificate-providers.asciidoc |  11 +
 ...n-to-commonly-abused-web-services.asciidoc |  27 ++-
 ...on-to-external-network-via-telnet.asciidoc |  51 ++++
 ...on-to-internal-network-via-telnet.asciidoc |  51 ++++
 ...el-process-with-unusual-arguments.asciidoc |  11 +
 ...on-of-a-hidden-local-user-account.asciidoc |  34 ++-
 ...s-and-directories-via-commandline.asciidoc |  61 ++++-
 ...-of-hidden-launch-agent-or-daemon.asciidoc |  35 +++
 ...idden-login-item-via-apple-script.asciidoc |  35 +++
 ...tion-of-hidden-shared-object-file.asciidoc |  61 ++++-
 ...eation-of-settingcontent-ms-files.asciidoc |   5 +-
 ...new-gpo-scheduled-task-or-service.asciidoc |  11 +
 ...f-domain-backup-dpapi-private-key.asciidoc |  18 +-
 ...-modification-of-root-certificate.asciidoc |  36 ++-
 ...isition-via-registry-hive-dumping.asciidoc |  38 ++-
 ...ged-by-previously-unknown-process.asciidoc |  66 +++++-
 ...-privileged-access-security-error.asciidoc |  12 +-
 ...cess-security-recommended-monitor.asciidoc |  12 +-
 ...lt-strike-team-server-certificate.asciidoc |   7 +-
 ...te-volume-usn-journal-with-fsutil.asciidoc |  23 +-
 ...ting-backup-catalogs-with-wbadmin.asciidoc |  38 ++-
 .../direct-outbound-smb-connection.asciidoc   |  25 +-
 ...ecurity-logs-using-built-in-tools.asciidoc |  34 ++-
 ...-windows-firewall-rules-via-netsh.asciidoc |  34 ++-
 ...control-via-registry-modification.asciidoc |  36 ++-
 ...-security-settings-via-powershell.asciidoc |  38 ++-
 ...t-capabilities-via-built-in-tools.asciidoc |   4 +-
 ...s-over-https-enabled-via-registry.asciidoc |  11 +
 ...-google-workspace-trusted-domains.asciidoc |  34 ++-
 ...ount-hashes-via-built-in-commands.asciidoc |  35 +++
 ...hain-content-via-security-command.asciidoc |  35 +++
 .../rule-details/dynamic-linker-copy.asciidoc |  66 +++++-
 .../elastic-agent-service-terminated.asciidoc |  11 +
 ...nd-rules-creation-or-modification.asciidoc |  35 +++
 ...-host-network-discovery-via-netsh.asciidoc |  34 ++-
 ...ncrypting-files-with-winrar-or-7z.asciidoc |  34 ++-
 ...ing-domain-trusts-via-dsquery-exe.asciidoc |  27 ++-
 ...ting-domain-trusts-via-nltest-exe.asciidoc |  27 ++-
 ...tion-command-spawned-via-wmiprvse.asciidoc |  11 +
 ...eration-of-administrator-accounts.asciidoc |  38 ++-
 ...ration-of-kernel-modules-via-proc.asciidoc |  23 +-
 .../enumeration-of-kernel-modules.asciidoc    |  35 +++
 ...rivileged-local-groups-membership.asciidoc |  52 ++++-
 ...s-or-groups-via-built-in-commands.asciidoc |  35 +++
 .../esxi-discovery-via-find.asciidoc          |  35 +++
 .../esxi-discovery-via-grep.asciidoc          |  35 +++
 ...-timestomping-using-touch-command.asciidoc |  46 +++-
 ...nge-mailbox-export-via-powershell.asciidoc |  23 +-
 ...creation-with-multiple-extensions.asciidoc |  11 +
 ...le-masquerading-as-kernel-process.asciidoc |  35 +++
 ...ble-media-with-network-connection.asciidoc |   3 +-
 ...om-unusual-directory-command-line.asciidoc |  40 +++-
 .../execution-of-an-unsigned-service.asciidoc |   5 +-
 ...ecution-of-com-object-via-xwizard.asciidoc |  11 +
 ...n-or-modified-by-microsoft-office.asciidoc |  23 +-
 ...written-or-modified-by-pdf-reader.asciidoc |  23 +-
 ...tron-child-process-node-js-module.asciidoc |  35 +++
 ...ution-via-local-sxs-shared-module.asciidoc |  18 +-
 ...ssql-xp-cmdshell-stored-procedure.asciidoc |  34 ++-
 ...execution-via-tsclient-mountpoint.asciidoc |  11 +
 ...xplicit-credentials-via-scripting.asciidoc |  35 +++
 ...g-exchange-mailbox-via-powershell.asciidoc |  34 ++-
 ...p-lookup-from-non-browser-process.asciidoc |  23 +-
 ...r-added-to-google-workspace-group.asciidoc |  34 ++-
 ...-deletion-in-suspicious-directory.asciidoc |  35 +++
 .../file-deletion-via-shred.asciidoc          |  46 +++-
 .../file-made-immutable-by-chattr.asciidoc    |  56 +++++
 ...odification-in-writable-directory.asciidoc |  59 ++++-
 ...r-listener-established-via-netcat.asciidoc |  74 +++++-
 ...h-suspicious-extension-downloaded.asciidoc |   8 +-
 ...ync-plugin-registered-and-enabled.asciidoc |  35 +++
 ...ta-user-session-started-via-proxy.asciidoc |  32 ++-
 ...value-accessed-in-secrets-manager.asciidoc |  32 ++-
 ...used-remote-access-tool-execution.asciidoc |  23 +-
 .../first-time-seen-driver-loaded.asciidoc    |  31 ++-
 ...ogin-from-third-party-application.asciidoc |  16 +-
 ...seen-newcredentials-logon-process.asciidoc |   4 +-
 ...me-seen-account-performing-dcsync.asciidoc |  44 +++-
 ...d-google-workspace-security-alert.asciidoc |  12 +-
 .../gcp-firewall-rule-creation.asciidoc       |   8 +-
 .../gcp-firewall-rule-deletion.asciidoc       |   8 +-
 .../gcp-firewall-rule-modification.asciidoc   |   8 +-
 .../gcp-iam-custom-role-creation.asciidoc     |   8 +-
 .../gcp-iam-role-deletion.asciidoc            |   8 +-
 ...-iam-service-account-key-deletion.asciidoc |   8 +-
 .../gcp-logging-bucket-deletion.asciidoc      |   8 +-
 .../gcp-logging-sink-deletion.asciidoc        |   8 +-
 .../gcp-logging-sink-modification.asciidoc    |   8 +-
 ...gcp-pub-sub-subscription-creation.asciidoc |   8 +-
 ...gcp-pub-sub-subscription-deletion.asciidoc |   8 +-
 .../gcp-pub-sub-topic-creation.asciidoc       |   8 +-
 .../gcp-pub-sub-topic-deletion.asciidoc       |   8 +-
 .../gcp-service-account-creation.asciidoc     |   8 +-
 .../gcp-service-account-deletion.asciidoc     |   8 +-
 .../gcp-service-account-disabled.asciidoc     |   8 +-
 .../gcp-service-account-key-creation.asciidoc |   8 +-
 ...bucket-configuration-modification.asciidoc |   8 +-
 .../gcp-storage-bucket-deletion.asciidoc      |   8 +-
 ...e-bucket-permissions-modification.asciidoc |   8 +-
 ...al-private-cloud-network-deletion.asciidoc |   8 +-
 ...tual-private-cloud-route-creation.asciidoc |   8 +-
 ...tual-private-cloud-route-deletion.asciidoc |   8 +-
 ...-transferred-via-google-workspace.asciidoc |  34 ++-
 ...gle-workspace-2sv-policy-disabled.asciidoc |  34 ++-
 ...ace-admin-role-assigned-to-a-user.asciidoc |  34 ++-
 ...gle-workspace-admin-role-deletion.asciidoc |  34 ++-
 ...main-wide-delegation-of-authority.asciidoc |  34 ++-
 ...kspace-bitlocker-setting-disabled.asciidoc |  34 ++-
 ...rkspace-custom-admin-role-created.asciidoc |  34 ++-
 ...m-gmail-route-created-or-modified.asciidoc |  34 ++-
 ...ey-s-accessed-from-anonymous-user.asciidoc |  12 +-
 ...orkspace-mfa-enforcement-disabled.asciidoc |  36 ++-
 ...ess-granted-to-custom-application.asciidoc |  38 ++-
 ...orkspace-password-policy-modified.asciidoc |  34 ++-
 ...etplace-modified-to-allow-any-app.asciidoc |  34 ++-
 .../google-workspace-role-modified.asciidoc   |  34 ++-
 ...ce-suspended-user-account-renewed.asciidoc |  12 +-
 ...-user-organizational-unit-changed.asciidoc |  34 ++-
 ...licy-abuse-for-privilege-addition.asciidoc |  46 +++-
 ...ry-via-microsoft-gpresult-utility.asciidoc |  23 +-
 ...fbaked-command-and-control-beacon.asciidoc |   7 +-
 ...ocess-arguments-in-an-rdp-session.asciidoc |  36 +++
 ...high-mean-of-rdp-session-duration.asciidoc |  36 +++
 ...password-reset-or-unlock-attempts.asciidoc |  28 ++-
 ...ocess-and-or-service-terminations.asciidoc |  23 +-
 ...gh-number-of-process-terminations.asciidoc |  58 ++++-
 ...-variance-in-rdp-session-duration.asciidoc |  36 +++
 .../rule-details/hosts-file-modified.asciidoc |  39 +++-
 .../hping-process-activity.asciidoc           |  51 ++++
 .../iis-http-logging-disabled.asciidoc        |  34 ++-
 ...windows-update-auto-update-client.asciidoc |  36 ++-
 ...to-an-unsecure-elasticsearch-node.asciidoc |   8 +-
 ...ingress-transfer-via-windows-bits.asciidoc |  33 ++-
 ...tion-of-security-support-provider.asciidoc |  11 +
 ...ctive-logon-by-an-unusual-process.asciidoc |  24 +-
 ...ractive-terminal-spawned-via-perl.asciidoc |  51 ++++
 ...ctive-terminal-spawned-via-python.asciidoc |  35 +++
 ...rberos-cached-credentials-dumping.asciidoc |  35 +++
 ...-authentication-disabled-for-user.asciidoc |  44 +++-
 ...eros-traffic-from-unusual-process.asciidoc |  36 ++-
 ...rnel-driver-load-by-non-root-user.asciidoc |  42 +++-
 .../rule-details/kernel-driver-load.asciidoc  |  34 ++-
 ...load-or-unload-via-kexec-detected.asciidoc |  35 +++
 .../kernel-module-load-via-insmod.asciidoc    |  66 +++++-
 .../kernel-module-removal.asciidoc            |  41 +++-
 ...ssword-retrieval-via-command-line.asciidoc |  35 +++
 .../krbtgt-delegation-backdoor.asciidoc       |  19 ++
 ...etes-anonymous-request-authorized.asciidoc |   8 +-
 ...with-excessive-linux-capabilities.asciidoc |  20 +-
 ...es-denied-service-account-request.asciidoc |   8 +-
 ...ervice-created-with-type-nodeport.asciidoc |   8 +-
 ...-with-a-sensitive-hostpath-volume.asciidoc |   8 +-
 ...bernetes-pod-created-with-hostipc.asciidoc |   8 +-
 ...etes-pod-created-with-hostnetwork.asciidoc |   8 +-
 ...bernetes-pod-created-with-hostpid.asciidoc |   8 +-
 ...kubernetes-privileged-pod-created.asciidoc |   8 +-
 ...ent-of-controller-service-account.asciidoc |   8 +-
 ...es-suspicious-self-subject-review.asciidoc |   8 +-
 .../kubernetes-user-exec-into-pod.asciidoc    |   8 +-
 ...teral-movement-via-startup-folder.asciidoc |  11 +
 ...odification-and-immediate-loading.asciidoc |  35 +++
 ...odification-and-immediate-loading.asciidoc |  35 +++
 .../linux-group-creation.asciidoc             |  57 ++++-
 ...ux-init-pid-1-secret-dump-via-gdb.asciidoc |  41 +++-
 ...shell-breakout-via-linux-binary-s.asciidoc |  65 +++++-
 .../linux-user-account-creation.asciidoc      |  57 ++++-
 ...ux-user-added-to-privileged-group.asciidoc |  62 ++++-
 .../lsass-memory-dump-creation.asciidoc       |  36 ++-
 .../lsass-memory-dump-handle-access.asciidoc  |  55 ++++-
 ...ss-process-access-via-windows-api.asciidoc |  31 ++-
 ...uest-predicted-to-be-a-dga-domain.asciidoc |  58 +++++
 ...with-a-high-dga-probability-score.asciidoc |  58 +++++
 ...redicted-to-be-malicious-activity.asciidoc |  60 +++++
 ...-high-malicious-probability-score.asciidoc |  60 +++++
 ...using-a-known-sunburst-dns-domain.asciidoc |  58 +++++
 ...ller-package-spawns-network-event.asciidoc |  35 +++
 ...masquerading-space-after-filename.asciidoc |  11 +
 ...-activation-for-okta-user-account.asciidoc |  29 ++-
 ...for-google-workspace-organization.asciidoc |  36 ++-
 ...change-anti-phish-policy-deletion.asciidoc |   8 +-
 ...ange-anti-phish-rule-modification.asciidoc |   8 +-
 ...im-signing-configuration-disabled.asciidoc |   8 +-
 ...t-365-exchange-dlp-policy-removed.asciidoc |   8 +-
 ...ge-malware-filter-policy-deletion.asciidoc |   8 +-
 ...-malware-filter-rule-modification.asciidoc |   8 +-
 ...-management-group-role-assignment.asciidoc |   8 +-
 ...nge-safe-attachment-rule-disabled.asciidoc |   8 +-
 ...xchange-safe-link-policy-disabled.asciidoc |   8 +-
 ...-exchange-transport-rule-creation.asciidoc |   8 +-
 ...hange-transport-rule-modification.asciidoc |   8 +-
 ...lobal-administrator-role-assigned.asciidoc |   8 +-
 ...ft-365-impossible-travel-activity.asciidoc |   8 +-
 ...365-inbox-forwarding-rule-created.asciidoc |   8 +-
 ...65-mass-download-by-a-single-user.asciidoc |   8 +-
 ...365-potential-ransomware-activity.asciidoc |   8 +-
 ...m-application-interaction-allowed.asciidoc |   8 +-
 ...365-teams-external-access-enabled.asciidoc |   8 +-
 ...ft-365-teams-guest-access-enabled.asciidoc |   8 +-
 ...5-unusual-volume-of-file-deletion.asciidoc |   8 +-
 ...ser-restricted-from-sending-email.asciidoc |   8 +-
 ...engine-started-an-unusual-process.asciidoc |  11 +
 ...ngine-started-by-a-script-process.asciidoc |  11 +
 ...ngine-started-by-a-system-process.asciidoc |  11 +
 ...-started-by-an-office-application.asciidoc |  34 ++-
 ...ld-engine-using-an-alternate-name.asciidoc |  36 ++-
 ...-um-spawning-suspicious-processes.asciidoc |  11 +
 ...erver-um-writing-suspicious-files.asciidoc |  22 +-
 ...ge-transport-agent-install-script.asciidoc |  28 ++-
 ...ker-spawning-suspicious-processes.asciidoc |  11 +
 ...iis-connection-strings-decryption.asciidoc |  11 +
 ...s-service-account-password-dumped.asciidoc |  11 +
 ...rosoft-windows-defender-tampering.asciidoc |  38 ++-
 ...mimikatz-memssp-log-file-detected.asciidoc |  40 +++-
 ...cation-of-amsienable-registry-key.asciidoc |  38 ++-
 ...odification-of-boot-configuration.asciidoc |  38 ++-
 ...amic-linker-preload-shared-object.asciidoc |  51 ++++
 ...nvironment-variable-via-launchctl.asciidoc |  35 +++
 .../modification-of-openssh-binaries.asciidoc |  78 ++++++-
 ...ari-settings-via-defaults-command.asciidoc |  35 +++
 ...on-of-the-mspkiaccountcredentials.asciidoc |  19 ++
 ...tion-of-wdigest-security-provider.asciidoc |  38 ++-
 ...n-okta-application-sign-on-policy.asciidoc |   8 +-
 ...ng-hidden-or-webdav-remote-shares.asciidoc |  11 +
 ...o-security-registry-modifications.asciidoc |  34 ++-
 ...sbuild-making-network-connections.asciidoc |  25 +-
 ...cation-disabled-for-an-azure-user.asciidoc |  32 ++-
 ...failure-followed-by-logon-success.asciidoc |  42 +++-
 ...lure-from-the-same-source-address.asciidoc |  38 ++-
 ...dresses-for-a-single-user-session.asciidoc |   8 +-
 ...ssions-detected-for-a-single-user.asciidoc |   8 +-
 ...-device-token-hash-behind-a-proxy.asciidoc |  28 ++-
 ...ltiple-vault-web-credentials-read.asciidoc |  11 +
 .../rule-details/my-first-rule.asciidoc       |   3 -
 ...espace-manipulation-using-unshare.asciidoc |  51 ++++
 ...t-listener-established-via-rlwrap.asciidoc |  36 +++
 ...network-activity-detected-via-cat.asciidoc |  81 +++++--
 ...ork-activity-detected-via-kworker.asciidoc |  36 +++
 .../network-connection-via-certutil.asciidoc  |  29 ++-
 ...connection-via-compiled-html-file.asciidoc |  25 +-
 ...-via-recently-compiled-executable.asciidoc |  35 +++
 ...nnection-via-registration-utility.asciidoc |  25 +-
 ...work-connection-via-signed-binary.asciidoc |  25 +-
 ...on-provider-registry-modification.asciidoc |  25 +-
 ...k-traffic-capture-via-cap-net-raw.asciidoc |  35 +++
 ...oweddeviceid-added-via-powershell.asciidoc |  11 +
 ...-authentication-behavior-detected.asciidoc |  28 ++-
 ...ntity-provider-idp-added-by-admin.asciidoc |  28 ++-
 ...new-or-modified-federation-domain.asciidoc |   8 +-
 ...ted-by-previously-unknown-process.asciidoc |  66 +++++-
 .../new-systemd-timer-created.asciidoc        |  62 ++++-
 .../nping-process-activity.asciidoc           |  51 ++++
 .../ntds-or-sam-database-file-copied.asciidoc |  36 ++-
 ...orted-by-user-as-malware-or-phish.asciidoc |   8 +-
 ...ssive-single-sign-on-logon-errors.asciidoc |   8 +-
 ...spicious-mailbox-right-delegation.asciidoc |   8 +-
 ...o365-mailbox-audit-logging-bypass.asciidoc |   8 +-
 ...force-or-password-spraying-attack.asciidoc |  28 ++-
 .../okta-fastpass-phishing-detection.asciidoc |  12 +-
 ...ign-in-events-via-third-party-idp.asciidoc |  28 ++-
 ...nsight-threat-suspected-promotion.asciidoc |  12 +-
 .../okta-user-session-impersonation.asciidoc  |  28 ++-
 ...arted-from-different-geolocations.asciidoc |   8 +-
 .../onedrive-malware-file-upload.asciidoc     |   8 +-
 .../peripheral-device-discovery.asciidoc      |  34 ++-
 ...tence-via-bits-job-notify-cmdline.asciidoc |  11 +
 ...ectoryservice-plugin-modification.asciidoc |  35 +++
 ...-via-docker-shortcut-modification.asciidoc |  35 +++
 ...sistence-via-folder-action-script.asciidoc |  35 +++
 ...tence-via-hidden-run-key-detected.asciidoc |  11 +
 ...ript-or-desktop-file-modification.asciidoc |  83 ++++++-
 ...sistence-via-login-or-logout-hook.asciidoc |  35 +++
 ...tence-via-microsoft-office-addins.asciidoc |  11 +
 ...istence-via-microsoft-outlook-vba.asciidoc |  11 +
 ...ersistence-via-powershell-profile.asciidoc |  25 +-
 ...stence-via-scheduled-job-creation.asciidoc |  11 +
 ...ycontroller-scheduled-task-hijack.asciidoc |  11 +
 ...pdate-orchestrator-service-hijack.asciidoc |  36 ++-
 ...stence-via-wmi-event-subscription.asciidoc |  11 +
 ...ia-wmi-standard-registry-provider.asciidoc |  25 +-
 ...-scripts-in-the-startup-directory.asciidoc |  40 +++-
 .../port-forwarding-rule-addition.asciidoc    |  34 ++-
 ...-via-azure-registered-application.asciidoc |  38 +--
 ...-dga-command-and-control-behavior.asciidoc |   7 +-
 .../possible-okta-dos-attack.asciidoc         |   8 +-
 ...tial-admin-group-account-addition.asciidoc |  35 +++
 ...n-interface-bypass-via-powershell.asciidoc |  25 +-
 ...-application-shimming-via-sdbinst.asciidoc |  11 +
 ...l-buffer-overflow-attack-detected.asciidoc |  14 ++
 ...chroot-container-escape-via-mount.asciidoc |  46 ++++
 ...ial-code-execution-via-postgresql.asciidoc |  35 +++
 ...okies-theft-via-browser-debugging.asciidoc |  11 +
 ...tial-credential-access-via-dcsync.asciidoc |  46 +++-
 ...cess-via-duplicatehandle-in-lsass.asciidoc |  11 +
 ...tial-access-via-lsass-memory-dump.asciidoc |  11 +
 ...cess-via-renamed-com-services-dll.asciidoc |  37 ++-
 ...ess-via-trusted-developer-utility.asciidoc |  25 +-
 ...tial-access-via-windows-utilities.asciidoc |  34 ++-
 ...-curl-cve-2023-38545-exploitation.asciidoc |  48 ++++
 ...ty-to-an-unusual-destination-port.asciidoc |  36 +++
 ...activity-to-an-unusual-ip-address.asciidoc |  36 +++
 ...n-activity-to-an-unusual-iso-code.asciidoc |  36 +++
 ...ion-activity-to-an-unusual-region.asciidoc |  36 +++
 ...tential-defense-evasion-via-proot.asciidoc |  41 +++-
 .../potential-dga-activity.asciidoc           |  67 ++++++
 .../potential-disabling-of-apparmor.asciidoc  |  47 +++-
 .../potential-disabling-of-selinux.asciidoc   |  62 ++++-
 ...ft-antimalware-service-executable.asciidoc |  11 +
 ...ng-via-trusted-microsoft-programs.asciidoc |  11 +
 ...ential-dns-tunneling-via-nslookup.asciidoc |  25 +-
 ...ential-evasion-via-filter-manager.asciidoc |  27 ++-
 ...on-via-windows-filtering-platform.asciidoc |  19 ++
 ...al-linux-ssh-brute-force-detected.asciidoc |  57 ++++-
 ...tential-file-transfer-via-certreq.asciidoc |  25 +-
 ...idden-local-user-account-creation.asciidoc |  35 +++
 ...-hidden-process-via-mount-hidepid.asciidoc |  46 +++-
 ...al-linux-ssh-brute-force-detected.asciidoc |  57 ++++-
 ...invoke-mimikatz-powershell-script.asciidoc |  53 ++++-
 ...ntial-kerberos-attack-via-bifrost.asciidoc |  35 +++
 ...teral-tool-transfer-via-smb-share.asciidoc |  23 +-
 ...ux-backdoor-user-account-creation.asciidoc |  62 ++++-
 ...ntial-dumping-via-proc-filesystem.asciidoc |  48 +++-
 ...x-credential-dumping-via-unshadow.asciidoc |  43 +++-
 ...otential-linux-hack-tool-launched.asciidoc |  36 +++
 ...ocal-account-brute-force-detected.asciidoc |  47 +++-
 ...ransomware-note-creation-detected.asciidoc |  35 +++
 ...otential-linux-ssh-x11-forwarding.asciidoc |  31 ++-
 ...-tunneling-and-or-port-forwarding.asciidoc |  98 +++++---
 ...e-creation-via-psscapturesnapshot.asciidoc |  13 ++
 ...emory-dump-via-psscapturesnapshot.asciidoc |   8 +
 ...al-macos-ssh-brute-force-detected.asciidoc |  35 +++
 ...l-masquerading-as-browser-process.asciidoc |  16 +-
 ...erading-as-business-app-installer.asciidoc |   3 +-
 ...tial-masquerading-as-system32-dll.asciidoc |   9 +-
 ...squerading-as-system32-executable.asciidoc |   5 +-
 ...tential-meterpreter-reverse-shell.asciidoc |  70 +++++-
 ...-microsoft-office-sandbox-evasion.asciidoc |  35 +++
 ...ication-of-accessibility-binaries.asciidoc |  38 ++-
 ...l-network-scan-executed-from-host.asciidoc |  36 +++
 ...andard-port-http-https-connection.asciidoc |  31 ++-
 ...fa-bombing-via-push-notifications.asciidoc |  29 ++-
 ...openssh-backdoor-logging-activity.asciidoc |  56 +++++
 ...rdp-connection-by-unusual-process.asciidoc |  14 +-
 ...ng-of-microsoft-365-user-accounts.asciidoc |   8 +-
 ...rsistence-through-init-d-detected.asciidoc |  66 +++++-
 ...rough-motd-file-creation-detected.asciidoc |  66 +++++-
 ...ence-through-run-control-detected.asciidoc |  62 ++++-
 ...persistence-through-systemd-udevd.asciidoc |  38 +++
 ...via-atom-init-script-modification.asciidoc |  35 +++
 ...ential-persistence-via-login-hook.asciidoc |  42 +++-
 ...al-persistence-via-periodic-tasks.asciidoc |  35 +++
 ...ce-via-time-provider-modification.asciidoc |  25 +-
 ...hacktool-script-by-function-names.asciidoc |  50 +++-
 ...-bypass-via-localhost-secure-copy.asciidoc |  35 +++
 ...rol-bypass-via-tccdb-modification.asciidoc |  35 +++
 ...on-through-writable-docker-socket.asciidoc |  35 +++
 ...on-via-container-misconfiguration.asciidoc |  46 ++++
 ...lege-escalation-via-cve-2023-4911.asciidoc |  48 ++++
 ...lege-escalation-via-enlightenment.asciidoc |  35 +++
 ...alation-via-installerfiletakeover.asciidoc |  40 +++-
 ...alation-via-linux-dac-permissions.asciidoc |  35 +++
 ...rivilege-escalation-via-overlayfs.asciidoc |  35 +++
 ...l-privilege-escalation-via-pkexec.asciidoc |  35 +++
 ...-escalation-via-python-cap-setuid.asciidoc |  36 +++
 ...-via-recently-compiled-executable.asciidoc |  35 +++
 ...tion-via-uid-int-max-bug-detected.asciidoc |  35 +++
 ...ation-via-samaccountname-spoofing.asciidoc |  10 +
 ...-process-injection-via-powershell.asciidoc |  48 +++-
 ...tocol-tunneling-via-chisel-client.asciidoc |  64 +++++-
 ...tocol-tunneling-via-chisel-server.asciidoc |  66 +++++-
 ...-protocol-tunneling-via-earthworm.asciidoc |  84 ++++++-
 ...-pspy-process-monitoring-detected.asciidoc |  42 +++-
 ...ote-code-execution-via-web-server.asciidoc |  62 ++++-
 ...te-credential-access-via-registry.asciidoc |  40 +++-
 ...remote-desktop-shadowing-activity.asciidoc |  11 +
 ...remote-desktop-tunneling-detected.asciidoc |  34 ++-
 ...remote-file-execution-via-msiexec.asciidoc |   3 +-
 ...verse-shell-activity-via-terminal.asciidoc |  35 ++-
 ...erse-shell-via-background-process.asciidoc |  35 +++
 ...potential-reverse-shell-via-child.asciidoc |  36 +++
 .../potential-reverse-shell-via-java.asciidoc |  35 +++
 ...verse-shell-via-suspicious-binary.asciidoc |  35 +++
 ...hell-via-suspicious-child-process.asciidoc |  35 +++
 .../potential-reverse-shell-via-udp.asciidoc  |  81 +++++--
 .../potential-reverse-shell.asciidoc          |  35 +++
 ...file-deletion-via-sdelete-utility.asciidoc |  23 +-
 ...ow-credentials-added-to-ad-object.asciidoc |  49 +++-
 ...e-read-via-command-line-utilities.asciidoc |  35 +++
 ...l-via-wildcard-injection-detected.asciidoc |  35 +++
 ...ential-ssh-it-ssh-worm-downloaded.asciidoc |  36 +++
 ...x-ftp-brute-force-attack-detected.asciidoc |  64 +++++-
 ...x-rdp-brute-force-attack-detected.asciidoc |  60 ++++-
 ...successful-ssh-brute-force-attack.asciidoc |  69 +++++-
 ...potential-sudo-hijacking-detected.asciidoc |  35 +++
 ...ege-escalation-via-cve-2019-14287.asciidoc |  35 +++
 ...anipulation-via-process-injection.asciidoc |  35 +++
 ...icious-debugfs-root-device-access.asciidoc |  35 +++
 ...s-via-wildcard-injection-detected.asciidoc |  35 +++
 ...-upgrade-of-non-interactive-shell.asciidoc |  35 +++
 ...indows-error-manager-masquerading.asciidoc |  25 +-
 ...fa-bombing-via-push-notifications.asciidoc |  28 ++-
 ...owershell-invoke-ninjacopy-script.asciidoc |  23 +-
 .../powershell-kerberos-ticket-dump.asciidoc  |  48 +++-
 ...owershell-kerberos-ticket-request.asciidoc |  46 +++-
 .../powershell-keylogging-script.asciidoc     |  48 +++-
 ...ershell-mailbox-collection-script.asciidoc |  48 +++-
 .../powershell-minidump-script.asciidoc       |  48 +++-
 .../powershell-psreflect-script.asciidoc      |  51 +++-
 ...ell-script-block-logging-disabled.asciidoc |  27 ++-
 ...-archive-compression-capabilities.asciidoc |  20 ++
 ...cript-with-discovery-capabilities.asciidoc |  33 ++-
 ...ncryption-decryption-capabilities.asciidoc |  23 +-
 ...cript-with-log-clear-capabilities.asciidoc |  25 +-
 ...ord-policy-discovery-capabilities.asciidoc |  26 ++-
 ...-execution-capabilities-via-winrm.asciidoc |  26 ++-
 ...-token-impersonation-capabilities.asciidoc |  49 +++-
 ...webcam-video-capture-capabilities.asciidoc |  20 ++
 ...wershell-share-enumeration-script.asciidoc |  45 +++-
 ...ery-related-windows-api-functions.asciidoc |  48 +++-
 ...us-payload-encoded-and-compressed.asciidoc |  50 +++-
 ...t-with-audio-capture-capabilities.asciidoc |  48 +++-
 ...-clipboard-retrieval-capabilities.asciidoc |  48 +++-
 ...ript-with-screenshot-capabilities.asciidoc |  48 +++-
 ...cap-chown-cap-fowner-capabilities.asciidoc |  46 +++-
 ...ia-cap-setuid-setgid-capabilities.asciidoc |  35 +++
 ...escalation-via-gdb-cap-sys-ptrace.asciidoc |  35 +++
 ...tion-via-named-pipe-impersonation.asciidoc |  36 ++-
 ...ia-rogue-named-pipe-impersonation.asciidoc |  14 ++
 ...ia-root-crontab-file-modification.asciidoc |  35 +++
 .../privileged-account-brute-force.asciidoc   |  38 ++-
 ...s-activity-via-compiled-html-file.asciidoc |  36 ++-
 .../process-capability-enumeration.asciidoc   |  35 +++
 ...s-created-with-a-duplicated-token.asciidoc |   9 +-
 ...cess-creation-via-secondary-logon.asciidoc |  13 ++
 ...ecution-from-an-unusual-directory.asciidoc |  40 +++-
 ...-started-from-process-id-pid-file.asciidoc |  46 +++-
 ...-termination-followed-by-deletion.asciidoc |  25 +-
 ...gram-files-directory-masquerading.asciidoc |  11 +
 ...pt-for-credentials-with-osascript.asciidoc |  35 +++
 .../proxychains-activity.asciidoc             |  31 ++-
 .../psexec-network-connection.asciidoc        |  23 +-
 ...script-execution-via-command-line.asciidoc |  11 +
 .../rule-details/rare-aws-error-code.asciidoc |  34 ++-
 .../rule-details/rare-user-logon.asciidoc     |  23 +-
 .../rdp-enabled-via-registry.asciidoc         |  34 ++-
 ...istry-persistence-via-appcert-dll.asciidoc |  11 +
 ...istry-persistence-via-appinit-dll.asciidoc |  36 ++-
 ...bled-in-windows-firewall-by-netsh.asciidoc |  34 ++-
 .../remote-execution-via-file-shares.asciidoc |  25 +-
 ...emote-file-copy-to-a-hidden-share.asciidoc |  11 +
 .../remote-file-copy-via-teamviewer.asciidoc  |  36 ++-
 ...oad-via-desktopimgdownldr-utility.asciidoc |  38 ++-
 ...remote-file-download-via-mpcmdrun.asciidoc |  38 ++-
 ...mote-file-download-via-powershell.asciidoc |  27 ++-
 ...e-download-via-script-interpreter.asciidoc |  25 +-
 ...e-scheduled-task-creation-via-rpc.asciidoc |  29 ++-
 .../remote-scheduled-task-creation.asciidoc   |  29 ++-
 ...n-enabled-via-systemsetup-command.asciidoc |  35 +++
 .../remote-system-discovery-commands.asciidoc |  35 ++-
 ...mote-xsl-script-execution-via-com.asciidoc |   3 +-
 ...remotely-started-services-via-rpc.asciidoc |  25 +-
 ...enamed-autoit-scripts-interpreter.asciidoc |  36 ++-
 ...-executed-with-short-program-name.asciidoc |  25 +-
 ...connection-via-gdb-cap-sys-ptrace.asciidoc |  35 +++
 ...file-downloaded-from-the-internet.asciidoc |   7 +-
 ...-task-created-by-a-windows-script.asciidoc |   7 +-
 ...d-task-execution-at-scale-via-gpo.asciidoc |  60 ++++-
 ...cheduled-tasks-at-command-enabled.asciidoc |  11 +
 ...le-modified-by-unexpected-process.asciidoc |  42 +++-
 ...or-saved-credentials-via-vaultcmd.asciidoc |  11 +
 ...ity-software-discovery-using-wmic.asciidoc |  35 ++-
 ...urity-software-discovery-via-grep.asciidoc |  35 ++-
 ...e-enabled-by-a-suspicious-process.asciidoc |  20 ++
 .../rule-details/segfault-detected.asciidoc   |  36 +++
 .../sensitive-files-compression.asciidoc      |  53 +++++
 ...ationprivilege-assigned-to-a-user.asciidoc |  45 +++-
 ...ol-spawned-via-script-interpreter.asciidoc |  25 +-
 ...isabled-via-registry-modification.asciidoc |   3 +-
 ...vice-path-modification-via-sc-exe.asciidoc |   6 +-
 ...tcap-setuid-setgid-capability-set.asciidoc |  62 ++++-
 ...ged-by-previously-unknown-process.asciidoc |  62 ++++-
 .../sharepoint-malware-file-upload.asciidoc   |   8 +-
 ...ell-execution-via-apple-scripting.asciidoc |  35 +++
 ...oxy-execution-via-ms-work-folders.asciidoc |  34 ++-
 ...reupdate-preferences-modification.asciidoc |  35 +++
 ...s-disabling-services-via-registry.asciidoc |  11 +
 .../spike-in-aws-error-messages.asciidoc      |  34 ++-
 ...to-an-external-device-via-airdrop.asciidoc |  35 +++
 ...-bytes-sent-to-an-external-device.asciidoc |  35 +++
 .../spike-in-failed-logon-events.asciidoc     |  23 +-
 ...e-in-network-traffic-to-a-country.asciidoc |  23 +-
 ...connections-made-from-a-source-ip.asciidoc |  36 +++
 ...nections-made-to-a-destination-ip.asciidoc |  36 +++
 ...er-of-processes-in-an-rdp-session.asciidoc |  36 +++
 .../spike-in-remote-file-transfers.asciidoc   |  35 +++
 ...ful-logon-events-from-a-source-ip.asciidoc |  23 +-
 ...-persistence-via-unsigned-process.asciidoc |  29 ++-
 ...ript-added-to-group-policy-object.asciidoc |  60 ++++-
 ...-or-run-key-registry-modification.asciidoc |  29 ++-
 ...rsistence-by-a-suspicious-process.asciidoc |  40 +++-
 ...ing-activity-with-high-confidence.asciidoc |  27 +++
 ...el-detected-c2-beaconing-activity.asciidoc |  27 +++
 ...n-to-okta-account-after-mfa-reset.asciidoc |  32 ++-
 ...r-application-script-modification.asciidoc |  35 +++
 ...sudo-command-enumeration-detected.asciidoc |  35 +++
 .../suid-sguid-enumeration-detected.asciidoc  |  35 +++
 ...urst-command-and-control-activity.asciidoc |  27 ++-
 ...us-activity-reported-by-okta-user.asciidoc |   8 +-
 ...us-antimalware-scan-interface-dll.asciidoc |  25 +-
 ...ous-apt-package-manager-execution.asciidoc |  35 +++
 ...ackage-manager-network-connection.asciidoc |  35 +++
 ...ous-automator-workflows-execution.asciidoc |  35 +++
 .../suspicious-browser-child-process.asciidoc |  35 +++
 ...icious-calendar-file-modification.asciidoc |  35 +++
 .../suspicious-certutil-commands.asciidoc     |  25 +-
 ...obe-acrobat-reader-update-service.asciidoc |  35 +++
 .../suspicious-cmd-execution-via-wmi.asciidoc |  11 +
 ...s-communication-app-child-process.asciidoc |  47 +++-
 ...racted-or-decompressed-via-funzip.asciidoc |  35 +++
 ...-crontab-creation-or-modification.asciidoc |  35 +++
 ...ta-encryption-via-openssl-utility.asciidoc |  37 ++-
 ...rsistence-or-privilege-escalation.asciidoc |  34 ++-
 ...s-dynamic-linker-discovery-via-od.asciidoc |  35 +++
 .../suspicious-emond-child-process.asciidoc   |  35 +++
 ...-endpoint-security-parent-process.asciidoc |  11 +
 ...s-execution-from-a-mounted-device.asciidoc |  11 +
 ...picious-execution-from-inet-cache.asciidoc |  82 +++++++
 ...ious-execution-via-scheduled-task.asciidoc |  11 +
 ...suspicious-explorer-child-process.asciidoc |  11 +
 ...us-file-changes-activity-detected.asciidoc |  35 +++
 ...e-creation-in-etc-for-persistence.asciidoc |  66 +++++-
 ...picious-file-creation-via-kworker.asciidoc |  70 +++++-
 ...s-hidden-child-process-of-launchd.asciidoc |  35 +++
 .../suspicious-html-file-creation.asciidoc    |  11 +
 ...-load-taskschd-dll-from-ms-office.asciidoc |  40 +++-
 .../suspicious-java-child-process.asciidoc    |  35 ++-
 .../suspicious-kworker-uid-elevation.asciidoc |  36 +++
 ...ious-lsass-access-via-malseclogon.asciidoc |  11 +
 .../suspicious-lsass-process-access.asciidoc  |  10 +
 ...ous-macos-ms-office-child-process.asciidoc |  35 +++
 ...ft-365-mail-access-by-clientappid.asciidoc |   8 +-
 ...soft-diagnostics-wizard-execution.asciidoc |  11 +
 ...ous-mining-process-creation-event.asciidoc |  35 +++
 .../suspicious-modprobe-file-event.asciidoc   |  28 ++-
 ...suspicious-module-loaded-by-lsass.asciidoc |  11 +
 ...uspicious-ms-office-child-process.asciidoc |  34 ++-
 ...spicious-ms-outlook-child-process.asciidoc |  34 ++-
 .../suspicious-net-code-compilation.asciidoc  |  11 +
 ...ous-net-reflection-via-powershell.asciidoc |  50 +++-
 ...-by-previously-unknown-executable.asciidoc | 115 +++++++++-
 ...etwork-connection-via-sudo-binary.asciidoc |  35 +++
 ...us-network-connection-via-systemd.asciidoc |  35 +++
 ...spicious-passwd-file-event-action.asciidoc |  69 +++++-
 ...spicious-pdf-reader-child-process.asciidoc |  34 ++-
 ...able-encoded-in-powershell-script.asciidoc |  50 +++-
 ...cious-powershell-engine-imageload.asciidoc |  23 +-
 ...cious-print-spooler-file-deletion.asciidoc |  11 +
 ...us-print-spooler-spl-file-created.asciidoc |  36 ++-
 ...-service-executable-file-creation.asciidoc |  11 +
 .../suspicious-proc-maps-discovery.asciidoc   |  35 +++
 ...oc-pseudo-file-system-enumeration.asciidoc |  27 ++-
 ...ess-access-via-direct-system-call.asciidoc |  38 ++-
 ...icious-process-creation-calltrace.asciidoc |  23 +-
 ...ion-via-renamed-psexec-executable.asciidoc |  34 ++-
 ...rocess-spawned-from-motd-detected.asciidoc |  66 +++++-
 ...picious-rdp-activex-client-loaded.asciidoc |  11 +
 ...stry-access-via-sebackupprivilege.asciidoc |  54 ++++-
 ...suspicious-renaming-of-esxi-files.asciidoc |  35 +++
 ...-renaming-of-esxi-index-html-file.asciidoc |  35 +++
 ...rvice-was-installed-in-the-system.asciidoc |  25 +-
 ...spicious-solarwinds-child-process.asciidoc |  11 +
 ...startup-shell-folder-modification.asciidoc |  29 ++-
 .../suspicious-symbolic-link-created.asciidoc |  35 +++
 .../suspicious-sysctl-file-event.asciidoc     |  29 ++-
 ...-by-previously-unknown-executable.asciidoc |  35 +++
 ...cious-termination-of-esxi-process.asciidoc |  35 +++
 ...-utility-launched-via-proxychains.asciidoc |  78 +++++--
 ...suspicious-werfault-child-process.asciidoc |  11 +
 ...process-cluster-spawned-by-a-host.asciidoc |  69 ++++++
 ...uster-spawned-by-a-parent-process.asciidoc |  69 ++++++
 ...process-cluster-spawned-by-a-user.asciidoc |  69 ++++++
 ...ous-wmi-image-load-from-ms-office.asciidoc |  11 +
 .../suspicious-zoom-child-process.asciidoc    |  25 +-
 .../svchost-spawning-cmd.asciidoc             |  36 ++-
 ...bolic-link-to-shadow-copy-created.asciidoc |  56 ++++-
 ...-or-moved-to-suspicious-directory.asciidoc |  39 +++-
 ...scovery-via-windows-command-shell.asciidoc |  35 ++-
 .../system-log-file-deletion.asciidoc         |  56 +++++
 .../system-shells-via-services.asciidoc       |  25 +-
 .../system-time-discovery.asciidoc            |   8 +-
 ...systemkey-access-via-command-line.asciidoc |  35 +++
 .../tainted-kernel-module-load.asciidoc       |  31 +++
 ...ed-out-of-tree-kernel-module-load.asciidoc |  33 +++
 ...ring-of-bash-command-line-history.asciidoc |  11 +
 ...-via-mounted-apfs-snapshot-access.asciidoc |  35 +++
 ...es-deleted-via-unexpected-process.asciidoc |  38 ++-
 ...threat-intel-hash-indicator-match.asciidoc |  37 ++-
 ...-intel-ip-address-indicator-match.asciidoc |  37 ++-
 .../threat-intel-url-indicator-match.asciidoc |  37 ++-
 ...-windows-registry-indicator-match.asciidoc |  37 ++-
 .../timestomping-using-touch-command.asciidoc |  11 +
 ...nternet-explorer-add-on-installer.asciidoc |  11 +
 ...eged-ifileoperation-com-interface.asciidoc |  11 +
 ...ia-windows-directory-masquerading.asciidoc |  38 ++-
 ...ademanager-elevated-com-interface.asciidoc |  11 +
 ...diskcleanup-scheduled-task-hijack.asciidoc |  11 +
 ...icmluautil-elevated-com-interface.asciidoc |  11 +
 ...a-windows-firewall-snap-in-hijack.asciidoc |  38 ++-
 ...rom-previously-unknown-executable.asciidoc |  38 +++
 ...zed-access-to-an-okta-application.asciidoc |   8 +-
 ...ocess-of-macos-screensaver-engine.asciidoc |  42 +++-
 ...-loading-from-a-suspicious-folder.asciidoc |  11 +
 .../untrusted-driver-loaded.asciidoc          |  29 ++-
 .../unusual-aws-command-for-a-user.asciidoc   |  34 ++-
 ...ess-from-a-system-virtual-process.asciidoc |  11 +
 .../unusual-child-process-of-dns-exe.asciidoc |  34 ++-
 ...usual-child-processes-of-rundll32.asciidoc |  29 ++-
 .../unusual-city-for-an-aws-command.asciidoc  |  34 ++-
 ...nusual-country-for-an-aws-command.asciidoc |  34 ++-
 ...tion-by-a-system-critical-process.asciidoc |  36 ++-
 ...le-creation-alternate-data-stream.asciidoc |  36 ++-
 ...sual-file-modification-by-dns-exe.asciidoc |  22 +-
 .../unusual-hour-for-a-user-to-logon.asciidoc |  23 +-
 .../unusual-linux-network-activity.asciidoc   |  11 +-
 .../unusual-linux-username.asciidoc           |  11 +-
 ...vity-from-a-windows-system-binary.asciidoc |  25 +-
 ...l-network-connection-via-rundll32.asciidoc |  23 +-
 ...unusual-parent-child-relationship.asciidoc |  36 ++-
 ...nusual-parent-process-for-cmd-exe.asciidoc |  11 +
 ...usual-print-spooler-child-process.asciidoc |  11 +
 ...cution-path-alternate-data-stream.asciidoc |  11 +
 .../unusual-process-extension.asciidoc        |   8 +-
 .../unusual-process-for-a-linux-host.asciidoc |  23 +-
 ...nusual-process-for-a-windows-host.asciidoc |  29 ++-
 ...rocess-for-mssql-service-accounts.asciidoc |  24 +-
 ...nusual-process-network-connection.asciidoc |  23 +-
 ...unusual-process-spawned-by-a-host.asciidoc |  69 ++++++
 ...ocess-spawned-by-a-parent-process.asciidoc |  69 ++++++
 ...unusual-process-spawned-by-a-user.asciidoc |  69 ++++++
 ...riting-data-to-an-external-device.asciidoc |  35 +++
 .../unusual-remote-file-directory.asciidoc    |  35 +++
 .../unusual-remote-file-extension.asciidoc    |  35 +++
 .../unusual-remote-file-size.asciidoc         |  35 +++
 ...t-child-process-childless-service.asciidoc |  11 +
 ...al-time-or-day-for-an-rdp-session.asciidoc |  36 +++
 ...user-privilege-enumeration-via-id.asciidoc |  35 +++
 .../unusual-windows-network-activity.asciidoc |  11 +-
 .../unusual-windows-remote-user.asciidoc      |  11 +-
 .../unusual-windows-username.asciidoc         |  11 +-
 .../user-account-creation.asciidoc            |  38 ++-
 ...-account-exposed-to-kerberoasting.asciidoc |  51 +++-
 ...ed-as-owner-for-azure-application.asciidoc |   8 +-
 ...owner-for-azure-service-principal.asciidoc |   8 +-
 .../user-added-to-privileged-group.asciidoc   |  34 ++-
 ...l-machine-fingerprinting-via-grep.asciidoc |  11 +
 .../virtual-machine-fingerprinting.asciidoc   |  51 ++++
 ...rivate-network-connection-attempt.asciidoc |  35 +++
 ...y-deleted-or-resized-via-vssadmin.asciidoc |  38 ++-
 ...adow-copy-deletion-via-powershell.asciidoc |  38 ++-
 ...ume-shadow-copy-deletion-via-wmic.asciidoc |  38 ++-
 ...ess-child-of-common-web-processes.asciidoc |  34 ++-
 .../webproxy-settings-modification.asciidoc   |  35 +++
 .../webserver-access-logs-deleted.asciidoc    |  11 +
 .../whoami-process-activity.asciidoc          |  38 ++-
 ...isabled-via-registry-modification.asciidoc |  38 ++-
 ...r-exclusions-added-via-powershell.asciidoc |  40 +++-
 .../windows-event-logs-cleared.asciidoc       |  23 +-
 ...-firewall-disabled-via-powershell.asciidoc |  34 ++-
 .../windows-network-enumeration.asciidoc      |  35 ++-
 ...gistry-file-creation-in-smb-share.asciidoc |  27 ++-
 ...ndows-script-executing-powershell.asciidoc |  34 ++-
 ...e-installed-via-an-unusual-client.asciidoc |  19 ++
 ...-for-linux-distribution-installed.asciidoc |  27 ++-
 ...or-linux-enabled-via-dism-utility.asciidoc |  27 ++-
 ...ntial-dumping-using-netsh-command.asciidoc |  25 +-
 .../rule-details/wmic-remote-command.asciidoc |   5 +-
 ...access-on-active-directory-object.asciidoc |  18 ++
 .../zoom-meeting-with-no-passcode.asciidoc    |   6 +
 docs/index.asciidoc                           |   2 +
 873 files changed, 24457 insertions(+), 3829 deletions(-)
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-attempt-to-clear-kernel-ring-buffer.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-attempt-to-disable-iptables-or-firewall.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-base16-or-base32-encoding-decoding-activity.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-creation-of-hidden-files-and-directories-via-commandline.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-creation-of-hidden-shared-object-file.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-esxi-timestomping-using-touch-command.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-execution-from-a-removable-media-with-network-connection.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-file-deletion-via-shred.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-file-permission-modification-in-writable-directory.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-first-time-seen-newcredentials-logon-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-interactive-logon-by-an-unusual-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-kernel-driver-load-by-non-root-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-kernel-module-removal.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-linux-init-pid-1-secret-dump-via-gdb.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-network-activity-detected-via-cat.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-defense-evasion-via-proot.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-disabling-of-apparmor.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-disabling-of-selinux.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-hidden-process-via-mount-hidepid.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-credential-dumping-via-proc-filesystem.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-credential-dumping-via-unshadow.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-local-account-brute-force-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-tunneling-and-or-port-forwarding.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-masquerading-as-business-app-installer.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-meterpreter-reverse-shell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-pspy-process-monitoring-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-remote-file-execution-via-msiexec.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-reverse-shell-via-udp.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-privilege-escalation-via-cap-chown-cap-fowner-capabilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-process-created-with-a-duplicated-token.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-remote-xsl-script-execution-via-com.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-antimalware-scan-interface-dll.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-execution-from-inet-cache.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-passwd-file-event-action.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-utility-launched-via-proxychains.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-system-binary-copied-and-or-moved-to-suspicious-directory.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rules-8-12-5-appendix.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rules-8-12-5-summary.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-inet-cache.asciidoc

diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-attempt-to-clear-kernel-ring-buffer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-attempt-to-clear-kernel-ring-buffer.asciidoc
new file mode 100644
index 0000000000..37e36e5ed7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-attempt-to-clear-kernel-ring-buffer.asciidoc
@@ -0,0 +1,112 @@
+[[prebuilt-rule-8-12-5-attempt-to-clear-kernel-ring-buffer]]
+=== Attempt to Clear Kernel Ring Buffer
+
+Monitors for the deletion of the kernel ring buffer events through dmesg. Attackers may clear kernel ring buffer events to evade detection after installing a Linux kernel module (LKM).
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Auditd Manager
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.action in ("exec", "exec_event", "executed") and
+event.type == "start" and process.name == "dmesg" and process.args : "-c"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: Clear Linux or Mac System Logs
+** ID: T1070.002
+** Reference URL: https://attack.mitre.org/techniques/T1070/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-attempt-to-disable-iptables-or-firewall.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-attempt-to-disable-iptables-or-firewall.asciidoc
new file mode 100644
index 0000000000..2ea7c07e66
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-attempt-to-disable-iptables-or-firewall.asciidoc
@@ -0,0 +1,115 @@
+[[prebuilt-rule-8-12-5-attempt-to-disable-iptables-or-firewall]]
+=== Attempt to Disable IPTables or Firewall
+
+Adversaries may attempt to disable the iptables or firewall service in an attempt to affect how a host is allowed to receive or send network traffic.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event") and
+ (
+   /* disable FW */
+   (
+     (process.name == "ufw" and process.args == "disable") or
+     (process.name == "iptables" and process.args == "-F" and process.args_count == 2)
+   ) or
+
+   /* stop FW service */
+   (
+     ((process.name == "service" and process.args == "stop") or
+       (process.name == "chkconfig" and process.args == "off") or
+       (process.name == "systemctl" and process.args in ("disable", "stop", "kill"))) and
+    process.args in ("firewalld", "ip6tables", "iptables")
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-base16-or-base32-encoding-decoding-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-base16-or-base32-encoding-decoding-activity.asciidoc
new file mode 100644
index 0000000000..bc1fa96680
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-base16-or-base32-encoding-decoding-activity.asciidoc
@@ -0,0 +1,120 @@
+[[prebuilt-rule-8-12-5-base16-or-base32-encoding-decoding-activity]]
+=== Base16 or Base32 Encoding/Decoding Activity
+
+Adversaries may encode/decode data in an attempt to evade detection by host- or network-based security controls.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Auditd Manager
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type in ("start", "process_started") and
+process.name in ("base16", "base32", "base32plain", "base32hex") and not process.args in ("--help", "--version")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-creation-of-hidden-files-and-directories-via-commandline.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-creation-of-hidden-files-and-directories-via-commandline.asciidoc
new file mode 100644
index 0000000000..74864a6e50
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-creation-of-hidden-files-and-directories-via-commandline.asciidoc
@@ -0,0 +1,126 @@
+[[prebuilt-rule-8-12-5-creation-of-hidden-files-and-directories-via-commandline]]
+=== Creation of Hidden Files and Directories via CommandLine
+
+Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. This rule looks for hidden files or folders in common writable directories.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 33
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Custom Ingest Pipeline*
+
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html[guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
+process.working_directory in ("/tmp", "/var/tmp", "/dev/shm") and
+process.args regex~ """\.[a-z0-9_\-][a-z0-9_\-\.]{1,254}""" and
+not process.name in ("ls", "find", "grep", "git", "jq", "basename")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
+* Sub-technique:
+** Name: Hidden Files and Directories
+** ID: T1564.001
+** Reference URL: https://attack.mitre.org/techniques/T1564/001/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-creation-of-hidden-shared-object-file.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-creation-of-hidden-shared-object-file.asciidoc
new file mode 100644
index 0000000000..fb711e9aa8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-creation-of-hidden-shared-object-file.asciidoc
@@ -0,0 +1,123 @@
+[[prebuilt-rule-8-12-5-creation-of-hidden-shared-object-file]]
+=== Creation of Hidden Shared Object File
+
+Identifies the creation of a hidden shared object (.so) file. Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 33
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Custom Ingest Pipeline*
+
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html[guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.type == "creation" and file.extension == "so" and file.name : ".*.so" and
+not process.name == "dockerd"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
+* Sub-technique:
+** Name: Hidden Files and Directories
+** ID: T1564.001
+** Reference URL: https://attack.mitre.org/techniques/T1564/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-esxi-timestomping-using-touch-command.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-esxi-timestomping-using-touch-command.asciidoc
new file mode 100644
index 0000000000..3769806d1e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-esxi-timestomping-using-touch-command.asciidoc
@@ -0,0 +1,106 @@
+[[prebuilt-rule-8-12-5-esxi-timestomping-using-touch-command]]
+=== ESXI Timestomping using Touch Command
+
+Identifies instances where the 'touch' command is executed on a Linux system with the "-r" flag, which is used to modify the timestamp of a file based on another file's timestamp. The rule targets specific VM-related paths, such as "/etc/vmware/", "/usr/lib/vmware/", or "/vmfs/*". These paths are associated with VMware virtualization software, and their presence in the touch command arguments may indicate that a threat actor is attempting to tamper with timestamps of VM-related files and configurations on the system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Auditd Manager
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "executed")
+and process.name : "touch" and process.args : "-r" and process.args : ("/etc/vmware/*", "/usr/lib/vmware/*", "/vmfs/*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: Timestomp
+** ID: T1070.006
+** Reference URL: https://attack.mitre.org/techniques/T1070/006/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-execution-from-a-removable-media-with-network-connection.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-execution-from-a-removable-media-with-network-connection.asciidoc
new file mode 100644
index 0000000000..ca2431562e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-execution-from-a-removable-media-with-network-connection.asciidoc
@@ -0,0 +1,67 @@
+[[prebuilt-rule-8-12-5-execution-from-a-removable-media-with-network-connection]]
+=== Execution from a Removable Media with Network Connection
+
+Identifies process execution from a removable media and by an unusual process. Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Data Source: Elastic Defend
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by process.entity_id with maxspan=5m
+ [process where host.os.type == "windows" and event.action == "start" and
+  
+  /* Direct Exec from USB */
+  (process.Ext.device.bus_type : "usb" or process.Ext.device.product_id : "USB *") and
+  (process.code_signature.trusted == false or process.code_signature.exists == false) and 
+  
+  not process.code_signature.status : ("errorExpired", "errorCode_endpoint*")]
+ [network where host.os.type == "windows" and event.action == "connection_attempted"]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Replication Through Removable Media
+** ID: T1091
+** Reference URL: https://attack.mitre.org/techniques/T1091/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-file-deletion-via-shred.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-file-deletion-via-shred.asciidoc
new file mode 100644
index 0000000000..266bed3eee
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-file-deletion-via-shred.asciidoc
@@ -0,0 +1,102 @@
+[[prebuilt-rule-8-12-5-file-deletion-via-shred]]
+=== File Deletion via Shred
+
+Malware or other files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and process.name == "shred" and process.args in (
+  "-u", "--remove", "-z", "--zero"
+) and not process.parent.name == "logrotate"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: File Deletion
+** ID: T1070.004
+** Reference URL: https://attack.mitre.org/techniques/T1070/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-file-permission-modification-in-writable-directory.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-file-permission-modification-in-writable-directory.asciidoc
new file mode 100644
index 0000000000..547cad22da
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-file-permission-modification-in-writable-directory.asciidoc
@@ -0,0 +1,112 @@
+[[prebuilt-rule-8-12-5-file-permission-modification-in-writable-directory]]
+=== File Permission Modification in Writable Directory
+
+Identifies file permission modifications in common writable directories by a non-root user. Adversaries often drop files or payloads into a writable directory and change permissions prior to execution.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 209
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:linux and event.category:process and event.type:start and
+process.name:(chattr or chgrp or chmod or chown) and process.working_directory:(/dev/shm or /tmp or /var/tmp) and
+not process.parent.name:(apt-key or update-motd-updates-available)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: File and Directory Permissions Modification
+** ID: T1222
+** Reference URL: https://attack.mitre.org/techniques/T1222/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-first-time-seen-newcredentials-logon-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-first-time-seen-newcredentials-logon-process.asciidoc
new file mode 100644
index 0000000000..1ebc319f39
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-first-time-seen-newcredentials-logon-process.asciidoc
@@ -0,0 +1,66 @@
+[[prebuilt-rule-8-12-5-first-time-seen-newcredentials-logon-process]]
+=== First Time Seen NewCredentials Logon Process
+
+Identifies a new credentials logon type performed by an unusual process. This may indicate the existence of an access token forging capability that are often abused to bypass access control restrictions.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/pt/blog/how-attackers-abuse-access-token-manipulation
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:"authentication" and host.os.type:"windows" and winlog.logon.type:"NewCredentials" and winlog.event_data.LogonProcessName:(Advapi* or "Advapi  ") and not winlog.event_data.SubjectUserName:*$ and not process.executable :???\\Program?Files*
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Access Token Manipulation
+** ID: T1134
+** Reference URL: https://attack.mitre.org/techniques/T1134/
+* Sub-technique:
+** Name: Token Impersonation/Theft
+** ID: T1134.001
+** Reference URL: https://attack.mitre.org/techniques/T1134/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-interactive-logon-by-an-unusual-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-interactive-logon-by-an-unusual-process.asciidoc
new file mode 100644
index 0000000000..941c07cb9c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-interactive-logon-by-an-unusual-process.asciidoc
@@ -0,0 +1,95 @@
+[[prebuilt-rule-8-12-5-interactive-logon-by-an-unusual-process]]
+=== Interactive Logon by an Unusual Process
+
+Identifies interactive logon attempt with alternate credentials and by an unusual process. Adversaries may create a new token to escalate privileges and bypass access controls.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.*
+* logs-windows.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://attack.mitre.org/techniques/T1134/002/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+Audit event 4624 is needed to trigger this rule.
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+authentication where 
+ host.os.type : "windows" and winlog.event_data.LogonProcessName : "Advapi*" and 
+ winlog.logon.type == "Interactive" and winlog.event_data.SubjectUserSid : ("S-1-5-21*", "S-1-12-*") and 
+ winlog.event_data.TargetUserSid : ("S-1-5-21*", "S-1-12-*")  and process.executable : "C:\\*" and 
+ not startswith~(winlog.event_data.SubjectUserSid, winlog.event_data.TargetUserSid) and 
+ not process.executable : 
+            ("?:\\Windows\\System32\\winlogon.exe", 
+             "?:\\Windows\\System32\\wininit.exe", 
+             "?:\\Program Files\\*.exe", 
+             "?:\\Program Files (x86)\\*.exe", 
+             "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe", 
+             "?:\\Windows\\System32\\inetsrv\\w3wp.exe", 
+             "?:\\Windows\\SysWOW64\\msiexec.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Access Token Manipulation
+** ID: T1134
+** Reference URL: https://attack.mitre.org/techniques/T1134/
+* Sub-technique:
+** Name: Create Process with Token
+** ID: T1134.002
+** Reference URL: https://attack.mitre.org/techniques/T1134/002/
+* Sub-technique:
+** Name: Make and Impersonate Token
+** ID: T1134.003
+** Reference URL: https://attack.mitre.org/techniques/T1134/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-kernel-driver-load-by-non-root-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-kernel-driver-load-by-non-root-user.asciidoc
new file mode 100644
index 0000000000..d4a456bb39
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-kernel-driver-load-by-non-root-user.asciidoc
@@ -0,0 +1,108 @@
+[[prebuilt-rule-8-12-5-kernel-driver-load-by-non-root-user]]
+=== Kernel Driver Load by non-root User
+
+Detects the loading of a Linux kernel module by a non-root user through system calls. Threat actors may leverage Linux kernel modules to load a rootkit on a system providing them with complete control and the ability to hide from security products. As other rules monitor for the addition of Linux kernel modules through system utilities or .ko files, this rule covers the gap that evasive rootkits leverage by monitoring for kernel module additions on the lowest level through auditd_manager.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Data Source: Auditd Manager
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Auditd Manager.
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule the following additional audit rules are required to be added to the integration:
+  -- "-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules"
+  -- "-a always,exit -F arch=b32 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules"
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+driver where host.os.type == "linux" and event.action == "loaded-kernel-module" and
+auditd.data.syscall in ("init_module", "finit_module") and user.id != "0"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Kernel Modules and Extensions
+** ID: T1547.006
+** Reference URL: https://attack.mitre.org/techniques/T1547/006/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Rootkit
+** ID: T1014
+** Reference URL: https://attack.mitre.org/techniques/T1014/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-kernel-module-removal.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-kernel-module-removal.asciidoc
new file mode 100644
index 0000000000..c16c7c274d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-kernel-module-removal.asciidoc
@@ -0,0 +1,116 @@
+[[prebuilt-rule-8-12-5-kernel-module-removal]]
+=== Kernel Module Removal
+
+Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This rule identifies attempts to remove a kernel module.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* http://man7.org/linux/man-pages/man8/modprobe.8.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.action in ("exec", "exec_event") and event.type == "start" and
+process.name == "rmmod" or (process.name == "modprobe" and process.args in ("--remove", "-r")) and 
+process.parent.name in ("sudo", "bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Kernel Modules and Extensions
+** ID: T1547.006
+** Reference URL: https://attack.mitre.org/techniques/T1547/006/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-linux-init-pid-1-secret-dump-via-gdb.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-linux-init-pid-1-secret-dump-via-gdb.asciidoc
new file mode 100644
index 0000000000..052fdbe3f8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-linux-init-pid-1-secret-dump-via-gdb.asciidoc
@@ -0,0 +1,104 @@
+[[prebuilt-rule-8-12-5-linux-init-pid-1-secret-dump-via-gdb]]
+=== Linux init (PID 1) Secret Dump via GDB
+
+This rule monitors for the potential memory dump of the init process (PID 1) through gdb. Attackers may leverage memory dumping techniques to attempt secret extraction from privileged processes. Tools that display this behavior include "truffleproc" and "bash-memory-dump". This behavior should not happen by default, and should be investigated thoroughly.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/controlplaneio/truffleproc
+* https://github.com/hajzer/bash-memory-dump
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.action in ("exec", "exec_event") and event.type == "start" and 
+process.name == "gdb" and process.args in ("--pid", "-p") and process.args == "1"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: Proc Filesystem
+** ID: T1003.007
+** Reference URL: https://attack.mitre.org/techniques/T1003/007/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-network-activity-detected-via-cat.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-network-activity-detected-via-cat.asciidoc
new file mode 100644
index 0000000000..854daedd32
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-network-activity-detected-via-cat.asciidoc
@@ -0,0 +1,181 @@
+[[prebuilt-rule-8-12-5-network-activity-detected-via-cat]]
+=== Network Activity Detected via cat
+
+This rule monitors for the execution of the cat command, followed by a connection attempt by the same process. Cat is capable of transfering data via tcp/udp channels by redirecting its read output to a /dev/tcp or /dev/udp channel. This activity is highly suspicious, and should be investigated. Attackers may leverage this capability to transfer tools or files to another host in the network or exfiltrate data while attempting to evade detection in the process.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Network Activity Detected via cat*
+
+
+Attackers may leverage the `cat` utility in conjunction with a listener to read all bytes of a file, and output the content to a `/dev/tcp` or `/dev/udp` channel to transfer/exfiltrate file contents to a remote system. 
+
+This rule looks for a sequence of a `cat` execution event followed by a network connection attempt by the same `cat` process. 
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
+
+
+- Identify any signs of suspicious network activity or anomalies that may indicate command and control activity or data exfiltration. This could include unexpected traffic patterns or unusual network behavior.
+  - Investigate listening ports and open sockets to look for potential protocol tunneling, reverse shells, or data exfiltration.
+    - !{osquery{"label":"Osquery - Retrieve Listening Ports","query":"SELECT pid, address, port, socket, protocol, path FROM listening_ports"}}
+    - !{osquery{"label":"Osquery - Retrieve Open Sockets","query":"SELECT pid, family, remote_address, remote_port, socket, state FROM process_open_sockets"}}
+- Identify the user account that performed the action, analyze it, and check whether it should perform this kind of action.
+  - !{osquery{"label":"Osquery - Retrieve Information for a Specific User","query":"SELECT * FROM users WHERE username = {{user.name}}"}}
+- Investigate whether the user is currently logged in and active.
+  - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
+  - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
+  - !{osquery{"label":"Osquery - Retrieve Process Info","query":"SELECT name, cmdline, parent, path, uid FROM processes"}}
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - If scripts or executables were dropped, retrieve the files and determine if they are malicious:
+    - Use a private sandboxed malware analysis system to perform analysis.
+      - Observe and collect information about the following activities:
+        - Attempts to contact external domains and addresses.
+          - Check if the domain is newly registered or unexpected.
+          - Check the reputation of the domain or IP address.
+        - File access, modification, and creation activities.
+
+
+*Related rules*
+
+
+- Suspicious Network Activity to the Internet by Previously Unknown Executable - 53617418-17b4-4e9c-8a2c-8deb8086ca4b
+
+
+*False positive analysis*
+
+
+- If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors, such as reverse shells, reverse proxies, or droppers, that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.entity_id with maxspan=1s
+  [process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and
+   process.name == "cat" and process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")]
+  [network where host.os.type == "linux" and event.action in ("connection_attempted", "disconnect_received") and
+   process.name == "cat" and not (destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
+     destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
+     "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
+     "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
+     "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
+     "FF00::/8"
+     )
+   )]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-defense-evasion-via-proot.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-defense-evasion-via-proot.asciidoc
new file mode 100644
index 0000000000..ea6b1ac918
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-defense-evasion-via-proot.asciidoc
@@ -0,0 +1,98 @@
+[[prebuilt-rule-8-12-5-potential-defense-evasion-via-proot]]
+=== Potential Defense Evasion via PRoot
+
+Identifies the execution of the PRoot utility, an open-source tool for user-space implementation of chroot, mount --bind, and binfmt_misc. Adversaries can leverage an open-source tool PRoot to expand the scope of their operations to multiple Linux distributions and simplify their necessary efforts. In a normal threat scenario, the scope of an attack is limited by the varying configurations of each Linux distribution. With PRoot, it provides an attacker with a consistent operational environment across different Linux distributions, such as Ubuntu, Fedora, and Alpine. PRoot also provides emulation capabilities that allow for malware built on other architectures, such as ARM, to be run.The post-exploitation technique called bring your own filesystem (BYOF), can be used by the threat actors to execute malicious payload or elevate privileges or perform network scans or orchestrate another attack on the environment. Although PRoot was originally not developed with malicious intent it can be easily tuned to work for one.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://proot-me.github.io/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.action in ("exec", "exec_event") and process.parent.name == "proot"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Exploitation for Defense Evasion
+** ID: T1211
+** Reference URL: https://attack.mitre.org/techniques/T1211/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-disabling-of-apparmor.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-disabling-of-apparmor.asciidoc
new file mode 100644
index 0000000000..f496cd1b63
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-disabling-of-apparmor.asciidoc
@@ -0,0 +1,107 @@
+[[prebuilt-rule-8-12-5-potential-disabling-of-apparmor]]
+=== Potential Disabling of AppArmor
+
+This rule monitors for potential attempts to disable AppArmor. AppArmor is a Linux security module that enforces fine-grained access control policies to restrict the actions and resources that specific applications and processes can access. Adversaries may disable security tools to avoid possible detection of their tools and activities.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Auditd Manager
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.action in ("exec", "exec_event", "executed") and event.type == "start"
+and (
+  (process.name == "systemctl" and process.args == "disable" and process.args == "apparmor") or
+  (process.name == "ln" and process.args : "/etc/apparmor.d/*" and process.args == "/etc/apparmor.d/disable/")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-disabling-of-selinux.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-disabling-of-selinux.asciidoc
new file mode 100644
index 0000000000..9551cb09b4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-disabling-of-selinux.asciidoc
@@ -0,0 +1,120 @@
+[[prebuilt-rule-8-12-5-potential-disabling-of-selinux]]
+=== Potential Disabling of SELinux
+
+Identifies potential attempts to disable Security-Enhanced Linux (SELinux), which is a Linux kernel security feature to support access control policies. Adversaries may disable security tools to avoid possible detection of their tools and activities.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Auditd Manager
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type in ("start", "process_started") and
+process.name == "setenforce" and process.args == "0"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-hidden-process-via-mount-hidepid.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-hidden-process-via-mount-hidepid.asciidoc
new file mode 100644
index 0000000000..9470688625
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-hidden-process-via-mount-hidepid.asciidoc
@@ -0,0 +1,102 @@
+[[prebuilt-rule-8-12-5-potential-hidden-process-via-mount-hidepid]]
+=== Potential Hidden Process via Mount Hidepid
+
+Identifies the execution of mount process with hidepid parameter, which can make processes invisible to other users from the system. Adversaries using Linux kernel version 3.2+ (or RHEL/CentOS v6.5+ above) can hide the process from other users. When hidepid=2 option is executed to mount the /proc filesystem, only the root user can see all processes and the logged-in user can only see their own process. This provides a defense evasion mechanism for the adversaries to hide their process executions from all other commands such as ps, top, pgrep and more. With the Linux kernel hardening hidepid option all the user has to do is remount the /proc filesystem with the option, which can now be monitored and detected.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Auditd Manager
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.action in ("exec", "exec_event", "executed") and event.type == "start" 
+and process.name == "mount" and process.args == "/proc" and process.args == "-o" and process.args : "*hidepid=2*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-credential-dumping-via-proc-filesystem.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-credential-dumping-via-proc-filesystem.asciidoc
new file mode 100644
index 0000000000..f93db1d3fe
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-credential-dumping-via-proc-filesystem.asciidoc
@@ -0,0 +1,110 @@
+[[prebuilt-rule-8-12-5-potential-linux-credential-dumping-via-proc-filesystem]]
+=== Potential Linux Credential Dumping via Proc Filesystem
+
+Identifies the execution of the mimipenguin exploit script which is linux adaptation of Windows tool mimikatz. Mimipenguin exploit script is used to dump clear text passwords from a currently logged-in user. The tool exploits a known vulnerability CVE-2018-20781. Malicious actors can exploit the cleartext credentials in memory by dumping the process and extracting lines that have a high probability of containing cleartext passwords.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/huntergregal/mimipenguin
+* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20781
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.parent.name with maxspan=1m
+  [process where host.os.type == "linux" and process.name == "ps" and event.action == "exec"
+   and process.args in ("-eo", "pid", "command")]
+  [process where host.os.type == "linux" and process.name == "strings" and event.action == "exec"
+   and process.args : "/tmp/*"]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: Proc Filesystem
+** ID: T1003.007
+** Reference URL: https://attack.mitre.org/techniques/T1003/007/
+* Technique:
+** Name: Exploitation for Credential Access
+** ID: T1212
+** Reference URL: https://attack.mitre.org/techniques/T1212/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-credential-dumping-via-unshadow.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-credential-dumping-via-unshadow.asciidoc
new file mode 100644
index 0000000000..8f1ebf98f9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-credential-dumping-via-unshadow.asciidoc
@@ -0,0 +1,103 @@
+[[prebuilt-rule-8-12-5-potential-linux-credential-dumping-via-unshadow]]
+=== Potential Linux Credential Dumping via Unshadow
+
+Identifies the execution of the unshadow utility which is part of John the Ripper, a password-cracking tool on the host machine. Malicious actors can use the utility to retrieve the combined contents of the '/etc/shadow' and '/etc/password' files. Using the combined file generated from the utility, the malicious threat actors can use them as input for password-cracking utilities or prepare themselves for future operations by gathering credential information of the victim.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event") and
+process.name == "unshadow" and process.args_count >= 3
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: /etc/passwd and /etc/shadow
+** ID: T1003.008
+** Reference URL: https://attack.mitre.org/techniques/T1003/008/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-local-account-brute-force-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-local-account-brute-force-detected.asciidoc
new file mode 100644
index 0000000000..fc8f112662
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-local-account-brute-force-detected.asciidoc
@@ -0,0 +1,104 @@
+[[prebuilt-rule-8-12-5-potential-linux-local-account-brute-force-detected]]
+=== Potential Linux Local Account Brute Force Detected
+
+Identifies multiple consecutive login attempts executed by one process targeting a local linux user account within a short time interval. Adversaries might brute force login attempts across different users with a default wordlist or a set of customly crafted passwords in an attempt to gain access to these accounts.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.parent.executable, user.id with maxspan=1s
+  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "su" and 
+   not process.parent.name in (
+     "bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "clickhouse-server", "ma", "gitlab-runner",
+     "updatedb.findutils", "cron"
+   )
+  ] with runs=10
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Guessing
+** ID: T1110.001
+** Reference URL: https://attack.mitre.org/techniques/T1110/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-tunneling-and-or-port-forwarding.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-tunneling-and-or-port-forwarding.asciidoc
new file mode 100644
index 0000000000..afa6394451
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-linux-tunneling-and-or-port-forwarding.asciidoc
@@ -0,0 +1,193 @@
+[[prebuilt-rule-8-12-5-potential-linux-tunneling-and-or-port-forwarding]]
+=== Potential Linux Tunneling and/or Port Forwarding
+
+This rule monitors for a set of Linux utilities that can be used for tunneling and port forwarding. Attackers can leverage tunneling and port forwarding techniques to bypass network defenses, establish hidden communication channels, and gain unauthorized access to internal resources, facilitating data exfiltration, lateral movement, and remote control.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform
+* https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential Linux Tunneling and/or Port Forwarding*
+
+
+Attackers can leverage many utilities to clandestinely tunnel network communications and evade security measures, potentially gaining unauthorized access to sensitive systems.
+
+This rule looks for several utilities that are capable of setting up tunnel network communications by analyzing process names or command line arguments. 
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
+
+
+- Identify any signs of suspicious network activity or anomalies that may indicate protocol tunneling. This could include unexpected traffic patterns or unusual network behavior.
+  - Investigate listening ports and open sockets to look for potential protocol tunneling, reverse shells, or data exfiltration.
+    - !{osquery{"label":"Osquery - Retrieve Listening Ports","query":"SELECT pid, address, port, socket, protocol, path FROM listening_ports"}}
+    - !{osquery{"label":"Osquery - Retrieve Open Sockets","query":"SELECT pid, family, remote_address, remote_port, socket, state FROM process_open_sockets"}}
+- Identify the user account that performed the action, analyze it, and check whether it should perform this kind of action.
+  - !{osquery{"label":"Osquery - Retrieve Information for a Specific User","query":"SELECT * FROM users WHERE username = {{user.name}}"}}
+- Investigate whether the user is currently logged in and active.
+  - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
+  - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
+  - !{osquery{"label":"Osquery - Retrieve Process Info","query":"SELECT name, cmdline, parent, path, uid FROM processes"}}
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - If scripts or executables were dropped, retrieve the files and determine if they are malicious:
+    - Use a private sandboxed malware analysis system to perform analysis.
+      - Observe and collect information about the following activities:
+        - Attempts to contact external domains and addresses.
+          - Check if the domain is newly registered or unexpected.
+          - Check the reputation of the domain or IP address.
+        - File access, modification, and creation activities.
+
+
+*Related rules*
+
+
+- Potential Protocol Tunneling via Chisel Client - 3f12325a-4cc6-410b-8d4c-9fbbeb744cfd
+- Potential Protocol Tunneling via Chisel Server - ac8805f6-1e08-406c-962e-3937057fa86f
+- Potential Protocol Tunneling via EarthWorm - 9f1c4ca3-44b5-481d-ba42-32dc215a2769
+- Suspicious Utility Launched via ProxyChains - 6ace94ba-f02c-4d55-9f53-87d99b6f9af4
+- ProxyChains Activity - 4b868f1f-15ff-4ba3-8c11-d5a7a6356d37
+
+
+*False positive analysis*
+
+
+- If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+- If this activity is related to a system administrator or developer who uses port tunneling/forwarding for benign purposes, consider adding exceptions for specific user accounts or hosts. 
+- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors, such as reverse shells, reverse proxies, or droppers, that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.action in ("exec", "exec_event") and
+event.type == "start" and (
+  (
+    // gost & pivotnacci - spawned without process.parent.name
+    (process.name == "gost" and process.args : ("-L*", "-C*", "-R*")) or (process.name == "pivotnacci")) or (
+    // ssh
+    (process.name in ("ssh", "sshd") and (process.args in ("-R", "-L", "D", "-w") and process.args_count >= 4 and 
+     not process.args : "chmod")) or
+    // sshuttle
+    (process.name == "sshuttle" and process.args in ("-r", "--remote", "-l", "--listen") and process.args_count >= 4) or
+    // socat
+    (process.name == "socat" and process.args : ("TCP4-LISTEN:*", "SOCKS*") and process.args_count >= 3) or
+    // chisel
+    (process.name : "chisel*" and process.args in ("client", "server")) or
+    // iodine(d), dnscat, hans, ptunnel-ng, ssf, 3proxy & ngrok 
+    (process.name in ("iodine", "iodined", "dnscat", "hans", "hans-ubuntu", "ptunnel-ng", "ssf", "3proxy", "ngrok"))
+  ) and process.parent.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Protocol Tunneling
+** ID: T1572
+** Reference URL: https://attack.mitre.org/techniques/T1572/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-masquerading-as-business-app-installer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-masquerading-as-business-app-installer.asciidoc
new file mode 100644
index 0000000000..5cd1f97323
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-masquerading-as-business-app-installer.asciidoc
@@ -0,0 +1,217 @@
+[[prebuilt-rule-8-12-5-potential-masquerading-as-business-app-installer]]
+=== Potential Masquerading as Business App Installer
+
+Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers
+
+*Tags*: 
+
+* Domain: Endpoint
+* Data Source: Elastic Defend
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Initial Access
+* Tactic: Execution
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and
+  event.type == "start" and process.executable : "?:\\Users\\*\\Downloads\\*" and
+  not process.code_signature.status : ("errorCode_endpoint*", "errorUntrustedRoot", "errorChaining") and
+  (
+    /* Slack */
+    (process.name : "*slack*.exe" and not
+      (process.code_signature.subject_name in (
+        "Slack Technologies, Inc.",
+        "Slack Technologies, LLC"
+       ) and process.code_signature.trusted == true)
+    ) or
+
+    /* WebEx */
+    (process.name : "*webex*.exe" and not
+      (process.code_signature.subject_name in ("Cisco WebEx LLC", "Cisco Systems, Inc.") and process.code_signature.trusted == true)
+    ) or
+
+    /* Teams */
+    (process.name : "teams*.exe" and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Discord */
+    (process.name : "*discord*.exe" and not
+      (process.code_signature.subject_name == "Discord Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* WhatsApp */
+    (process.name : "*whatsapp*.exe" and not
+      (process.code_signature.subject_name in (
+        "WhatsApp LLC",
+        "WhatsApp, Inc",
+        "24803D75-212C-471A-BC57-9EF86AB91435"
+       ) and process.code_signature.trusted == true)
+    ) or
+
+    /* Zoom */
+    (process.name : ("*zoom*installer*.exe", "*zoom*setup*.exe", "zoom.exe")  and not
+      (process.code_signature.subject_name == "Zoom Video Communications, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* Outlook */
+    (process.name : "*outlook*.exe" and not
+      (
+        (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) or
+        (
+          process.name: "MSOutlookHelp-PST-Viewer.exe" and process.code_signature.subject_name == "Aryson Technologies Pvt. Ltd" and
+          process.code_signature.trusted == true
+        )
+      )
+    ) or
+
+    /* Thunderbird */
+    (process.name : "*thunderbird*.exe" and not
+      (process.code_signature.subject_name == "Mozilla Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Grammarly */
+    (process.name : "*grammarly*.exe" and not
+      (process.code_signature.subject_name == "Grammarly, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* Dropbox */
+    (process.name : "*dropbox*.exe" and not
+      (process.code_signature.subject_name == "Dropbox, Inc" and process.code_signature.trusted == true)
+    ) or
+
+    /* Tableau */
+    (process.name : "*tableau*.exe" and not
+      (process.code_signature.subject_name == "Tableau Software LLC" and process.code_signature.trusted == true)
+    ) or
+
+    /* Google Drive */
+    (process.name : "*googledrive*.exe" and not
+      (process.code_signature.subject_name == "Google LLC" and process.code_signature.trusted == true)
+    ) or
+
+    /* MSOffice */
+    (process.name : "*office*setup*.exe" and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Okta */
+    (process.name : "*okta*.exe" and not
+      (process.code_signature.subject_name == "Okta, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* OneDrive */
+    (process.name : "*onedrive*.exe" and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Chrome */
+    (process.name : "*chrome*.exe" and not
+      (process.code_signature.subject_name in ("Google LLC", "Google Inc") and process.code_signature.trusted == true)
+    ) or
+
+    /* Firefox */
+    (process.name : "*firefox*.exe" and not
+      (process.code_signature.subject_name == "Mozilla Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Edge */
+    (process.name : ("*microsoftedge*.exe", "*msedge*.exe") and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Brave */
+    (process.name : "*brave*.exe" and not
+      (process.code_signature.subject_name == "Brave Software, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* GoogleCloud Related Tools */
+    (process.name : "*GoogleCloud*.exe" and not
+      (process.code_signature.subject_name == "Google LLC" and process.code_signature.trusted == true)
+    ) or
+
+    /* Github Related Tools */
+    (process.name : "*github*.exe" and not
+      (process.code_signature.subject_name == "GitHub, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* Notion */
+    (process.name : "*notion*.exe" and not
+      (process.code_signature.subject_name == "Notion Labs, Inc." and process.code_signature.trusted == true)
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Invalid Code Signature
+** ID: T1036.001
+** Reference URL: https://attack.mitre.org/techniques/T1036/001/
+* Sub-technique:
+** Name: Match Legitimate Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Drive-by Compromise
+** ID: T1189
+** Reference URL: https://attack.mitre.org/techniques/T1189/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: User Execution
+** ID: T1204
+** Reference URL: https://attack.mitre.org/techniques/T1204/
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-meterpreter-reverse-shell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-meterpreter-reverse-shell.asciidoc
new file mode 100644
index 0000000000..f4e0f31b55
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-meterpreter-reverse-shell.asciidoc
@@ -0,0 +1,129 @@
+[[prebuilt-rule-8-12-5-potential-meterpreter-reverse-shell]]
+=== Potential Meterpreter Reverse Shell
+
+This detection rule identifies a sample of suspicious Linux system file reads used for system fingerprinting, leveraged by the Metasploit Meterpreter shell to gather information about the target that it is executing its shell on. Detecting this pattern is indicative of a successful meterpreter shell connection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Data Source: Auditd Manager
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Auditbeat
+- Auditd Manager
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule the following additional audit rules are required to be added to the integration:
+  -w /proc/net/ -p r -k audit_proc
+  -w /etc/machine-id -p wa -k machineid
+  -w /etc/passwd -p wa -k passwd
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sample by host.id, process.pid, user.id
+  [file where host.os.type == "linux" and auditd.data.syscall == "open" and auditd.data.a2 == "1b6" and file.path == "/etc/machine-id"]
+  [file where host.os.type == "linux" and auditd.data.syscall == "open" and auditd.data.a2 == "1b6" and file.path == "/etc/passwd"]
+  [file where host.os.type == "linux" and auditd.data.syscall == "open" and auditd.data.a2 == "1b6" and file.path == "/proc/net/route"]
+  [file where host.os.type == "linux" and auditd.data.syscall == "open" and auditd.data.a2 == "1b6" and file.path == "/proc/net/ipv6_route"]
+  [file where host.os.type == "linux" and auditd.data.syscall == "open" and auditd.data.a2 == "1b6" and file.path == "/proc/net/if_inet6"]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-pspy-process-monitoring-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-pspy-process-monitoring-detected.asciidoc
new file mode 100644
index 0000000000..1c3c15b811
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-pspy-process-monitoring-detected.asciidoc
@@ -0,0 +1,101 @@
+[[prebuilt-rule-8-12-5-potential-pspy-process-monitoring-detected]]
+=== Potential Pspy Process Monitoring Detected
+
+This rule leverages auditd to monitor for processes scanning different processes within the /proc directory using the openat syscall. This is a strong indication for the usage of the pspy utility. Attackers may leverage the pspy process monitoring utility to monitor system processes without requiring root permissions, in order to find potential privilege escalation vectors.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-auditd_manager.auditd-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/DominicBreuker/pspy
+
+*Tags*: 
+
+* Data Source: Auditd Manager
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Auditd Manager.
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule the following additional audit rules are required to be added to the integration:
+  -- "-w /proc/ -p r -k audit_proc"
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by process.pid, host.id with maxspan=5s
+  [file where host.os.type == "linux" and auditd.data.syscall == "openat" and file.path == "/proc" and
+   auditd.data.a0 : ("ffffffffffffff9c", "ffffff9c") and auditd.data.a2 : ("80000", "88000") ] with runs=10
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Process Discovery
+** ID: T1057
+** Reference URL: https://attack.mitre.org/techniques/T1057/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-remote-file-execution-via-msiexec.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-remote-file-execution-via-msiexec.asciidoc
new file mode 100644
index 0000000000..cb094a5f9c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-remote-file-execution-via-msiexec.asciidoc
@@ -0,0 +1,106 @@
+[[prebuilt-rule-8-12-5-potential-remote-file-execution-via-msiexec]]
+=== Potential Remote File Execution via MSIEXEC
+
+Identifies the execution of the built-in Windows Installer, msiexec.exe, to install a remote package. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence with maxspan=1m
+ [process where host.os.type == "windows" and event.action == "start" and
+    process.name : "msiexec.exe" and process.args : "/V"] by process.entity_id
+ [network where host.os.type == "windows" and process.name : "msiexec.exe" and
+    event.action == "connection_attempted"] by process.entity_id
+ [process where host.os.type == "windows" and event.action == "start" and
+  process.parent.name : "msiexec.exe" and user.id : ("S-1-5-21-*", "S-1-5-12-1-*") and
+  not process.executable : ("?:\\Windows\\SysWOW64\\msiexec.exe",
+                            "?:\\Windows\\System32\\msiexec.exe",
+                            "?:\\Windows\\System32\\srtasks.exe",
+                            "?:\\Windows\\SysWOW64\\srtasks.exe",
+                            "?:\\Windows\\System32\\taskkill.exe",
+                            "?:\\Windows\\Installer\\MSI*.tmp",
+                            "?:\\Program Files\\*.exe",
+                            "?:\\Program Files (x86)\\*.exe",
+                            "?:\\Windows\\System32\\ie4uinit.exe",
+                            "?:\\Windows\\SysWOW64\\ie4uinit.exe",
+                            "?:\\Windows\\System32\\sc.exe",
+                            "?:\\Windows\\system32\\Wbem\\mofcomp.exe",
+                            "?:\\Windows\\twain_32\\fjscan32\\SOP\\crtdmprc.exe",
+                            "?:\\Windows\\SysWOW64\\taskkill.exe",
+                            "?:\\Windows\\SysWOW64\\schtasks.exe",
+                            "?:\\Windows\\system32\\schtasks.exe",
+                            "?:\\Windows\\System32\\sdbinst.exe") and
+  not (process.code_signature.subject_name == "Citrix Systems, Inc." and process.code_signature.trusted == true) and
+  not (process.name : ("regsvr32.exe", "powershell.exe", "rundll32.exe", "wscript.exe") and
+       process.Ext.token.integrity_level_name == "high" and
+       process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
+  not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and process.code_signature.trusted == true) and
+  not (process.name : "rundll32.exe" and process.args : "printui.dll,PrintUIEntry")
+  ] by process.parent.entity_id
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Sub-technique:
+** Name: Msiexec
+** ID: T1218.007
+** Reference URL: https://attack.mitre.org/techniques/T1218/007/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-reverse-shell-via-udp.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-reverse-shell-via-udp.asciidoc
new file mode 100644
index 0000000000..b30e733dde
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-reverse-shell-via-udp.asciidoc
@@ -0,0 +1,139 @@
+[[prebuilt-rule-8-12-5-potential-reverse-shell-via-udp]]
+=== Potential Reverse Shell via UDP
+
+This detection rule identifies suspicious network traffic patterns associated with UDP reverse shell activity. This activity consists of a sample of an execve, socket and connect syscall executed by the same process, where the auditd.data.a0-1 indicate a UDP connection, ending with an egress connection event. An attacker may establish a Linux UDP reverse shell to bypass traditional firewall restrictions and gain remote access to a target system covertly.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
+
+*Tags*: 
+
+* Data Source: Auditd Manager
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Auditbeat
+- Auditd Manager
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule no additional audit rules are required to be added to the integration.
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sample by host.id, process.pid, process.parent.pid
+  [process where host.os.type == "linux" and auditd.data.syscall == "execve" and process.name : (
+     "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "perl", "python*", "nc", "ncat", "netcat", "php*",
+     "ruby", "openssl", "awk", "telnet", "lua*", "socat"
+   )
+  ]
+  [process where host.os.type == "linux" and auditd.data.syscall == "socket" and process.name : (
+     "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "perl", "python*", "nc", "ncat", "netcat", "php*",
+     "ruby", "openssl", "awk", "telnet", "lua*", "socat"
+   ) and
+   auditd.data.a0 == "2" and auditd.data.a1 : ("2", "802")]
+[network where host.os.type == "linux" and auditd.data.syscall == "connect" and process.name : (
+   "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "perl", "python*", "nc", "ncat", "netcat", "php*",
+   "ruby", "openssl", "awk", "telnet", "lua*", "socat"
+ ) and
+ network.direction == "egress" and destination.ip != null and destination.ip != "127.0.0.1" and
+ destination.ip != "127.0.0.53" and destination.ip != "::1"]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-successful-linux-ftp-brute-force-attack-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
new file mode 100644
index 0000000000..763cecb735
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
@@ -0,0 +1,123 @@
+[[prebuilt-rule-8-12-5-potential-successful-linux-ftp-brute-force-attack-detected]]
+=== Potential Successful Linux FTP Brute Force Attack Detected
+
+An FTP (file transfer protocol) brute force attack is a method where an attacker systematically tries different combinations of usernames and passwords to gain unauthorized access to an FTP server, and if successful, the impact can include unauthorized data access, manipulation, or theft, compromising the security and integrity of the server and potentially exposing sensitive information. This rule identifies multiple consecutive authentication failures targeting a specific user account from the same source address and within a short time interval, followed by a successful authentication.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Data Source: Auditd Manager
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Auditbeat
+- Auditd Manager
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule no additional audit rules are required to be added to the integration.
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, auditd.data.addr, related.user with maxspan=5s
+  [authentication where host.os.type == "linux" and event.action == "authenticated" and
+   auditd.data.terminal == "ftp" and event.outcome == "failure" and auditd.data.addr != null and
+   auditd.data.addr != "0.0.0.0" and auditd.data.addr != "::"] with runs=10
+  [authentication where host.os.type == "linux" and event.action  == "authenticated" and
+   auditd.data.terminal == "ftp" and event.outcome == "success" and auditd.data.addr != null and
+   auditd.data.addr != "0.0.0.0" and auditd.data.addr != "::"] | tail 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Guessing
+** ID: T1110.001
+** Reference URL: https://attack.mitre.org/techniques/T1110/001/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-successful-linux-rdp-brute-force-attack-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
new file mode 100644
index 0000000000..fcac01f26f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
@@ -0,0 +1,121 @@
+[[prebuilt-rule-8-12-5-potential-successful-linux-rdp-brute-force-attack-detected]]
+=== Potential Successful Linux RDP Brute Force Attack Detected
+
+An RDP (Remote Desktop Protocol) brute force attack involves an attacker repeatedly attempting various username and password combinations to gain unauthorized access to a remote computer via RDP, and if successful, the potential impact can include unauthorized control over the compromised system, data theft, or the ability to launch further attacks within the network, jeopardizing the security and confidentiality of the targeted system and potentially compromising the entire network infrastructure. This rule identifies multiple consecutive authentication failures targeting a specific user account within a short time interval, followed by a successful authentication.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Data Source: Auditd Manager
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Auditbeat
+- Auditd Manager
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule no additional audit rules are required to be added to the integration.
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, related.user with maxspan=5s
+  [authentication where host.os.type == "linux" and event.action == "authenticated" and
+   auditd.data.terminal : "*rdp*" and event.outcome == "failure"] with runs=10
+  [authentication where host.os.type == "linux" and event.action  == "authenticated" and
+   auditd.data.terminal : "*rdp*" and event.outcome == "success"] | tail 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Guessing
+** ID: T1110.001
+** Reference URL: https://attack.mitre.org/techniques/T1110/001/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-privilege-escalation-via-cap-chown-cap-fowner-capabilities.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-privilege-escalation-via-cap-chown-cap-fowner-capabilities.asciidoc
new file mode 100644
index 0000000000..865a3f6e28
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-privilege-escalation-via-cap-chown-cap-fowner-capabilities.asciidoc
@@ -0,0 +1,108 @@
+[[prebuilt-rule-8-12-5-privilege-escalation-via-cap-chown-cap-fowner-capabilities]]
+=== Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities
+
+Identifies instances where a processes (granted CAP_CHOWN and/or CAP_FOWNER capabilities) is executed, after which the ownership of a suspicious file or binary is changed. In Linux, the CAP_CHOWN capability allows a process to change the owner of a file, while CAP_FOWNER permits it to bypass permission checks on operations that require file ownership (like reading, writing, and executing). Attackers may abuse these capabilities to obtain unauthorized access to files.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Data Source: Auditd Manager
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Auditd Manager.
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule the following additional audit rules are required to be added to the integration:
+  -- "-w /etc/ -p rwxa -k audit_recursive_etc"
+  -- "-w /root/ -p rwxa -k audit_root"
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.pid with maxspan=1s
+  [process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and
+   process.name != null and process.thread.capabilities.effective : ("CAP_CHOWN", "CAP_FOWNER") and
+   process.command_line : ("*sudoers*", "*passwd*", "*shadow*", "*/root/*") and user.id != "0"]
+  [file where host.os.type == "linux" and event.action == "changed-file-ownership-of" and event.type == "change" and
+   event.outcome == "success" and file.path in (
+     "/etc/passwd",
+     "/etc/shadow",
+     "/etc/sudoers",
+     "/root/.ssh/*"
+   ) and user.id != "0"
+  ]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-process-created-with-a-duplicated-token.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-process-created-with-a-duplicated-token.asciidoc
new file mode 100644
index 0000000000..cabea85d34
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-process-created-with-a-duplicated-token.asciidoc
@@ -0,0 +1,95 @@
+[[prebuilt-rule-8-12-5-process-created-with-a-duplicated-token]]
+=== Process Created with a Duplicated Token
+
+Identifies the creation of a process impersonating the token of another user logon session. Adversaries may create a new process with a different token to escalate privileges and bypass access controls.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* This rule is only compatible with Elastic Endpoint 8.4+ */
+
+process where host.os.type == "windows" and event.action == "start" and
+
+ user.id : ("S-1-5-21-*", "S-1-12-1-*") and
+
+ (process.Ext.effective_parent.executable regex~ """[C-Z]:\\Windows\\(System32|SysWOW64)\\[a-zA-Z0-9\-\_\.]+\.exe""" or
+  process.Ext.effective_parent.executable : "?:\\Windows\\explorer.exe") and
+
+ (
+  process.name : ("powershell.exe", "cmd.exe", "rundll32.exe", "notepad.exe", "net.exe", "ntdsutil.exe",
+                  "tasklist.exe", "reg.exe", "certutil.exe", "bitsadmin.exe", "msbuild.exe", "esentutl.exe") or
+
+  ((process.Ext.relative_file_creation_time <= 900 or process.Ext.relative_file_name_modify_time <= 900) and
+   not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
+   not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*"))
+ ) and
+ not (process.name : "rundll32.exe" and
+      process.command_line : ("*davclnt.dll,DavSetCookie*", "*?:\\Program Files*",
+                              "*\\Windows\\System32\\winethc.dll*", "*\\Windows\\SYSTEM32\\EDGEHTML.dll*",
+                              "*shell32.dll,SHCreateLocalServerRunDll*")) and
+ not startswith~(process.Ext.effective_parent.name, process.parent.name) and 
+ not (process.name : "powershell.exe" and process.parent.name : "wmiprvse.exe" and process.Ext.effective_parent.executable : "?:\\Windows\\System32\\wsmprovhost.exe") and 
+ not (process.Ext.effective_parent.executable : "?:\\Windows\\System32\\RuntimeBroker.exe" and process.parent.executable : "?:\\Windows\\System32\\sihost.exe") and 
+ not (process.Ext.effective_parent.executable : "?:\\Windows\\System32\\sethc.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and 
+ not (process.Ext.effective_parent.executable : "?:\\Windows\\explorer.exe" and 
+      process.parent.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\msiexec.exe", "?:\\Windows\\twain_32\\*.exe"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Access Token Manipulation
+** ID: T1134
+** Reference URL: https://attack.mitre.org/techniques/T1134/
+* Sub-technique:
+** Name: Token Impersonation/Theft
+** ID: T1134.001
+** Reference URL: https://attack.mitre.org/techniques/T1134/001/
+* Sub-technique:
+** Name: Create Process with Token
+** ID: T1134.002
+** Reference URL: https://attack.mitre.org/techniques/T1134/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-remote-xsl-script-execution-via-com.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-remote-xsl-script-execution-via-com.asciidoc
new file mode 100644
index 0000000000..7ed962a97c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-remote-xsl-script-execution-via-com.asciidoc
@@ -0,0 +1,83 @@
+[[prebuilt-rule-8-12-5-remote-xsl-script-execution-via-com]]
+=== Remote XSL Script Execution via COM
+
+Identifies the execution of a hosted XSL script using the Microsoft.XMLDOM COM interface via Microsoft Office processes. This behavior may indicate adversarial activity to execute malicious JScript or VBScript on the system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence with maxspan=1m
+ [library where host.os.type == "windows" and dll.name : "msxml3.dll" and
+  process.name : ("winword.exe", "excel.exe", "powerpnt.exe", "mspub.exe")] by process.entity_id
+ [process where host.os.type == "windows" and event.action == "start" and
+  process.parent.name : ("winword.exe", "excel.exe", "powerpnt.exe", "mspub.exe") and 
+  not process.executable :
+        ("?:\\Windows\\System32\\WerFault.exe",
+         "?:\\Windows\\SysWoW64\\WerFault.exe",
+         "?:\\windows\\splwow64.exe",
+         "?:\\Windows\\System32\\conhost.exe",
+         "?:\\Program Files\\*.exe",
+         "?:\\Program Files (x86)\\*exe")] by process.parent.entity_id
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: XSL Script Processing
+** ID: T1220
+** Reference URL: https://attack.mitre.org/techniques/T1220/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-antimalware-scan-interface-dll.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-antimalware-scan-interface-dll.asciidoc
new file mode 100644
index 0000000000..0845672714
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-antimalware-scan-interface-dll.asciidoc
@@ -0,0 +1,141 @@
+[[prebuilt-rule-8-12-5-suspicious-antimalware-scan-interface-dll]]
+=== Suspicious Antimalware Scan Interface DLL
+
+Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Antimalware Scan Interface DLL*
+
+
+The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product on a machine. AMSI integrates with multiple Windows components, ranging from User Account Control (UAC) to VBA macros and PowerShell.
+
+Attackers might copy a rogue AMSI DLL to an unusual location to prevent the process from loading the legitimate module, achieving a bypass to execute malicious code.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Identify the process that created the DLL and which account was used.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the execution of scripts and macros after the registry modification.
+- Investigate other processes launched from the directory that the DLL was created.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe:
+  - Observe and collect information about the following activities in the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+
+
+*False positive analysis*
+
+
+- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team as these modifications expose the host to malware infections.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and file.path != null and
+ file.name : ("amsi.dll", "amsi") and not file.path : ("?:\\Windows\\system32\\amsi.dll", "?:\\Windows\\Syswow64\\amsi.dll", "?:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSXS\\*", "?:\\$WINDOWS.~BT\\NewOS\\Windows\\servicing\\LCU\\*", "?:\\$WINDOWS.~BT\\Work\\*\\*", "?:\\Windows\\SoftwareDistribution\\Download\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL Search Order Hijacking
+** ID: T1574.001
+** Reference URL: https://attack.mitre.org/techniques/T1574/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-execution-from-inet-cache.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-execution-from-inet-cache.asciidoc
new file mode 100644
index 0000000000..ecc4981341
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-execution-from-inet-cache.asciidoc
@@ -0,0 +1,82 @@
+[[prebuilt-rule-8-12-5-suspicious-execution-from-inet-cache]]
+=== Suspicious Execution from INET Cache
+
+Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious content via WININET during initial access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Command and Control
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and  
+ process.parent.name : ("explorer.exe", "winrar.exe", "7zFM.exe", "Bandizip.exe") and
+  (process.args : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" or
+   process.executable : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-passwd-file-event-action.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-passwd-file-event-action.asciidoc
new file mode 100644
index 0000000000..03ed0a1e1a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-passwd-file-event-action.asciidoc
@@ -0,0 +1,127 @@
+[[prebuilt-rule-8-12-5-suspicious-passwd-file-event-action]]
+=== Suspicious Passwd File Event Action
+
+Monitors for the generation of a passwd password entry via openssl, followed by a file write activity on the "/etc/passwd" file. The "/etc/passwd" file in Linux stores user account information, including usernames, user IDs, group IDs, home directories, and default shell paths. Attackers may exploit a misconfiguration in the "/etc/passwd" file permissions or other privileges to add a new entry to the "/etc/passwd" file with root permissions, and leverage this new user account to login as root.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Data Source: Auditd Manager
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend and Auditd Manager.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule the following additional audit rules are required to be added to the integration:
+  -- "-w /etc/passwd -p wa -k etcpasswd"
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.parent.pid with maxspan=1m
+  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
+   process.name == "openssl" and process.args == "passwd" and user.id != "0"]
+  [file where host.os.type == "linux" and file.path == "/etc/passwd" and process.parent.pid != 1 and
+   not auditd.data.a2 == "80000" and event.outcome == "success" and user.id != "0"]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-utility-launched-via-proxychains.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-utility-launched-via-proxychains.asciidoc
new file mode 100644
index 0000000000..7aa21415a1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-suspicious-utility-launched-via-proxychains.asciidoc
@@ -0,0 +1,183 @@
+[[prebuilt-rule-8-12-5-suspicious-utility-launched-via-proxychains]]
+=== Suspicious Utility Launched via ProxyChains
+
+This rule monitors for the execution of suspicious linux tools through ProxyChains. ProxyChains is a command-line tool that enables the routing of network connections through intermediary proxies, enhancing anonymity and enabling access to restricted resources. Attackers can exploit the ProxyChains utility to hide their true source IP address, evade detection, and perform malicious activities through a chain of proxy servers, potentially masking their identity and intentions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* endgame-*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Auditd Manager
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Utility Launched via ProxyChains*
+
+
+Attackers can leverage `proxychains` to obfuscate their origin and bypass network defenses by routing their malicious traffic through multiple intermediary servers.
+
+This rule looks for a list of suspicious processes spawned through `proxychains` by analyzing process command line arguments. 
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
+
+
+- Identify any signs of suspicious network activity or anomalies that may indicate network obfuscation. This could include unexpected traffic patterns or unusual network behavior.
+  - Investigate listening ports and open sockets to look for potential protocol tunneling, reverse shells, or data exfiltration.
+    - !{osquery{"label":"Osquery - Retrieve Listening Ports","query":"SELECT pid, address, port, socket, protocol, path FROM listening_ports"}}
+    - !{osquery{"label":"Osquery - Retrieve Open Sockets","query":"SELECT pid, family, remote_address, remote_port, socket, state FROM process_open_sockets"}}
+- Identify the user account that performed the action, analyze it, and check whether it should perform this kind of action.
+  - !{osquery{"label":"Osquery - Retrieve Information for a Specific User","query":"SELECT * FROM users WHERE username = {{user.name}}"}}
+- Investigate whether the user is currently logged in and active.
+  - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
+  - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
+  - !{osquery{"label":"Osquery - Retrieve Process Info","query":"SELECT name, cmdline, parent, path, uid FROM processes"}}
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - If scripts or executables were dropped, retrieve the files and determine if they are malicious:
+    - Use a private sandboxed malware analysis system to perform analysis.
+      - Observe and collect information about the following activities:
+        - Attempts to contact external domains and addresses.
+          - Check if the domain is newly registered or unexpected.
+          - Check the reputation of the domain or IP address.
+        - File access, modification, and creation activities.
+
+
+*Related rules*
+
+
+- ProxyChains Activity - 4b868f1f-15ff-4ba3-8c11-d5a7a6356d37
+- Potential Protocol Tunneling via Chisel Client - 3f12325a-4cc6-410b-8d4c-9fbbeb744cfd
+- Potential Protocol Tunneling via Chisel Server - ac8805f6-1e08-406c-962e-3937057fa86f
+- Potential Linux Tunneling and/or Port Forwarding - 6ee947e9-de7e-4281-a55d-09289bdf947e
+- Potential Protocol Tunneling via EarthWorm - 9f1c4ca3-44b5-481d-ba42-32dc215a2769
+
+
+*False positive analysis*
+
+
+- If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+- If this activity is related to a system administrator or developer who uses this utility for benign purposes, consider adding exceptions for specific user accounts or hosts. 
+- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors, such as reverse shells, reverse proxies, or droppers, that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.action in ("exec", "exec_event", "executed") and
+event.type == "start" and process.name == "proxychains" and process.args : (
+  "ssh", "sshd", "sshuttle", "socat", "iodine", "iodined", "dnscat", "hans", "hans-ubuntu", "ptunnel-ng",
+  "ssf", "3proxy", "ngrok", "gost", "pivotnacci", "chisel*", "nmap", "ping", "python*", "php*", "perl", "ruby",
+  "lua*", "openssl", "nc", "netcat", "ncat", "telnet", "awk", "java", "telnet", "ftp", "curl", "wget"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Protocol Tunneling
+** ID: T1572
+** Reference URL: https://attack.mitre.org/techniques/T1572/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-system-binary-copied-and-or-moved-to-suspicious-directory.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-system-binary-copied-and-or-moved-to-suspicious-directory.asciidoc
new file mode 100644
index 0000000000..46c7258756
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rule-8-12-5-system-binary-copied-and-or-moved-to-suspicious-directory.asciidoc
@@ -0,0 +1,128 @@
+[[prebuilt-rule-8-12-5-system-binary-copied-and-or-moved-to-suspicious-directory]]
+=== System Binary Copied and/or Moved to Suspicious Directory
+
+This rule monitors for the copying or moving of a system binary to a suspicious directory. Adversaries may copy/move and rename system binaries to evade detection. Copying a system binary to a different location should not occur often, so if it does, the activity should be investigated.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.entity_id with maxspan=1s
+  [process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and 
+   process.name in ("cp", "mv") and process.args : (
+   // Shells
+   "/bin/*sh", "/usr/bin/*sh", 
+
+   // Interpreters
+   "/bin/python*", "/usr/bin/python*", "/bin/php*", "/usr/bin/php*", "/bin/ruby*", "/usr/bin/ruby*", "/bin/perl*",
+   "/usr/bin/perl*", "/bin/lua*", "/usr/bin/lua*", "/bin/java*", "/usr/bin/java*", 
+
+   // Compilers
+   "/bin/gcc*", "/usr/bin/gcc*", "/bin/g++*", "/usr/bin/g++*", "/bin/cc", "/usr/bin/cc",
+
+   // Suspicious utilities
+   "/bin/nc", "/usr/bin/nc", "/bin/ncat", "/usr/bin/ncat", "/bin/netcat", "/usr/bin/netcat", "/bin/nc.openbsd",
+   "/usr/bin/nc.openbsd", "/bin/*awk", "/usr/bin/*awk", "/bin/socat", "/usr/bin/socat", "/bin/openssl",
+   "/usr/bin/openssl", "/bin/telnet", "/usr/bin/telnet", "/bin/mkfifo", "/usr/bin/mkfifo", "/bin/mknod",
+   "/usr/bin/mknod", "/bin/ping*", "/usr/bin/ping*", "/bin/nmap", "/usr/bin/nmap",
+
+   // System utilities
+   "/bin/ls", "/usr/bin/ls", "/bin/cat", "/usr/bin/cat", "/bin/sudo", "/usr/bin/sudo", "/bin/curl", "/usr/bin/curl",
+   "/bin/wget", "/usr/bin/wget", "/bin/tmux", "/usr/bin/tmux", "/bin/screen", "/usr/bin/screen", "/bin/ssh",
+   "/usr/bin/ssh", "/bin/ftp", "/usr/bin/ftp"
+  ) and not process.parent.name in ("dracut-install", "apticron", "generate-from-dir", "platform-python")]
+  [file where host.os.type == "linux" and event.action == "creation" and file.path : (
+    "/dev/shm/*", "/run/shm/*", "/tmp/*", "/var/tmp/*", "/run/*", "/var/run/*", "/var/www/*", "/proc/*/fd/*"
+  ) and not file.path : ("/tmp/rear*", "/var/tmp/rear*", "/var/tmp/dracut*", "/var/tmp/mkinitramfs*")]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename System Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rules-8-12-5-appendix.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rules-8-12-5-appendix.asciidoc
new file mode 100644
index 0000000000..8d889608a3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rules-8-12-5-appendix.asciidoc
@@ -0,0 +1,44 @@
+["appendix",role="exclude",id="prebuilt-rule-8-12-5-prebuilt-rules-8-12-5-appendix"]
+= Downloadable rule update v8.12.5
+
+This section lists all updates associated with version 8.12.5 of the Fleet integration *Prebuilt Security Detection Rules*.
+
+
+include::prebuilt-rule-8-12-5-potential-masquerading-as-business-app-installer.asciidoc[]
+include::prebuilt-rule-8-12-5-suspicious-execution-from-inet-cache.asciidoc[]
+include::prebuilt-rule-8-12-5-execution-from-a-removable-media-with-network-connection.asciidoc[]
+include::prebuilt-rule-8-12-5-potential-remote-file-execution-via-msiexec.asciidoc[]
+include::prebuilt-rule-8-12-5-remote-xsl-script-execution-via-com.asciidoc[]
+include::prebuilt-rule-8-12-5-network-activity-detected-via-cat.asciidoc[]
+include::prebuilt-rule-8-12-5-suspicious-utility-launched-via-proxychains.asciidoc[]
+include::prebuilt-rule-8-12-5-potential-linux-tunneling-and-or-port-forwarding.asciidoc[]
+include::prebuilt-rule-8-12-5-potential-linux-credential-dumping-via-unshadow.asciidoc[]
+include::prebuilt-rule-8-12-5-linux-init-pid-1-secret-dump-via-gdb.asciidoc[]
+include::prebuilt-rule-8-12-5-potential-linux-local-account-brute-force-detected.asciidoc[]
+include::prebuilt-rule-8-12-5-potential-successful-linux-ftp-brute-force-attack-detected.asciidoc[]
+include::prebuilt-rule-8-12-5-potential-successful-linux-rdp-brute-force-attack-detected.asciidoc[]
+include::prebuilt-rule-8-12-5-potential-linux-credential-dumping-via-proc-filesystem.asciidoc[]
+include::prebuilt-rule-8-12-5-attempt-to-disable-iptables-or-firewall.asciidoc[]
+include::prebuilt-rule-8-12-5-base16-or-base32-encoding-decoding-activity.asciidoc[]
+include::prebuilt-rule-8-12-5-system-binary-copied-and-or-moved-to-suspicious-directory.asciidoc[]
+include::prebuilt-rule-8-12-5-attempt-to-clear-kernel-ring-buffer.asciidoc[]
+include::prebuilt-rule-8-12-5-potential-disabling-of-apparmor.asciidoc[]
+include::prebuilt-rule-8-12-5-potential-disabling-of-selinux.asciidoc[]
+include::prebuilt-rule-8-12-5-esxi-timestomping-using-touch-command.asciidoc[]
+include::prebuilt-rule-8-12-5-file-deletion-via-shred.asciidoc[]
+include::prebuilt-rule-8-12-5-file-permission-modification-in-writable-directory.asciidoc[]
+include::prebuilt-rule-8-12-5-creation-of-hidden-files-and-directories-via-commandline.asciidoc[]
+include::prebuilt-rule-8-12-5-creation-of-hidden-shared-object-file.asciidoc[]
+include::prebuilt-rule-8-12-5-kernel-module-removal.asciidoc[]
+include::prebuilt-rule-8-12-5-potential-hidden-process-via-mount-hidepid.asciidoc[]
+include::prebuilt-rule-8-12-5-potential-defense-evasion-via-proot.asciidoc[]
+include::prebuilt-rule-8-12-5-potential-pspy-process-monitoring-detected.asciidoc[]
+include::prebuilt-rule-8-12-5-potential-meterpreter-reverse-shell.asciidoc[]
+include::prebuilt-rule-8-12-5-potential-reverse-shell-via-udp.asciidoc[]
+include::prebuilt-rule-8-12-5-kernel-driver-load-by-non-root-user.asciidoc[]
+include::prebuilt-rule-8-12-5-privilege-escalation-via-cap-chown-cap-fowner-capabilities.asciidoc[]
+include::prebuilt-rule-8-12-5-suspicious-passwd-file-event-action.asciidoc[]
+include::prebuilt-rule-8-12-5-suspicious-antimalware-scan-interface-dll.asciidoc[]
+include::prebuilt-rule-8-12-5-process-created-with-a-duplicated-token.asciidoc[]
+include::prebuilt-rule-8-12-5-interactive-logon-by-an-unusual-process.asciidoc[]
+include::prebuilt-rule-8-12-5-first-time-seen-newcredentials-logon-process.asciidoc[]
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rules-8-12-5-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rules-8-12-5-summary.asciidoc
new file mode 100644
index 0000000000..024fb77822
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rules-8-12-5-summary.asciidoc
@@ -0,0 +1,88 @@
+[[prebuilt-rule-8-12-5-prebuilt-rules-8-12-5-summary]]
+[role="xpack"]
+== Update v8.12.5
+
+This section lists all updates associated with version 8.12.5 of the Fleet integration *Prebuilt Security Detection Rules*.
+
+
+[width="100%",options="header"]
+|==============================================
+|Rule |Description |Status |Version
+
+|<<prebuilt-rule-8-12-5-potential-masquerading-as-business-app-installer, Potential Masquerading as Business App Installer>> | Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access. | new | 3 
+
+|<<prebuilt-rule-8-12-5-suspicious-execution-from-inet-cache, Suspicious Execution from INET Cache>> | Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious content via WININET during initial access. | new | 1 
+
+|<<prebuilt-rule-8-12-5-execution-from-a-removable-media-with-network-connection, Execution from a Removable Media with Network Connection>> | Identifies process execution from a removable media and by an unusual process. Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. | new | 2 
+
+|<<prebuilt-rule-8-12-5-potential-remote-file-execution-via-msiexec, Potential Remote File Execution via MSIEXEC>> | Identifies the execution of the built-in Windows Installer, msiexec.exe, to install a remote package. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. | new | 2 
+
+|<<prebuilt-rule-8-12-5-remote-xsl-script-execution-via-com, Remote XSL Script Execution via COM>> | Identifies the execution of a hosted XSL script using the Microsoft.XMLDOM COM interface via Microsoft Office processes. This behavior may indicate adversarial activity to execute malicious JScript or VBScript on the system. | new | 2 
+
+|<<prebuilt-rule-8-12-5-network-activity-detected-via-cat, Network Activity Detected via cat>> | This rule monitors for the execution of the cat command, followed by a connection attempt by the same process. Cat is capable of transfering data via tcp/udp channels by redirecting its read output to a /dev/tcp or /dev/udp channel. This activity is highly suspicious, and should be investigated. Attackers may leverage this capability to transfer tools or files to another host in the network or exfiltrate data while attempting to evade detection in the process. | update | 5 
+
+|<<prebuilt-rule-8-12-5-suspicious-utility-launched-via-proxychains, Suspicious Utility Launched via ProxyChains>> | This rule monitors for the execution of suspicious linux tools through ProxyChains. ProxyChains is a command-line tool that enables the routing of network connections through intermediary proxies, enhancing anonymity and enabling access to restricted resources. Attackers can exploit the ProxyChains utility to hide their true source IP address, evade detection, and perform malicious activities through a chain of proxy servers, potentially masking their identity and intentions. | update | 5 
+
+|<<prebuilt-rule-8-12-5-potential-linux-tunneling-and-or-port-forwarding, Potential Linux Tunneling and/or Port Forwarding>> | This rule monitors for a set of Linux utilities that can be used for tunneling and port forwarding. Attackers can leverage tunneling and port forwarding techniques to bypass network defenses, establish hidden communication channels, and gain unauthorized access to internal resources, facilitating data exfiltration, lateral movement, and remote control. | update | 5 
+
+|<<prebuilt-rule-8-12-5-potential-linux-credential-dumping-via-unshadow, Potential Linux Credential Dumping via Unshadow>> | Identifies the execution of the unshadow utility which is part of John the Ripper, a password-cracking tool on the host machine. Malicious actors can use the utility to retrieve the combined contents of the '/etc/shadow' and '/etc/password' files. Using the combined file generated from the utility, the malicious threat actors can use them as input for password-cracking utilities or prepare themselves for future operations by gathering credential information of the victim. | update | 7 
+
+|<<prebuilt-rule-8-12-5-linux-init-pid-1-secret-dump-via-gdb, Linux init (PID 1) Secret Dump via GDB>> | This rule monitors for the potential memory dump of the init process (PID 1) through gdb. Attackers may leverage memory dumping techniques to attempt secret extraction from privileged processes. Tools that display this behavior include "truffleproc" and "bash-memory-dump". This behavior should not happen by default, and should be investigated thoroughly. | update | 5 
+
+|<<prebuilt-rule-8-12-5-potential-linux-local-account-brute-force-detected, Potential Linux Local Account Brute Force Detected>> | Identifies multiple consecutive login attempts executed by one process targeting a local linux user account within a short time interval. Adversaries might brute force login attempts across different users with a default wordlist or a set of customly crafted passwords in an attempt to gain access to these accounts. | update | 5 
+
+|<<prebuilt-rule-8-12-5-potential-successful-linux-ftp-brute-force-attack-detected, Potential Successful Linux FTP Brute Force Attack Detected>> | An FTP (file transfer protocol) brute force attack is a method where an attacker systematically tries different combinations of usernames and passwords to gain unauthorized access to an FTP server, and if successful, the impact can include unauthorized data access, manipulation, or theft, compromising the security and integrity of the server and potentially exposing sensitive information. This rule identifies multiple consecutive authentication failures targeting a specific user account from the same source address and within a short time interval, followed by a successful authentication. | update | 6 
+
+|<<prebuilt-rule-8-12-5-potential-successful-linux-rdp-brute-force-attack-detected, Potential Successful Linux RDP Brute Force Attack Detected>> | An RDP (Remote Desktop Protocol) brute force attack involves an attacker repeatedly attempting various username and password combinations to gain unauthorized access to a remote computer via RDP, and if successful, the potential impact can include unauthorized control over the compromised system, data theft, or the ability to launch further attacks within the network, jeopardizing the security and confidentiality of the targeted system and potentially compromising the entire network infrastructure. This rule identifies multiple consecutive authentication failures targeting a specific user account within a short time interval, followed by a successful authentication. | update | 6 
+
+|<<prebuilt-rule-8-12-5-potential-linux-credential-dumping-via-proc-filesystem, Potential Linux Credential Dumping via Proc Filesystem>> | Identifies the execution of the mimipenguin exploit script which is linux adaptation of Windows tool mimikatz. Mimipenguin exploit script is used to dump clear text passwords from a currently logged-in user. The tool exploits a known vulnerability CVE-2018-20781. Malicious actors can exploit the cleartext credentials in memory by dumping the process and extracting lines that have a high probability of containing cleartext passwords. | update | 6 
+
+|<<prebuilt-rule-8-12-5-attempt-to-disable-iptables-or-firewall, Attempt to Disable IPTables or Firewall>> | Adversaries may attempt to disable the iptables or firewall service in an attempt to affect how a host is allowed to receive or send network traffic. | update | 6 
+
+|<<prebuilt-rule-8-12-5-base16-or-base32-encoding-decoding-activity, Base16 or Base32 Encoding/Decoding Activity>> | Adversaries may encode/decode data in an attempt to evade detection by host- or network-based security controls. | update | 108 
+
+|<<prebuilt-rule-8-12-5-system-binary-copied-and-or-moved-to-suspicious-directory, System Binary Copied and/or Moved to Suspicious Directory>> | This rule monitors for the copying or moving of a system binary to a suspicious directory. Adversaries may copy/move and rename system binaries to evade detection. Copying a system binary to a different location should not occur often, so if it does, the activity should be investigated. | update | 6 
+
+|<<prebuilt-rule-8-12-5-attempt-to-clear-kernel-ring-buffer, Attempt to Clear Kernel Ring Buffer>> | Monitors for the deletion of the kernel ring buffer events through dmesg. Attackers may clear kernel ring buffer events to evade detection after installing a Linux kernel module (LKM). | update | 2 
+
+|<<prebuilt-rule-8-12-5-potential-disabling-of-apparmor, Potential Disabling of AppArmor>> | This rule monitors for potential attempts to disable AppArmor. AppArmor is a Linux security module that enforces fine-grained access control policies to restrict the actions and resources that specific applications and processes can access. Adversaries may disable security tools to avoid possible detection of their tools and activities. | update | 4 
+
+|<<prebuilt-rule-8-12-5-potential-disabling-of-selinux, Potential Disabling of SELinux>> | Identifies potential attempts to disable Security-Enhanced Linux (SELinux), which is a Linux kernel security feature to support access control policies. Adversaries may disable security tools to avoid possible detection of their tools and activities. | update | 108 
+
+|<<prebuilt-rule-8-12-5-esxi-timestomping-using-touch-command, ESXI Timestomping using Touch Command>> | Identifies instances where the 'touch' command is executed on a Linux system with the "-r" flag, which is used to modify the timestamp of a file based on another file's timestamp. The rule targets specific VM-related paths, such as "/etc/vmware/", "/usr/lib/vmware/", or "/vmfs/*". These paths are associated with VMware virtualization software, and their presence in the touch command arguments may indicate that a threat actor is attempting to tamper with timestamps of VM-related files and configurations on the system. | update | 6 
+
+|<<prebuilt-rule-8-12-5-file-deletion-via-shred, File Deletion via Shred>> | Malware or other files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process. | update | 108 
+
+|<<prebuilt-rule-8-12-5-file-permission-modification-in-writable-directory, File Permission Modification in Writable Directory>> | Identifies file permission modifications in common writable directories by a non-root user. Adversaries often drop files or payloads into a writable directory and change permissions prior to execution. | update | 209 
+
+|<<prebuilt-rule-8-12-5-creation-of-hidden-files-and-directories-via-commandline, Creation of Hidden Files and Directories via CommandLine>> | Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. This rule looks for hidden files or folders in common writable directories. | update | 109 
+
+|<<prebuilt-rule-8-12-5-creation-of-hidden-shared-object-file, Creation of Hidden Shared Object File>> | Identifies the creation of a hidden shared object (.so) file. Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. | update | 109 
+
+|<<prebuilt-rule-8-12-5-kernel-module-removal, Kernel Module Removal>> | Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This rule identifies attempts to remove a kernel module. | update | 108 
+
+|<<prebuilt-rule-8-12-5-potential-hidden-process-via-mount-hidepid, Potential Hidden Process via Mount Hidepid>> | Identifies the execution of mount process with hidepid parameter, which can make processes invisible to other users from the system. Adversaries using Linux kernel version 3.2+ (or RHEL/CentOS v6.5+ above) can hide the process from other users. When hidepid=2 option is executed to mount the /proc filesystem, only the root user can see all processes and the logged-in user can only see their own process. This provides a defense evasion mechanism for the adversaries to hide their process executions from all other commands such as ps, top, pgrep and more. With the Linux kernel hardening hidepid option all the user has to do is remount the /proc filesystem with the option, which can now be monitored and detected. | update | 6 
+
+|<<prebuilt-rule-8-12-5-potential-defense-evasion-via-proot, Potential Defense Evasion via PRoot>> | Identifies the execution of the PRoot utility, an open-source tool for user-space implementation of chroot, mount --bind, and binfmt_misc. Adversaries can leverage an open-source tool PRoot to expand the scope of their operations to multiple Linux distributions and simplify their necessary efforts. In a normal threat scenario, the scope of an attack is limited by the varying configurations of each Linux distribution. With PRoot, it provides an attacker with a consistent operational environment across different Linux distributions, such as Ubuntu, Fedora, and Alpine. PRoot also provides emulation capabilities that allow for malware built on other architectures, such as ARM, to be run.The post-exploitation technique called bring your own filesystem (BYOF), can be used by the threat actors to execute malicious payload or elevate privileges or perform network scans or orchestrate another attack on the environment. Although PRoot was originally not developed with malicious intent it can be easily tuned to work for one. | update | 6 
+
+|<<prebuilt-rule-8-12-5-potential-pspy-process-monitoring-detected, Potential Pspy Process Monitoring Detected>> | This rule leverages auditd to monitor for processes scanning different processes within the /proc directory using the openat syscall. This is a strong indication for the usage of the pspy utility. Attackers may leverage the pspy process monitoring utility to monitor system processes without requiring root permissions, in order to find potential privilege escalation vectors. | update | 6 
+
+|<<prebuilt-rule-8-12-5-potential-meterpreter-reverse-shell, Potential Meterpreter Reverse Shell>> | This detection rule identifies a sample of suspicious Linux system file reads used for system fingerprinting, leveraged by the Metasploit Meterpreter shell to gather information about the target that it is executing its shell on. Detecting this pattern is indicative of a successful meterpreter shell connection. | update | 5 
+
+|<<prebuilt-rule-8-12-5-potential-reverse-shell-via-udp, Potential Reverse Shell via UDP>> | This detection rule identifies suspicious network traffic patterns associated with UDP reverse shell activity. This activity consists of a sample of an execve, socket and connect syscall executed by the same process, where the auditd.data.a0-1 indicate a UDP connection, ending with an egress connection event. An attacker may establish a Linux UDP reverse shell to bypass traditional firewall restrictions and gain remote access to a target system covertly. | update | 5 
+
+|<<prebuilt-rule-8-12-5-kernel-driver-load-by-non-root-user, Kernel Driver Load by non-root User>> | Detects the loading of a Linux kernel module by a non-root user through system calls. Threat actors may leverage Linux kernel modules to load a rootkit on a system providing them with complete control and the ability to hide from security products. As other rules monitor for the addition of Linux kernel modules through system utilities or .ko files, this rule covers the gap that evasive rootkits leverage by monitoring for kernel module additions on the lowest level through auditd_manager. | update | 2 
+
+|<<prebuilt-rule-8-12-5-privilege-escalation-via-cap-chown-cap-fowner-capabilities, Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities>> | Identifies instances where a processes (granted CAP_CHOWN and/or CAP_FOWNER capabilities) is executed, after which the ownership of a suspicious file or binary is changed. In Linux, the CAP_CHOWN capability allows a process to change the owner of a file, while CAP_FOWNER permits it to bypass permission checks on operations that require file ownership (like reading, writing, and executing). Attackers may abuse these capabilities to obtain unauthorized access to files. | update | 2 
+
+|<<prebuilt-rule-8-12-5-suspicious-passwd-file-event-action, Suspicious Passwd File Event Action>> | Monitors for the generation of a passwd password entry via openssl, followed by a file write activity on the "/etc/passwd" file. The "/etc/passwd" file in Linux stores user account information, including usernames, user IDs, group IDs, home directories, and default shell paths. Attackers may exploit a misconfiguration in the "/etc/passwd" file permissions or other privileges to add a new entry to the "/etc/passwd" file with root permissions, and leverage this new user account to login as root. | update | 2 
+
+|<<prebuilt-rule-8-12-5-suspicious-antimalware-scan-interface-dll, Suspicious Antimalware Scan Interface DLL>> | Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one. | update | 7 
+
+|<<prebuilt-rule-8-12-5-process-created-with-a-duplicated-token, Process Created with a Duplicated Token>> | Identifies the creation of a process impersonating the token of another user logon session. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. | update | 2 
+
+|<<prebuilt-rule-8-12-5-interactive-logon-by-an-unusual-process, Interactive Logon by an Unusual Process>> | Identifies interactive logon attempt with alternate credentials and by an unusual process. Adversaries may create a new token to escalate privileges and bypass access controls. | update | 2 
+
+|<<prebuilt-rule-8-12-5-first-time-seen-newcredentials-logon-process, First Time Seen NewCredentials Logon Process>> | Identifies a new credentials logon type performed by an unusual process. This may indicate the existence of an access token forging capability that are often abused to bypass access control restrictions. | update | 2 
+
+|==============================================
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
index 9b32f32741..df0974641e 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
@@ -13,6 +13,10 @@ For previous rule updates, please navigate to the https://www.elastic.co/guide/e
 |Update version |Date | New rules | Updated rules | Notes
 
 
+|<<prebuilt-rule-8-12-5-prebuilt-rules-8-12-5-summary, 8.12.5>> | 23 Feb 2024 | 5 | 33 | 
+updating rules for 8.12.5 release package
+
+
 |<<prebuilt-rule-8-12-4-prebuilt-rules-8-12-4-summary, 8.12.4>> | 08 Feb 2024 | 10 | 6 |
 This release includes new and tuned rules for Linux and Windows.
 New rules for Linux include detection for discovery, persistence, privilege escalation and defense evasion.
@@ -48,3 +52,4 @@ include::downloadable-packages/8-12-1/prebuilt-rules-8-12-1-summary.asciidoc[lev
 include::downloadable-packages/8-12-2/prebuilt-rules-8-12-2-summary.asciidoc[leveloffset=+1]
 include::downloadable-packages/8-12-3/prebuilt-rules-8-12-3-summary.asciidoc[leveloffset=+1]
 include::downloadable-packages/8-12-4/prebuilt-rules-8-12-4-summary.asciidoc[leveloffset=+1]
+include::downloadable-packages/8-12-5/prebuilt-rules-8-12-5-summary.asciidoc[leveloffset=+1]
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
index 9644f52514..e798607817 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
@@ -190,7 +190,7 @@ and their rule type is `machine_learning`.
 
 |<<at-exe-command-lateral-movement, At.exe Command Lateral Movement>> |Identifies use of at.exe to interact with the task scheduler on remote hosts. Remote task creations, modifications or execution could be indicative of adversary lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
 
-|<<attempt-to-clear-kernel-ring-buffer, Attempt to Clear Kernel Ring Buffer>> |Monitors for the deletion of the kernel ring buffer events through dmesg. Attackers may clear kernel ring buffer events to evade detection after installing a Linux kernel module (LKM). |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |1
+|<<attempt-to-clear-kernel-ring-buffer, Attempt to Clear Kernel Ring Buffer>> |Monitors for the deletion of the kernel ring buffer events through dmesg. Attackers may clear kernel ring buffer events to evade detection after installing a Linux kernel module (LKM). |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |8.3.0 |2
 
 |<<attempt-to-create-okta-api-token, Attempt to Create Okta API Token>> |Detects attempts to create an Okta API token. An adversary may create an Okta API token to maintain access to an organization's network while they work to achieve their objectives. An attacker may abuse an API token to execute techniques such as creating user accounts or disabling security rules or policies. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Persistence] |8.10.0 |205
 
@@ -212,7 +212,7 @@ and their rule type is `machine_learning`.
 
 |<<attempt-to-disable-gatekeeper, Attempt to Disable Gatekeeper>> |Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security feature that's designed to ensure that only trusted software is run. Adversaries may attempt to disable Gatekeeper before executing malicious code. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<attempt-to-disable-iptables-or-firewall, Attempt to Disable IPTables or Firewall>> |Adversaries may attempt to disable the iptables or firewall service in an attempt to affect how a host is allowed to receive or send network traffic. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |5
+|<<attempt-to-disable-iptables-or-firewall, Attempt to Disable IPTables or Firewall>> |Adversaries may attempt to disable the iptables or firewall service in an attempt to affect how a host is allowed to receive or send network traffic. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |6
 
 |<<attempt-to-disable-syslog-service, Attempt to Disable Syslog Service>> |Adversaries may attempt to disable the syslog service in an attempt to an attempt to disrupt event logging and evade detection by security controls. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
@@ -318,7 +318,7 @@ and their rule type is `machine_learning`.
 
 |<<bpf-filter-applied-using-tc, BPF filter applied using TC>> |Detects when the tc (transmission control) binary is utilized to set a BPF (Berkeley Packet Filter) on a network interface. Tc is used to configure Traffic Control in the Linux kernel. It can shape, schedule, police and drop traffic. A threat actor can utilize tc to set a bpf filter on an interface for the purpose of manipulating the incoming traffic. This technique is not at all common and should indicate abnormal, suspicious or malicious activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Threat: TripleCross], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |107
 
-|<<base16-or-base32-encoding-decoding-activity, Base16 or Base32 Encoding/Decoding Activity>> |Adversaries may encode/decode data in an attempt to evade detection by host- or network-based security controls. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |107
+|<<base16-or-base32-encoding-decoding-activity, Base16 or Base32 Encoding/Decoding Activity>> |Adversaries may encode/decode data in an attempt to evade detection by host- or network-based security controls. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Auditd Manager] |8.3.0 |108
 
 |<<bash-shell-profile-modification, Bash Shell Profile Modification>> |Both ~/.bash_profile and ~/.bashrc are files containing shell commands that are run when Bash is invoked. These files are executed in a user's context, either interactively or non-interactively, when a user logs in so that their environment is set correctly. Adversaries may abuse this to establish persistence by executing malicious content triggered by a user’s shell. |[Domain: Endpoint], [OS: macOS], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |104
 
@@ -372,17 +372,17 @@ and their rule type is `machine_learning`.
 
 |<<control-panel-process-with-unusual-arguments, Control Panel Process with Unusual Arguments>> |Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse control.exe to proxy execution of malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
-|<<creation-of-hidden-files-and-directories-via-commandline, Creation of Hidden Files and Directories via CommandLine>> |Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. This rule looks for hidden files or folders in common writable directories. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |108
+|<<creation-of-hidden-files-and-directories-via-commandline, Creation of Hidden Files and Directories via CommandLine>> |Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. This rule looks for hidden files or folders in common writable directories. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<creation-of-hidden-launch-agent-or-daemon, Creation of Hidden Launch Agent or Daemon>> |Identifies the creation of a hidden launch agent or daemon. An adversary may establish persistence by installing a new launch agent or daemon which executes at login. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<creation-of-hidden-login-item-via-apple-script, Creation of Hidden Login Item via Apple Script>> |Identifies the execution of osascript to create a hidden login item. This may indicate an attempt to persist a malicious program while concealing its presence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |107
 
-|<<creation-of-hidden-shared-object-file, Creation of Hidden Shared Object File>> |Identifies the creation of a hidden shared object (.so) file. Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<creation-of-hidden-shared-object-file, Creation of Hidden Shared Object File>> |Identifies the creation of a hidden shared object (.so) file. Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<creation-of-kernel-module, Creation of Kernel Module>> |Identifies activity related to loading kernel modules on Linux via creation of new ko files in the LKM directory. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |2
 
-|<<creation-of-settingcontent-ms-files, Creation of SettingContent-ms Files>> |Identifies the suspicious creation of SettingContents-ms files, which have been used in attacks to achieve code execution while evading defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
+|<<creation-of-settingcontent-ms-files, Creation of SettingContent-ms Files>> |Identifies the suspicious creation of SettingContents-ms files, which have been used in attacks to achieve code execution while evading defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
 
 |<<creation-of-a-hidden-local-user-account, Creation of a Hidden Local User Account>> |Identifies the creation of a hidden local user account by appending the dollar sign to the account name. This is sometimes done by attackers to increase access to a system and avoid appearing in the results of accounts listing using the net users command. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
@@ -432,7 +432,7 @@ and their rule type is `machine_learning`.
 
 |<<discovery-of-domain-groups, Discovery of Domain Groups>> |Identifies the execution of Linux built-in commands related to account or group enumeration. Adversaries may use account and group information to orient themselves before deciding how to act. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |1
 
-|<<discovery-of-internet-capabilities-via-built-in-tools, Discovery of Internet Capabilities via Built-in Tools>> |Identifies the use of built-in tools attackers can use to check for Internet connectivity on compromised systems. These results may be used to determine communication capabilities with C2 servers, or to identify routes, redirectors, and proxy servers. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend] |8.6.0 |101
+|<<discovery-of-internet-capabilities-via-built-in-tools, Discovery of Internet Capabilities via Built-in Tools>> |Identifies the use of built-in tools attackers can use to check for Internet connectivity on compromised systems. These results may be used to determine communication capabilities with C2 servers, or to identify routes, redirectors, and proxy servers. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend] |8.6.0 |102
 
 |<<domain-added-to-google-workspace-trusted-domains, Domain Added to Google Workspace Trusted Domains>> |Detects when a domain is added to the list of trusted Google Workspace domains. An adversary may add a trusted domain in order to collect and exfiltrate data from their target’s organization with less restrictive security controls. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Configuration Audit], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.4.0 |205
 
@@ -450,7 +450,7 @@ and their rule type is `machine_learning`.
 
 |<<esxi-discovery-via-grep, ESXI Discovery via Grep>> |Identifies instances where a process named 'grep', 'egrep', or 'pgrep' is started on a Linux system with arguments related to virtual machine (VM) files, such as "vmdk", "vmx", "vmxf", "vmsd", "vmsn", "vswp", "vmss", "nvram", or "vmem". These file extensions are associated with VM-related file formats, and their presence in grep command arguments may indicate that a threat actor is attempting to search for, analyze, or manipulate VM files on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend] |8.5.0 |5
 
-|<<esxi-timestomping-using-touch-command, ESXI Timestomping using Touch Command>> |Identifies instances where the 'touch' command is executed on a Linux system with the "-r" flag, which is used to modify the timestamp of a file based on another file's timestamp. The rule targets specific VM-related paths, such as "/etc/vmware/", "/usr/lib/vmware/", or "/vmfs/*". These paths are associated with VMware virtualization software, and their presence in the touch command arguments may indicate that a threat actor is attempting to tamper with timestamps of VM-related files and configurations on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.5.0 |5
+|<<esxi-timestomping-using-touch-command, ESXI Timestomping using Touch Command>> |Identifies instances where the 'touch' command is executed on a Linux system with the "-r" flag, which is used to modify the timestamp of a file based on another file's timestamp. The rule targets specific VM-related paths, such as "/etc/vmware/", "/usr/lib/vmware/", or "/vmfs/*". These paths are associated with VMware virtualization software, and their presence in the touch command arguments may indicate that a threat actor is attempting to tamper with timestamps of VM-related files and configurations on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Auditd Manager] |8.5.0 |6
 
 |<<eggshell-backdoor-execution, EggShell Backdoor Execution>> |Identifies the execution of and EggShell Backdoor. EggShell is a known post exploitation tool for macOS and Linux. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |103
 
@@ -476,7 +476,7 @@ and their rule type is `machine_learning`.
 
 |<<enumeration-of-kernel-modules, Enumeration of Kernel Modules>> |Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend] |8.6.0 |208
 
-|<<enumeration-of-kernel-modules-via-proc, Enumeration of Kernel Modules via Proc>> |Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module using the /proc/modules filesystem. This filesystem is used by utilities such as lsmod and kmod to list the available kernel modules. |[OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.6.0 |104
+|<<enumeration-of-kernel-modules-via-proc, Enumeration of Kernel Modules via Proc>> |Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module using the /proc/modules filesystem. This filesystem is used by utilities such as lsmod and kmod to list the available kernel modules. |[Data Source: Auditd Manager], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.6.0 |105
 
 |<<enumeration-of-privileged-local-groups-membership, Enumeration of Privileged Local Groups Membership>> |Identifies instances of an unusual process enumerating built-in Windows privileged local groups membership like Administrators or Remote Desktop users. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide] |8.6.0 |210
 
@@ -492,7 +492,7 @@ and their rule type is `machine_learning`.
 
 |<<execution-from-unusual-directory-command-line, Execution from Unusual Directory - Command Line>> |Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide malware in trusted paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
-|<<execution-from-a-removable-media-with-network-connection, Execution from a Removable Media with Network Connection>> |Identifies process execution from a removable media and by an unusual process. Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |1
+|<<execution-from-a-removable-media-with-network-connection, Execution from a Removable Media with Network Connection>> |Identifies process execution from a removable media and by an unusual process. Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Defend] |8.3.0 |2
 
 |<<execution-of-com-object-via-xwizard, Execution of COM object via Xwizard>> |Windows Component Object Model (COM) is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects or executable code. Xwizard can be used to run a COM object created in registry to evade defensive counter measures. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |107
 
@@ -502,7 +502,7 @@ and their rule type is `machine_learning`.
 
 |<<execution-of-persistent-suspicious-program, Execution of Persistent Suspicious Program>> |Identifies execution of suspicious persistent programs (scripts, rundll32, etc.) by looking at process lineage and command line usage. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<execution-of-an-unsigned-service, Execution of an Unsigned Service>> |This rule identifies the execution of unsigned executables via service control manager (SCM). Adversaries may abuse SCM to execute malware or escalate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.6.0 |103
+|<<execution-of-an-unsigned-service, Execution of an Unsigned Service>> |This rule identifies the execution of unsigned executables via service control manager (SCM). Adversaries may abuse SCM to execute malware or escalate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.6.0 |104
 
 |<<execution-via-electron-child-process-node-js-module, Execution via Electron Child Process Node.js Module>> |Identifies attempts to execute a child process from within the context of an Electron application using the child_process Node.js module. Adversaries may abuse this technique to inherit permissions from parent processes. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |105
 
@@ -540,11 +540,11 @@ and their rule type is `machine_learning`.
 
 |<<file-creation-execution-and-self-deletion-in-suspicious-directory, File Creation, Execution and Self-Deletion in Suspicious Directory>> |This rule monitors for the creation of a file, followed by its execution and self-deletion in a short timespan within a directory often used for malicious purposes by threat actors. This behavior is often used by malware to execute malicious code and delete itself to hide its tracks. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |3
 
-|<<file-deletion-via-shred, File Deletion via Shred>> |Malware or other files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |107
+|<<file-deletion-via-shred, File Deletion via Shred>> |Malware or other files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |108
 
 |<<file-made-executable-via-chmod-inside-a-container, File Made Executable via Chmod Inside A Container>> |This rule detects when chmod is used to add the execute permission to a file inside a container. Modifying file permissions to make a file executable could indicate malicious activity, as an attacker may attempt to run unauthorized or malicious code inside the container. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion] |8.8.0 |2
 
-|<<file-permission-modification-in-writable-directory, File Permission Modification in Writable Directory>> |Identifies file permission modifications in common writable directories by a non-root user. Adversaries often drop files or payloads into a writable directory and change permissions prior to execution. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.6.0 |208
+|<<file-permission-modification-in-writable-directory, File Permission Modification in Writable Directory>> |Identifies file permission modifications in common writable directories by a non-root user. Adversaries often drop files or payloads into a writable directory and change permissions prior to execution. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.6.0 |209
 
 |<<file-staged-in-root-folder-of-recycle-bin, File Staged in Root Folder of Recycle Bin>> |Identifies files written to the root of the Recycle Bin folder instead of subdirectories. Adversaries may place files in the root of the Recycle Bin in preparation for exfiltration or to evade defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
 
@@ -558,7 +558,7 @@ and their rule type is `machine_learning`.
 
 |<<file-or-directory-deletion-command, File or Directory Deletion Command>> |This rule identifies the execution of commands that can be used to delete files and directories. Adversaries may delete files and directories on a host system, such as logs, browser history, or malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |2
 
-|<<file-with-suspicious-extension-downloaded, File with Suspicious Extension Downloaded>> |Identifies unusual files downloaded from outside the local network that have the potential to be abused for code execution. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
+|<<file-with-suspicious-extension-downloaded, File with Suspicious Extension Downloaded>> |Identifies unusual files downloaded from outside the local network that have the potential to be abused for code execution. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
 
 |<<finder-sync-plugin-registered-and-enabled, Finder Sync Plugin Registered and Enabled>> |Finder Sync plugins enable users to extend Finder’s functionality by modifying the user interface. Adversaries may abuse this feature by adding a rogue Finder Plugin to repeatedly execute malicious payloads for persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
@@ -590,7 +590,7 @@ and their rule type is `machine_learning`.
 
 |<<first-time-seen-google-workspace-oauth-login-from-third-party-application, First Time Seen Google Workspace OAuth Login from Third-Party Application>> |Detects the first time a third-party application logs in and authenticated with OAuth. OAuth is used to grant permissions to specific resources and services in Google Workspace. Compromised credentials or service accounts could allow an adversary to authenticate to Google Workspace as a valid user and inherit their privileges. |[Domain: Cloud], [Data Source: Google Workspace], [Tactic: Defense Evasion], [Tactic: Initial Access] |8.4.0 |3
 
-|<<first-time-seen-newcredentials-logon-process, First Time Seen NewCredentials Logon Process>> |Identifies a new credentials logon type performed by an unusual process. This may indicate the existence of an access token forging capability that are often abused to bypass access control restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.4.0 |1
+|<<first-time-seen-newcredentials-logon-process, First Time Seen NewCredentials Logon Process>> |Identifies a new credentials logon type performed by an unusual process. This may indicate the existence of an access token forging capability that are often abused to bypass access control restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.4.0 |2
 
 |<<first-time-seen-removable-device, First Time Seen Removable Device>> |Identifies newly seen removable devices by device friendly name using registry modification events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Exfiltration], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.4.0 |2
 
@@ -758,7 +758,7 @@ and their rule type is `machine_learning`.
 
 |<<interactive-exec-command-launched-against-a-running-container, Interactive Exec Command Launched Against A Running Container>> |This rule detects interactive 'exec' events launched against a container using the 'exec' command. Using the 'exec' command in a pod allows a user to establish a temporary shell session and execute any process/command inside the container. This rule specifically targets higher-risk interactive commands that allow real-time interaction with a container's shell. A malicious actor could use this level of access to further compromise the container environment or attempt a container breakout. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.8.0 |2
 
-|<<interactive-logon-by-an-unusual-process, Interactive Logon by an Unusual Process>> |Identifies interactive logon attempt with alternate credentials and by an unusual process. Adversaries may create a new token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |1
+|<<interactive-logon-by-an-unusual-process, Interactive Logon by an Unusual Process>> |Identifies interactive logon attempt with alternate credentials and by an unusual process. Adversaries may create a new token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |2
 
 |<<interactive-terminal-spawned-via-perl, Interactive Terminal Spawned via Perl>> |Identifies when a terminal (tty) is spawned via Perl. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |107
 
@@ -772,15 +772,15 @@ and their rule type is `machine_learning`.
 
 |<<kerberos-traffic-from-unusual-process, Kerberos Traffic from Unusual Process>> |Identifies network connections to the standard Kerberos port from an unusual process. On Windows, the only process that normally performs Kerberos traffic from a domain joined host is lsass.exe. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |108
 
-|<<kernel-driver-load, Kernel Driver Load>> |Detects the loading of a Linux kernel module through system calls. Threat actors may leverage Linux kernel modules to load a rootkit on a system providing them with complete control and the ability to hide from security products. As other rules monitor for the addition of Linux kernel modules through system utilities or .ko files, this rule covers the gap that evasive rootkits leverage by monitoring for kernel module additions on the lowest level through auditd_manager. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Rule Type: BBR] |8.3.0 |2
+|<<kernel-driver-load, Kernel Driver Load>> |Detects the loading of a Linux kernel module through system calls. Threat actors may leverage Linux kernel modules to load a rootkit on a system providing them with complete control and the ability to hide from security products. As other rules monitor for the addition of Linux kernel modules through system utilities or .ko files, this rule covers the gap that evasive rootkits leverage by monitoring for kernel module additions on the lowest level through auditd_manager. |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Rule Type: BBR] |8.3.0 |3
 
-|<<kernel-driver-load-by-non-root-user, Kernel Driver Load by non-root User>> |Detects the loading of a Linux kernel module by a non-root user through system calls. Threat actors may leverage Linux kernel modules to load a rootkit on a system providing them with complete control and the ability to hide from security products. As other rules monitor for the addition of Linux kernel modules through system utilities or .ko files, this rule covers the gap that evasive rootkits leverage by monitoring for kernel module additions on the lowest level through auditd_manager. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion] |8.3.0 |1
+|<<kernel-driver-load-by-non-root-user, Kernel Driver Load by non-root User>> |Detects the loading of a Linux kernel module by a non-root user through system calls. Threat actors may leverage Linux kernel modules to load a rootkit on a system providing them with complete control and the ability to hide from security products. As other rules monitor for the addition of Linux kernel modules through system utilities or .ko files, this rule covers the gap that evasive rootkits leverage by monitoring for kernel module additions on the lowest level through auditd_manager. |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion] |8.3.0 |2
 
 |<<kernel-load-or-unload-via-kexec-detected, Kernel Load or Unload via Kexec Detected>> |This detection rule identifies the usage of kexec, helping to uncover unauthorized kernel replacements and potential compromise of the system's integrity. Kexec is a Linux feature that enables the loading and execution of a different kernel without going through the typical boot process. Malicious actors can abuse kexec to bypass security measures, escalate privileges, establish persistence or hide their activities by loading a malicious kernel, enabling them to tamper with the system's trusted state, allowing e.g. a VM Escape. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |5
 
 |<<kernel-module-load-via-insmod, Kernel Module Load via insmod>> |Detects the use of the insmod binary to load a Linux kernel object file. Threat actors can use this binary, given they have root privileges, to load a rootkit on a system providing them with complete control and the ability to hide from security products. Manually loading a kernel module in this manner should not be at all common and can indicate suspcious or malicious behavior. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Threat: Rootkit], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
-|<<kernel-module-removal, Kernel Module Removal>> |Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This rule identifies attempts to remove a kernel module. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |107
+|<<kernel-module-removal, Kernel Module Removal>> |Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This rule identifies attempts to remove a kernel module. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
 |<<keychain-password-retrieval-via-command-line, Keychain Password Retrieval via Command Line>> |Adversaries may collect keychain storage data from a system to in order to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |106
 
@@ -834,7 +834,7 @@ and their rule type is `machine_learning`.
 
 |<<linux-user-added-to-privileged-group, Linux User Added to Privileged Group>> |Identifies attempts to add a user to a privileged group. Attackers may add users to a privileged group in order to establish persistence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |5
 
-|<<linux-init-pid-1-secret-dump-via-gdb, Linux init (PID 1) Secret Dump via GDB>> |This rule monitors for the potential memory dump of the init process (PID 1) through gdb. Attackers may leverage memory dumping techniques to attempt secret extraction from privileged processes. Tools that display this behavior include "truffleproc" and "bash-memory-dump". This behavior should not happen by default, and should be investigated thoroughly. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |3
+|<<linux-init-pid-1-secret-dump-via-gdb, Linux init (PID 1) Secret Dump via GDB>> |This rule monitors for the potential memory dump of the init process (PID 1) through gdb. Attackers may leverage memory dumping techniques to attempt secret extraction from privileged processes. Tools that display this behavior include "truffleproc" and "bash-memory-dump". This behavior should not happen by default, and should be investigated thoroughly. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |5
 
 |<<local-account-tokenfilter-policy-disabled, Local Account TokenFilter Policy Disabled>> |Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If this value exists (which doesn't by default) and is set to 1, then remote connections from all local members of Administrators are granted full high-integrity tokens during negotiation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |6
 
@@ -924,7 +924,7 @@ and their rule type is `machine_learning`.
 
 |<<microsoft-exchange-server-um-writing-suspicious-files, Microsoft Exchange Server UM Writing Suspicious Files>> |Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<microsoft-exchange-transport-agent-install-script, Microsoft Exchange Transport Agent Install Script>> |Identifies the use of Cmdlets and methods related to Microsoft Exchange Transport Agents install. Adversaries may leverage malicious Microsoft Exchange Transport Agents to execute tasks in response to adversary-defined criteria, establishing persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |2
+|<<microsoft-exchange-transport-agent-install-script, Microsoft Exchange Transport Agent Install Script>> |Identifies the use of Cmdlets and methods related to Microsoft Exchange Transport Agents install. Adversaries may leverage malicious Microsoft Exchange Transport Agents to execute tasks in response to adversary-defined criteria, establishing persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |3
 
 |<<microsoft-exchange-worker-spawning-suspicious-processes, Microsoft Exchange Worker Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |107
 
@@ -1000,7 +1000,7 @@ and their rule type is `machine_learning`.
 
 |<<network-activity-detected-via-kworker, Network Activity Detected via Kworker>> |This rule monitors for network connections from a kworker process. kworker, or kernel worker, processes are part of the kernel's workqueue mechanism. They are responsible for executing work that has been scheduled to be done in kernel space, which might include tasks like handling interrupts, background activities, and other kernel-related tasks. Attackers may attempt to evade detection by masquerading as a kernel worker process. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend] |8.6.0 |2
 
-|<<network-activity-detected-via-cat, Network Activity Detected via cat>> |This rule monitors for the execution of the cat command, followed by a connection attempt by the same process. Cat is capable of transfering data via tcp/udp channels by redirecting its read output to a /dev/tcp or /dev/udp channel. This activity is highly suspicious, and should be investigated. Attackers may leverage this capability to transfer tools or files to another host in the network or exfiltrate data while attempting to evade detection in the process. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend] |8.3.0 |4
+|<<network-activity-detected-via-cat, Network Activity Detected via cat>> |This rule monitors for the execution of the cat command, followed by a connection attempt by the same process. Cat is capable of transfering data via tcp/udp channels by redirecting its read output to a /dev/tcp or /dev/udp channel. This activity is highly suspicious, and should be investigated. Attackers may leverage this capability to transfer tools or files to another host in the network or exfiltrate data while attempting to evade detection in the process. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend] |8.3.0 |5
 
 |<<network-connection-via-certutil, Network Connection via Certutil>> |Identifies certutil.exe making a network connection. Adversaries could abuse certutil.exe to download a certificate, or malware, from a remote URL. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |109
 
@@ -1172,11 +1172,11 @@ and their rule type is `machine_learning`.
 
 |<<potential-defense-evasion-via-cmstp-exe, Potential Defense Evasion via CMSTP.exe>> |The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program to install Connection Manager service profiles, which accept installation information file (INF) files. Adversaries may abuse CMSTP to proxy the execution of malicious code by supplying INF files that contain malicious commands. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
-|<<potential-defense-evasion-via-proot, Potential Defense Evasion via PRoot>> |Identifies the execution of the PRoot utility, an open-source tool for user-space implementation of chroot, mount --bind, and binfmt_misc. Adversaries can leverage an open-source tool PRoot to expand the scope of their operations to multiple Linux distributions and simplify their necessary efforts. In a normal threat scenario, the scope of an attack is limited by the varying configurations of each Linux distribution. With PRoot, it provides an attacker with a consistent operational environment across different Linux distributions, such as Ubuntu, Fedora, and Alpine. PRoot also provides emulation capabilities that allow for malware built on other architectures, such as ARM, to be run.The post-exploitation technique called bring your own filesystem (BYOF), can be used by the threat actors to execute malicious payload or elevate privileges or perform network scans or orchestrate another attack on the environment. Although PRoot was originally not developed with malicious intent it can be easily tuned to work for one. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |5
+|<<potential-defense-evasion-via-proot, Potential Defense Evasion via PRoot>> |Identifies the execution of the PRoot utility, an open-source tool for user-space implementation of chroot, mount --bind, and binfmt_misc. Adversaries can leverage an open-source tool PRoot to expand the scope of their operations to multiple Linux distributions and simplify their necessary efforts. In a normal threat scenario, the scope of an attack is limited by the varying configurations of each Linux distribution. With PRoot, it provides an attacker with a consistent operational environment across different Linux distributions, such as Ubuntu, Fedora, and Alpine. PRoot also provides emulation capabilities that allow for malware built on other architectures, such as ARM, to be run.The post-exploitation technique called bring your own filesystem (BYOF), can be used by the threat actors to execute malicious payload or elevate privileges or perform network scans or orchestrate another attack on the environment. Although PRoot was originally not developed with malicious intent it can be easily tuned to work for one. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |6
 
-|<<potential-disabling-of-apparmor, Potential Disabling of AppArmor>> |This rule monitors for potential attempts to disable AppArmor. AppArmor is a Linux security module that enforces fine-grained access control policies to restrict the actions and resources that specific applications and processes can access. Adversaries may disable security tools to avoid possible detection of their tools and activities. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |3
+|<<potential-disabling-of-apparmor, Potential Disabling of AppArmor>> |This rule monitors for potential attempts to disable AppArmor. AppArmor is a Linux security module that enforces fine-grained access control policies to restrict the actions and resources that specific applications and processes can access. Adversaries may disable security tools to avoid possible detection of their tools and activities. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |8.3.0 |4
 
-|<<potential-disabling-of-selinux, Potential Disabling of SELinux>> |Identifies potential attempts to disable Security-Enhanced Linux (SELinux), which is a Linux kernel security feature to support access control policies. Adversaries may disable security tools to avoid possible detection of their tools and activities. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |107
+|<<potential-disabling-of-selinux, Potential Disabling of SELinux>> |Identifies potential attempts to disable Security-Enhanced Linux (SELinux), which is a Linux kernel security feature to support access control policies. Adversaries may disable security tools to avoid possible detection of their tools and activities. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Auditd Manager] |8.3.0 |108
 
 |<<potential-enumeration-via-active-directory-web-service, Potential Enumeration via Active Directory Web Service>> |Identifies processes loading Active Directory related modules followed by a network connection to the ADWS dedicated TCP port. Adversaries may abuse the ADWS Windows service that allows Active Directory to be queried via this web service. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend] |8.3.0 |1
 
@@ -1192,7 +1192,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-hidden-local-user-account-creation, Potential Hidden Local User Account Creation>> |Identifies attempts to create a local account that will be hidden from the macOS logon window. This may indicate an attempt to evade user attention while maintaining persistence using a separate local account. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |105
 
-|<<potential-hidden-process-via-mount-hidepid, Potential Hidden Process via Mount Hidepid>> |Identifies the execution of mount process with hidepid parameter, which can make processes invisible to other users from the system. Adversaries using Linux kernel version 3.2+ (or RHEL/CentOS v6.5+ above) can hide the process from other users. When hidepid=2 option is executed to mount the /proc filesystem, only the root user can see all processes and the logged-in user can only see their own process. This provides a defense evasion mechanism for the adversaries to hide their process executions from all other commands such as ps, top, pgrep and more. With the Linux kernel hardening hidepid option all the user has to do is remount the /proc filesystem with the option, which can now be monitored and detected. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |5
+|<<potential-hidden-process-via-mount-hidepid, Potential Hidden Process via Mount Hidepid>> |Identifies the execution of mount process with hidepid parameter, which can make processes invisible to other users from the system. Adversaries using Linux kernel version 3.2+ (or RHEL/CentOS v6.5+ above) can hide the process from other users. When hidepid=2 option is executed to mount the /proc filesystem, only the root user can see all processes and the logged-in user can only see their own process. This provides a defense evasion mechanism for the adversaries to hide their process executions from all other commands such as ps, top, pgrep and more. With the Linux kernel hardening hidepid option all the user has to do is remount the /proc filesystem with the option, which can now be monitored and detected. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Auditd Manager] |8.3.0 |6
 
 |<<potential-internal-linux-ssh-brute-force-detected, Potential Internal Linux SSH Brute Force Detected>> |Identifies multiple internal consecutive login failures targeting a user account from the same source address within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to these accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |9
 
@@ -1212,13 +1212,13 @@ and their rule type is `machine_learning`.
 
 |<<potential-linux-backdoor-user-account-creation, Potential Linux Backdoor User Account Creation>> |Identifies the attempt to create a new backdoor user by setting the user's UID to 0. Attackers may alter a user's UID to 0 to establish persistence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |5
 
-|<<potential-linux-credential-dumping-via-proc-filesystem, Potential Linux Credential Dumping via Proc Filesystem>> |Identifies the execution of the mimipenguin exploit script which is linux adaptation of Windows tool mimikatz. Mimipenguin exploit script is used to dump clear text passwords from a currently logged-in user. The tool exploits a known vulnerability CVE-2018-20781. Malicious actors can exploit the cleartext credentials in memory by dumping the process and extracting lines that have a high probability of containing cleartext passwords. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |5
+|<<potential-linux-credential-dumping-via-proc-filesystem, Potential Linux Credential Dumping via Proc Filesystem>> |Identifies the execution of the mimipenguin exploit script which is linux adaptation of Windows tool mimikatz. Mimipenguin exploit script is used to dump clear text passwords from a currently logged-in user. The tool exploits a known vulnerability CVE-2018-20781. Malicious actors can exploit the cleartext credentials in memory by dumping the process and extracting lines that have a high probability of containing cleartext passwords. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |6
 
-|<<potential-linux-credential-dumping-via-unshadow, Potential Linux Credential Dumping via Unshadow>> |Identifies the execution of the unshadow utility which is part of John the Ripper, a password-cracking tool on the host machine. Malicious actors can use the utility to retrieve the combined contents of the '/etc/shadow' and '/etc/password' files. Using the combined file generated from the utility, the malicious threat actors can use them as input for password-cracking utilities or prepare themselves for future operations by gathering credential information of the victim. |[Data Source: Elastic Endgame], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |6
+|<<potential-linux-credential-dumping-via-unshadow, Potential Linux Credential Dumping via Unshadow>> |Identifies the execution of the unshadow utility which is part of John the Ripper, a password-cracking tool on the host machine. Malicious actors can use the utility to retrieve the combined contents of the '/etc/shadow' and '/etc/password' files. Using the combined file generated from the utility, the malicious threat actors can use them as input for password-cracking utilities or prepare themselves for future operations by gathering credential information of the victim. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |7
 
 |<<potential-linux-hack-tool-launched, Potential Linux Hack Tool Launched>> |Monitors for the execution of different processes that might be used by attackers for malicious intent. An alert from this rule should be investigated further, as hack tools are commonly used by blue teamers and system administrators as well. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |2
 
-|<<potential-linux-local-account-brute-force-detected, Potential Linux Local Account Brute Force Detected>> |Identifies multiple consecutive login attempts executed by one process targeting a local linux user account within a short time interval. Adversaries might brute force login attempts across different users with a default wordlist or a set of customly crafted passwords in an attempt to gain access to these accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |4
+|<<potential-linux-local-account-brute-force-detected, Potential Linux Local Account Brute Force Detected>> |Identifies multiple consecutive login attempts executed by one process targeting a local linux user account within a short time interval. Adversaries might brute force login attempts across different users with a default wordlist or a set of customly crafted passwords in an attempt to gain access to these accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |5
 
 |<<potential-linux-ransomware-note-creation-detected, Potential Linux Ransomware Note Creation Detected>> |This rule identifies a sequence of a mass file encryption event in conjunction with the creation of a .txt file with a file name containing ransomware keywords executed by the same process in a 1 second timespan. Ransomware is a type of malware that encrypts a victim's files or systems and demands payment (usually in cryptocurrency) in exchange for the decryption key. One important indicator of a ransomware attack is the mass encryption of the file system, after which a new file extension is added to the file. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact], [Data Source: Elastic Defend] |8.3.0 |7
 
@@ -1226,25 +1226,25 @@ and their rule type is `machine_learning`.
 
 |<<potential-linux-ssh-x11-forwarding, Potential Linux SSH X11 Forwarding>> |This rule monitors for X11 forwarding via SSH. X11 forwarding is a feature that allows users to run graphical applications on a remote server and display the application's graphical user interface on their local machine. Attackers can abuse X11 forwarding for tunneling their GUI-based tools, pivot through compromised systems, and create covert communication channels, enabling lateral movement and facilitating remote control of systems within a network. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
 
-|<<potential-linux-tunneling-and-or-port-forwarding, Potential Linux Tunneling and/or Port Forwarding>> |This rule monitors for a set of Linux utilities that can be used for tunneling and port forwarding. Attackers can leverage tunneling and port forwarding techniques to bypass network defenses, establish hidden communication channels, and gain unauthorized access to internal resources, facilitating data exfiltration, lateral movement, and remote control. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend] |8.3.0 |4
+|<<potential-linux-tunneling-and-or-port-forwarding, Potential Linux Tunneling and/or Port Forwarding>> |This rule monitors for a set of Linux utilities that can be used for tunneling and port forwarding. Attackers can leverage tunneling and port forwarding techniques to bypass network defenses, establish hidden communication channels, and gain unauthorized access to internal resources, facilitating data exfiltration, lateral movement, and remote control. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |5
 
 |<<potential-local-ntlm-relay-via-http, Potential Local NTLM Relay via HTTP>> |Identifies attempt to coerce a local NTLM authentication via HTTP using the Windows Printer Spooler service as a target. An adversary may use this primitive in combination with other techniques to elevate privileges on a compromised system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |107
 
-|<<potential-masquerading-as-browser-process, Potential Masquerading as Browser Process>> |Identifies suspicious instances of browser processes, such as unsigned or signed with unusual certificates, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |2
+|<<potential-masquerading-as-browser-process, Potential Masquerading as Browser Process>> |Identifies suspicious instances of browser processes, such as unsigned or signed with unusual certificates, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |3
 
-|<<potential-masquerading-as-business-app-installer, Potential Masquerading as Business App Installer>> |Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Initial Access], [Tactic: Execution], [Rule Type: BBR] |8.3.0 |2
+|<<potential-masquerading-as-business-app-installer, Potential Masquerading as Business App Installer>> |Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Initial Access], [Tactic: Execution] |8.3.0 |3
 
 |<<potential-masquerading-as-communication-apps, Potential Masquerading as Communication Apps>> |Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |4
 
-|<<potential-masquerading-as-system32-dll, Potential Masquerading as System32 DLL>> |Identifies suspicious instances of default system32 DLLs either unsigned or signed with non-MS certificates. This can potentially indicate the attempt to masquerade as system DLLs, perform DLL Search Order Hijacking or backdoor and resign legitimate DLLs. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR] |8.4.0 |102
+|<<potential-masquerading-as-system32-dll, Potential Masquerading as System32 DLL>> |Identifies suspicious instances of default system32 DLLs either unsigned or signed with non-MS certificates. This can potentially indicate the attempt to masquerade as system DLLs, perform DLL Search Order Hijacking or backdoor and resign legitimate DLLs. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR] |8.4.0 |103
 
-|<<potential-masquerading-as-system32-executable, Potential Masquerading as System32 Executable>> |Identifies suspicious instances of default system32 executables, either unsigned or signed with non-MS certificates. This could indicate the attempt to masquerade as system executables or backdoored and resigned legitimate executables. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR] |8.3.0 |2
+|<<potential-masquerading-as-system32-executable, Potential Masquerading as System32 Executable>> |Identifies suspicious instances of default system32 executables, either unsigned or signed with non-MS certificates. This could indicate the attempt to masquerade as system executables or backdoored and resigned legitimate executables. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR] |8.3.0 |3
 
 |<<potential-masquerading-as-vlc-dll, Potential Masquerading as VLC DLL>> |Identifies instances of VLC-related DLLs which are not signed by the original developer. Attackers may name their payload as legitimate applications to blend into the environment, or embedding its malicious code within legitimate applications to deceive machine learning algorithms by incorporating authentic and benign code. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR] |8.3.0 |2
 
 |<<potential-memory-seeking-activity, Potential Memory Seeking Activity>> |Monitors for the execution of Unix utilities that may be leveraged as memory address seekers. Attackers may leverage built-in utilities to seek specific memory addresses, allowing for potential future manipulation/exploitation. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |1
 
-|<<potential-meterpreter-reverse-shell, Potential Meterpreter Reverse Shell>> |This detection rule identifies a sample of suspicious Linux system file reads used for system fingerprinting, leveraged by the Metasploit Meterpreter shell to gather information about the target that it is executing its shell on. Detecting this pattern is indicative of a successful meterpreter shell connection. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.6.0 |4
+|<<potential-meterpreter-reverse-shell, Potential Meterpreter Reverse Shell>> |This detection rule identifies a sample of suspicious Linux system file reads used for system fingerprinting, leveraged by the Metasploit Meterpreter shell to gather information about the target that it is executing its shell on. Detecting this pattern is indicative of a successful meterpreter shell connection. |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.6.0 |5
 
 |<<potential-microsoft-office-sandbox-evasion, Potential Microsoft Office Sandbox Evasion>> |Identifies the creation of a suspicious zip file prepended with special characters. Sandboxed Microsoft Office applications on macOS are allowed to write files that start with special characters, which can be combined with an AutoStart location to achieve sandbox evasion. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |105
 
@@ -1266,7 +1266,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-openssh-backdoor-logging-activity, Potential OpenSSH Backdoor Logging Activity>> |Identifies a Secure Shell (SSH) client or server process creating or writing to a known SSH backdoor log file. Adversaries may modify SSH related binaries for persistence or credential access via patching sensitive functions to enable unauthorized access or to log SSH credentials for exfiltration. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
-|<<potential-outgoing-rdp-connection-by-unusual-process, Potential Outgoing RDP Connection by Unusual Process>> |Adversaries may attempt to connect to a remote system over Windows Remote Desktop Protocol (RDP) to achieve lateral movement. Adversaries may avoid using the Microsoft Terminal Services Client (mstsc.exe) binary to establish an RDP connection to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |1
+|<<potential-outgoing-rdp-connection-by-unusual-process, Potential Outgoing RDP Connection by Unusual Process>> |Adversaries may attempt to connect to a remote system over Windows Remote Desktop Protocol (RDP) to achieve lateral movement. Adversaries may avoid using the Microsoft Terminal Services Client (mstsc.exe) binary to establish an RDP connection to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |2
 
 |<<potential-pass-the-hash-pth-attempt, Potential Pass-the-Hash (PtH) Attempt>> |Adversaries may pass the hash using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.4.0 |3
 
@@ -1328,11 +1328,11 @@ and their rule type is `machine_learning`.
 
 |<<potential-protocol-tunneling-via-chisel-client, Potential Protocol Tunneling via Chisel Client>> |This rule monitors for common command line flags leveraged by the Chisel client utility followed by a connection attempt. Chisel is a command-line utility used for creating and managing TCP and UDP tunnels, enabling port forwarding and secure communication between machines. Attackers can abuse the Chisel utility to establish covert communication channels, bypass network restrictions, and carry out malicious activities by creating tunnels that allow unauthorized access to internal systems. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend] |8.3.0 |4
 
-|<<potential-protocol-tunneling-via-chisel-server, Potential Protocol Tunneling via Chisel Server>> |This rule monitors for common command line flags leveraged by the Chisel server utility followed by a received connection within a timespan of 1 minute. Chisel is a command-line utility used for creating and managing TCP and UDP tunnels, enabling port forwarding and secure communication between machines. Attackers can abuse the Chisel utility to establish covert communication channels, bypass network restrictions, and carry out malicious activities by creating tunnels that allow unauthorized access to internal systems. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend] |8.3.0 |4
+|<<potential-protocol-tunneling-via-chisel-server, Potential Protocol Tunneling via Chisel Server>> |This rule monitors for common command line flags leveraged by the Chisel server utility followed by a received connection within a timespan of 1 minute. Chisel is a command-line utility used for creating and managing TCP and UDP tunnels, enabling port forwarding and secure communication between machines. Attackers can abuse the Chisel utility to establish covert communication channels, bypass network restrictions, and carry out malicious activities by creating tunnels that allow unauthorized access to internal systems. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend] |8.3.0 |5
 
 |<<potential-protocol-tunneling-via-earthworm, Potential Protocol Tunneling via EarthWorm>> |Identifies the execution of the EarthWorm tunneler. Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection and network filtering, or to enable access to otherwise unreachable systems. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
-|<<potential-pspy-process-monitoring-detected, Potential Pspy Process Monitoring Detected>> |This rule leverages auditd to monitor for processes scanning different processes within the /proc directory using the openat syscall. This is a strong indication for the usage of the pspy utility. Attackers may leverage the pspy process monitoring utility to monitor system processes without requiring root permissions, in order to find potential privilege escalation vectors. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery] |8.3.0 |5
+|<<potential-pspy-process-monitoring-detected, Potential Pspy Process Monitoring Detected>> |This rule leverages auditd to monitor for processes scanning different processes within the /proc directory using the openat syscall. This is a strong indication for the usage of the pspy utility. Attackers may leverage the pspy process monitoring utility to monitor system processes without requiring root permissions, in order to find potential privilege escalation vectors. |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery] |8.3.0 |6
 
 |<<potential-remote-code-execution-via-web-server, Potential Remote Code Execution via Web Server>> |Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. Attackers may exploit a vulnerability in a web application to execute commands via a web server, or place a backdoor file that can be abused to gain code execution as a mechanism for persistence. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Initial Access], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |6
 
@@ -1342,7 +1342,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-remote-desktop-tunneling-detected, Potential Remote Desktop Tunneling Detected>> |Identifies potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
-|<<potential-remote-file-execution-via-msiexec, Potential Remote File Execution via MSIEXEC>> |Identifies the execution of the built-in Windows Installer, msiexec.exe, to install a remote package. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |1
+|<<potential-remote-file-execution-via-msiexec, Potential Remote File Execution via MSIEXEC>> |Identifies the execution of the built-in Windows Installer, msiexec.exe, to install a remote package. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |2
 
 |<<potential-reverse-shell, Potential Reverse Shell>> |This detection rule identifies suspicious network traffic patterns associated with TCP reverse shell activity. This activity consists of a parent-child relationship where a network event is followed by the creation of a shell process. An attacker may establish a Linux TCP reverse shell to gain remote access to a target system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |7
 
@@ -1358,7 +1358,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-reverse-shell-via-suspicious-child-process, Potential Reverse Shell via Suspicious Child Process>> |This detection rule detects the creation of a shell through a suspicious process chain. Any reverse shells spawned by the specified utilities that are initialized from a single process followed by a network connection attempt will be captured through this rule. Attackers may spawn reverse shells to establish persistence onto a target system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |8
 
-|<<potential-reverse-shell-via-udp, Potential Reverse Shell via UDP>> |This detection rule identifies suspicious network traffic patterns associated with UDP reverse shell activity. This activity consists of a sample of an execve, socket and connect syscall executed by the same process, where the auditd.data.a0-1 indicate a UDP connection, ending with an egress connection event. An attacker may establish a Linux UDP reverse shell to bypass traditional firewall restrictions and gain remote access to a target system covertly. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.6.0 |4
+|<<potential-reverse-shell-via-udp, Potential Reverse Shell via UDP>> |This detection rule identifies suspicious network traffic patterns associated with UDP reverse shell activity. This activity consists of a sample of an execve, socket and connect syscall executed by the same process, where the auditd.data.a0-1 indicate a UDP connection, ending with an egress connection event. An attacker may establish a Linux UDP reverse shell to bypass traditional firewall restrictions and gain remote access to a target system covertly. |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.6.0 |5
 
 |<<potential-ssh-it-ssh-worm-downloaded, Potential SSH-IT SSH Worm Downloaded>> |Identifies processes that are capable of downloading files with command line arguments containing URLs to SSH-IT's autonomous SSH worm. This worm intercepts outgoing SSH connections every time a user uses ssh. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |2
 
@@ -1374,9 +1374,9 @@ and their rule type is `machine_learning`.
 
 |<<potential-shell-via-wildcard-injection-detected, Potential Shell via Wildcard Injection Detected>> |This rule monitors for the execution of a set of linux binaries, that are potentially vulnerable to wildcard injection, with suspicious command line flags followed by a shell spawn event. Linux wildcard injection is a type of security vulnerability where attackers manipulate commands or input containing wildcards (e.g., *, ?, []) to execute unintended operations or access sensitive data by tricking the system into interpreting the wildcard characters in unexpected ways. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |4
 
-|<<potential-successful-linux-ftp-brute-force-attack-detected, Potential Successful Linux FTP Brute Force Attack Detected>> |An FTP (file transfer protocol) brute force attack is a method where an attacker systematically tries different combinations of usernames and passwords to gain unauthorized access to an FTP server, and if successful, the impact can include unauthorized data access, manipulation, or theft, compromising the security and integrity of the server and potentially exposing sensitive information. This rule identifies multiple consecutive authentication failures targeting a specific user account from the same source address and within a short time interval, followed by a successful authentication. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |5
+|<<potential-successful-linux-ftp-brute-force-attack-detected, Potential Successful Linux FTP Brute Force Attack Detected>> |An FTP (file transfer protocol) brute force attack is a method where an attacker systematically tries different combinations of usernames and passwords to gain unauthorized access to an FTP server, and if successful, the impact can include unauthorized data access, manipulation, or theft, compromising the security and integrity of the server and potentially exposing sensitive information. This rule identifies multiple consecutive authentication failures targeting a specific user account from the same source address and within a short time interval, followed by a successful authentication. |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |6
 
-|<<potential-successful-linux-rdp-brute-force-attack-detected, Potential Successful Linux RDP Brute Force Attack Detected>> |An RDP (Remote Desktop Protocol) brute force attack involves an attacker repeatedly attempting various username and password combinations to gain unauthorized access to a remote computer via RDP, and if successful, the potential impact can include unauthorized control over the compromised system, data theft, or the ability to launch further attacks within the network, jeopardizing the security and confidentiality of the targeted system and potentially compromising the entire network infrastructure. This rule identifies multiple consecutive authentication failures targeting a specific user account within a short time interval, followed by a successful authentication. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |5
+|<<potential-successful-linux-rdp-brute-force-attack-detected, Potential Successful Linux RDP Brute Force Attack Detected>> |An RDP (Remote Desktop Protocol) brute force attack involves an attacker repeatedly attempting various username and password combinations to gain unauthorized access to a remote computer via RDP, and if successful, the potential impact can include unauthorized control over the compromised system, data theft, or the ability to launch further attacks within the network, jeopardizing the security and confidentiality of the targeted system and potentially compromising the entire network infrastructure. This rule identifies multiple consecutive authentication failures targeting a specific user account within a short time interval, followed by a successful authentication. |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |6
 
 |<<potential-successful-ssh-brute-force-attack, Potential Successful SSH Brute Force Attack>> |Identifies multiple SSH login failures followed by a successful one from the same source address. Adversaries can attempt to login into multiple users with a common or known password to gain access to accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |9
 
@@ -1424,15 +1424,15 @@ and their rule type is `machine_learning`.
 
 |<<powershell-script-with-archive-compression-capabilities, PowerShell Script with Archive Compression Capabilities>> |Identifies the use of Cmdlets and methods related to archive compression activities. Adversaries will often compress and encrypt data in preparation for exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |4
 
-|<<powershell-script-with-discovery-capabilities, PowerShell Script with Discovery Capabilities>> |Identifies the use of Cmdlets and methods related to discovery activities. Attackers can use these to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Tactic: Discovery], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |4
+|<<powershell-script-with-discovery-capabilities, PowerShell Script with Discovery Capabilities>> |Identifies the use of Cmdlets and methods related to discovery activities. Attackers can use these to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Tactic: Discovery], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |5
 
 |<<powershell-script-with-encryption-decryption-capabilities, PowerShell Script with Encryption/Decryption Capabilities>> |Identifies the use of Cmdlets and methods related to encryption/decryption of files in PowerShell scripts, which malware and offensive security tools can abuse to encrypt data or decrypt payloads to bypass security solutions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |8.3.0 |5
 
-|<<powershell-script-with-log-clear-capabilities, PowerShell Script with Log Clear Capabilities>> |Identifies the use of Cmdlets and methods related to Windows event log deletion activities. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |3
+|<<powershell-script-with-log-clear-capabilities, PowerShell Script with Log Clear Capabilities>> |Identifies the use of Cmdlets and methods related to Windows event log deletion activities. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |4
 
-|<<powershell-script-with-password-policy-discovery-capabilities, PowerShell Script with Password Policy Discovery Capabilities>> |Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM to perform lateral movement using built-in tools. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Execution], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |3
+|<<powershell-script-with-password-policy-discovery-capabilities, PowerShell Script with Password Policy Discovery Capabilities>> |Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM to perform lateral movement using built-in tools. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Execution], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |4
 
-|<<powershell-script-with-remote-execution-capabilities-via-winrm, PowerShell Script with Remote Execution Capabilities via WinRM>> |Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM to perform lateral movement using built-in tools. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Execution], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |4
+|<<powershell-script-with-remote-execution-capabilities-via-winrm, PowerShell Script with Remote Execution Capabilities via WinRM>> |Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM to perform lateral movement using built-in tools. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Execution], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |5
 
 |<<powershell-script-with-token-impersonation-capabilities, PowerShell Script with Token Impersonation Capabilities>> |Detects scripts that contain PowerShell functions, structures, or Windows API functions related to token impersonation/theft. Attackers may duplicate then impersonate another user's token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: PowerShell Logs] |8.3.0 |10
 
@@ -1450,7 +1450,7 @@ and their rule type is `machine_learning`.
 
 |<<powershell-suspicious-script-with-screenshot-capabilities, PowerShell Suspicious Script with Screenshot Capabilities>> |Detects PowerShell scripts that can take screenshots, which is a common feature in post-exploitation kits and remote access tools (RATs). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |107
 
-|<<privilege-escalation-via-cap-chown-cap-fowner-capabilities, Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities>> |Identifies instances where a processes (granted CAP_CHOWN and/or CAP_FOWNER capabilities) is executed, after which the ownership of a suspicious file or binary is changed. In Linux, the CAP_CHOWN capability allows a process to change the owner of a file, while CAP_FOWNER permits it to bypass permission checks on operations that require file ownership (like reading, writing, and executing). Attackers may abuse these capabilities to obtain unauthorized access to files. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.11.0 |1
+|<<privilege-escalation-via-cap-chown-cap-fowner-capabilities, Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities>> |Identifies instances where a processes (granted CAP_CHOWN and/or CAP_FOWNER capabilities) is executed, after which the ownership of a suspicious file or binary is changed. In Linux, the CAP_CHOWN capability allows a process to change the owner of a file, while CAP_FOWNER permits it to bypass permission checks on operations that require file ownership (like reading, writing, and executing). Attackers may abuse these capabilities to obtain unauthorized access to files. |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.11.0 |2
 
 |<<privilege-escalation-via-cap-setuid-setgid-capabilities, Privilege Escalation via CAP_SETUID/SETGID Capabilities>> |Identifies instances where a process (granted CAP_SETUID and/or CAP_SETGID capabilities) is executed, after which the user's access is elevated to UID/GID 0 (root). In Linux, the CAP_SETUID and CAP_SETGID capabilities allow a process to change its UID and GID, respectively, providing control over user and group identity management. Attackers may leverage a misconfiguration for exploitation in order to escalate their privileges to root. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.11.0 |1
 
@@ -1472,7 +1472,7 @@ and their rule type is `machine_learning`.
 
 |<<process-capability-enumeration, Process Capability Enumeration>> |Identifies recursive process capability enumeration of the entire filesystem through the getcap command. Malicious users may manipulate identified capabilities to gain root privileges. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend] |8.11.0 |1
 
-|<<process-created-with-a-duplicated-token, Process Created with a Duplicated Token>> |Identifies the creation of a process impersonating the token of another user logon session. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.4.0 |1
+|<<process-created-with-a-duplicated-token, Process Created with a Duplicated Token>> |Identifies the creation of a process impersonating the token of another user logon session. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.4.0 |2
 
 |<<process-created-with-an-elevated-token, Process Created with an Elevated Token>> |Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.4.0 |5
 
@@ -1560,7 +1560,7 @@ and their rule type is `machine_learning`.
 
 |<<remote-windows-service-installed, Remote Windows Service Installed>> |Identifies a network logon followed by Windows service creation with same LogonId. This could be indicative of lateral movement, but will be noisy if commonly done by administrators." |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Persistence] |8.3.0 |6
 
-|<<remote-xsl-script-execution-via-com, Remote XSL Script Execution via COM>> |Identifies the execution of a hosted XSL script using the Microsoft.XMLDOM COM interface via Microsoft Office processes. This behavior may indicate adversarial activity to execute malicious JScript or VBScript on the system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |1
+|<<remote-xsl-script-execution-via-com, Remote XSL Script Execution via COM>> |Identifies the execution of a hosted XSL script using the Microsoft.XMLDOM COM interface via Microsoft Office processes. This behavior may indicate adversarial activity to execute malicious JScript or VBScript on the system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |2
 
 |<<remotely-started-services-via-rpc, Remotely Started Services via RPC>> |Identifies remote execution of Windows services over remote procedure call (RPC). This could be indicative of lateral movement, but will be noisy if commonly done by administrators." |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |109
 
@@ -1622,11 +1622,11 @@ and their rule type is `machine_learning`.
 
 |<<service-creation-via-local-kerberos-authentication, Service Creation via Local Kerberos Authentication>> |Identifies a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, followed by a sevice creation from the same LogonId. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined user to local System privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Credential Access], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |105
 
-|<<service-disabled-via-registry-modification, Service Disabled via Registry Modification>> |Identifies attempts to modify services start settings using processes other than services.exe. Attackers may attempt to modify security and monitoring services to avoid detection or delay response. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
+|<<service-disabled-via-registry-modification, Service Disabled via Registry Modification>> |Identifies attempts to modify services start settings using processes other than services.exe. Attackers may attempt to modify security and monitoring services to avoid detection or delay response. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
 
 |<<service-path-modification, Service Path Modification>> |Identifies attempts to modify a service path by an unusual process. Attackers may attempt to modify existing services for persistence or privilege escalation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
-|<<service-path-modification-via-sc-exe, Service Path Modification via sc.exe>> |Identifies attempts to modify a service path setting using sc.exe. Attackers may attempt to modify existing services for persistence or privilege escalation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
+|<<service-path-modification-via-sc-exe, Service Path Modification via sc.exe>> |Identifies attempts to modify a service path setting using sc.exe. Attackers may attempt to modify existing services for persistence or privilege escalation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
 
 |<<setcap-setuid-setgid-capability-set, Setcap setuid/setgid Capability Set>> |This rule monitors for the addition of the cap_setuid+ep or cap_setgid+ep capabilities via setcap. Setuid (Set User ID) and setgid (Set Group ID) are Unix-like OS features that enable processes to run with elevated privileges, based on the file owner or group. Threat actors can exploit these attributes to achieve persistence by creating malicious binaries, allowing them to maintain control over a compromised system with elevated permissions. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |4
 
@@ -1720,7 +1720,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-cmd-execution-via-wmi, Suspicious Cmd Execution via WMI>> |Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
-|<<suspicious-communication-app-child-process, Suspicious Communication App Child Process>> |Identifies suspicious child processes of communications apps, which can indicate a potential masquerading as the communication app or the exploitation of a vulnerability on the application causing it to execute code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |2
+|<<suspicious-communication-app-child-process, Suspicious Communication App Child Process>> |Identifies suspicious child processes of communications apps, which can indicate a potential masquerading as the communication app or the exploitation of a vulnerability on the application causing it to execute code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |3
 
 |<<suspicious-content-extracted-or-decompressed-via-funzip, Suspicious Content Extracted or Decompressed via Funzip>> |Identifies when suspicious content is extracted from a file and subsequently decompressed using the funzip utility. Malware may execute the tail utility using the "-c" option to read a sequence of bytes from the end of a file. The output from tail can be piped to funzip in order to decompress malicious code before it is executed. This behavior is consistent with malware families such as Bundlore. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |4
 
@@ -1728,7 +1728,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-dll-loaded-for-persistence-or-privilege-escalation, Suspicious DLL Loaded for Persistence or Privilege Escalation>> |Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
-|<<suspicious-data-encryption-via-openssl-utility, Suspicious Data Encryption via OpenSSL Utility>> |Identifies when the openssl command-line utility is used to encrypt multiple files on a host within a short time window. Adversaries may encrypt data on a single or multiple systems in order to disrupt the availability of their target's data and may attempt to hold the organization's data to ransom for the purposes of extortion. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact], [Data Source: Elastic Defend] |8.3.0 |4
+|<<suspicious-data-encryption-via-openssl-utility, Suspicious Data Encryption via OpenSSL Utility>> |Identifies when the openssl command-line utility is used to encrypt multiple files on a host within a short time window. Adversaries may encrypt data on a single or multiple systems in order to disrupt the availability of their target's data and may attempt to hold the organization's data to ransom for the purposes of extortion. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact], [Data Source: Elastic Defend] |8.3.0 |5
 
 |<<suspicious-dynamic-linker-discovery-via-od, Suspicious Dynamic Linker Discovery via od>> |Monitors for dynamic linker discovery via the od utility. od (octal dump) is a command-line utility in Unix operating systems used for displaying data in various formats, including octal, hexadecimal, decimal, and ASCII, primarily used for examining and debugging binary files or data streams. Attackers can leverage od to analyze the dynamic linker by identifying injection points and craft exploits based on the observed behaviors and structures within these files. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |1
 
@@ -1736,6 +1736,8 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-endpoint-security-parent-process, Suspicious Endpoint Security Parent Process>> |A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
+|<<suspicious-execution-from-inet-cache, Suspicious Execution from INET Cache>> |Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious content via WININET during initial access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Command and Control], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |1
+
 |<<suspicious-execution-from-a-mounted-device, Suspicious Execution from a Mounted Device>> |Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may use this technique to evade defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<suspicious-execution-via-msiexec, Suspicious Execution via MSIEXEC>> |Identifies suspicious execution of the built-in Windows Installer, msiexec.exe, to install a package from usual paths or parent process. Adversaries may abuse msiexec.exe to launch malicious local MSI files. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |1
@@ -1790,7 +1792,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-mining-process-creation-event, Suspicious Mining Process Creation Event>> |Identifies service creation events of common mining services, possibly indicating the infection of a system with a cryptominer. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |5
 
-|<<suspicious-modprobe-file-event, Suspicious Modprobe File Event>> |Detects file events involving kernel modules in modprobe configuration files, which may indicate unauthorized access or manipulation of critical kernel modules. Attackers may tamper with the modprobe files to load malicious or unauthorized kernel modules, potentially bypassing security measures, escalating privileges, or hiding their activities within the system. |[OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.6.0 |105
+|<<suspicious-modprobe-file-event, Suspicious Modprobe File Event>> |Detects file events involving kernel modules in modprobe configuration files, which may indicate unauthorized access or manipulation of critical kernel modules. Attackers may tamper with the modprobe files to load malicious or unauthorized kernel modules, potentially bypassing security measures, escalating privileges, or hiding their activities within the system. |[Data Source: Auditd Manager], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.6.0 |106
 
 |<<suspicious-module-loaded-by-lsass, Suspicious Module Loaded by LSASS>> |Identifies LSASS loading an unsigned or untrusted DLL. Windows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |6
 
@@ -1804,7 +1806,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-pdf-reader-child-process, Suspicious PDF Reader Child Process>> |Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Initial Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
-|<<suspicious-passwd-file-event-action, Suspicious Passwd File Event Action>> |Monitors for the generation of a passwd password entry via openssl, followed by a file write activity on the "/etc/passwd" file. The "/etc/passwd" file in Linux stores user account information, including usernames, user IDs, group IDs, home directories, and default shell paths. Attackers may exploit a misconfiguration in the "/etc/passwd" file permissions or other privileges to add a new entry to the "/etc/passwd" file with root permissions, and leverage this new user account to login as root. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |1
+|<<suspicious-passwd-file-event-action, Suspicious Passwd File Event Action>> |Monitors for the generation of a passwd password entry via openssl, followed by a file write activity on the "/etc/passwd" file. The "/etc/passwd" file in Linux stores user account information, including usernames, user IDs, group IDs, home directories, and default shell paths. Attackers may exploit a misconfiguration in the "/etc/passwd" file permissions or other privileges to add a new entry to the "/etc/passwd" file with root permissions, and leverage this new user account to login as root. |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |2
 
 |<<suspicious-portable-executable-encoded-in-powershell-script, Suspicious Portable Executable Encoded in Powershell Script>> |Detects the presence of a portable executable (PE) in a PowerShell script by looking for its encoded header. Attackers embed PEs into PowerShell scripts to inject them into memory, avoiding defences by not writing to disk. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |109
 
@@ -1820,7 +1822,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-printspooler-service-executable-file-creation, Suspicious PrintSpooler Service Executable File Creation>> |Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to the following CVE's - CVE-2020-1048, CVE-2020-1337 and CVE-2020-1300 and verify that the impacted system is patched. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<suspicious-proc-pseudo-file-system-enumeration, Suspicious Proc Pseudo File System Enumeration>> |This rule monitors for a rapid enumeration of 25 different proc cmd, stat, and exe files, which suggests an abnormal activity pattern. Such behavior could be an indicator of a malicious process scanning or gathering information about running processes, potentially for reconnaissance, privilege escalation, or identifying vulnerable targets. |[OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.3.0 |5
+|<<suspicious-proc-pseudo-file-system-enumeration, Suspicious Proc Pseudo File System Enumeration>> |This rule monitors for a rapid enumeration of 25 different proc cmd, stat, and exe files, which suggests an abnormal activity pattern. Such behavior could be an indicator of a malicious process scanning or gathering information about running processes, potentially for reconnaissance, privilege escalation, or identifying vulnerable targets. |[Data Source: Auditd Manager], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.3.0 |6
 
 |<<suspicious-process-access-via-direct-system-call, Suspicious Process Access via Direct System Call>> |Identifies suspicious process access events from an unknown memory region. Endpoint security solutions usually hook userland Windows APIs in order to decide if the code that is being executed is malicious or not. It's possible to bypass hooked functions by writing malicious functions that call syscalls directly. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Sysmon Only] |8.8.0 |210
 
@@ -1848,7 +1850,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-symbolic-link-created, Suspicious Symbolic Link Created>> |Identifies the creation of a symbolic link to a suspicious file or location. A symbolic link is a reference to a file or directory that acts as a pointer or shortcut, allowing users to access the target file or directory from a different location in the file system. An attacker can potentially leverage symbolic links for privilege escalation by tricking a privileged process into following the symbolic link to a sensitive file, giving the attacker access to data or capabilities they would not normally have. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |4
 
-|<<suspicious-sysctl-file-event, Suspicious Sysctl File Event>> |Monitors file events on sysctl configuration files (e.g., /etc/sysctl.conf, /etc/sysctl.d/*.conf) to identify potential unauthorized access or manipulation of system-level configuration settings. Attackers may tamper with the sysctl configuration files to modify kernel parameters, potentially compromising system stability, performance, or security. |[OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.6.0 |105
+|<<suspicious-sysctl-file-event, Suspicious Sysctl File Event>> |Monitors file events on sysctl configuration files (e.g., /etc/sysctl.conf, /etc/sysctl.d/*.conf) to identify potential unauthorized access or manipulation of system-level configuration settings. Attackers may tamper with the sysctl configuration files to modify kernel parameters, potentially compromising system stability, performance, or security. |[Data Source: Auditd Manager], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.6.0 |106
 
 |<<suspicious-system-commands-executed-by-previously-unknown-executable, Suspicious System Commands Executed by Previously Unknown Executable>> |This rule monitors for the execution of several commonly used system commands executed by a previously unknown executable located in commonly abused directories. An alert from this rule can indicate the presence of potentially malicious activity, such as the execution of unauthorized or suspicious processes attempting to run malicious code. Detecting and investigating such behavior can help identify and mitigate potential security threats, protecting the system and its data from potential compromise. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.6.0 |104
 
@@ -1856,7 +1858,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-troubleshooting-pack-cabinet-execution, Suspicious Troubleshooting Pack Cabinet Execution>> |Identifies the execution of the Microsoft Diagnostic Wizard to open a diagcab file from a suspicious path and with an unusual parent process. This may indicate an attempt to execute malicious Troubleshooting Pack Cabinet files. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |1
 
-|<<suspicious-utility-launched-via-proxychains, Suspicious Utility Launched via ProxyChains>> |This rule monitors for the execution of suspicious linux tools through ProxyChains. ProxyChains is a command-line tool that enables the routing of network connections through intermediary proxies, enhancing anonymity and enabling access to restricted resources. Attackers can exploit the ProxyChains utility to hide their true source IP address, evade detection, and perform malicious activities through a chain of proxy servers, potentially masking their identity and intentions. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend] |8.3.0 |4
+|<<suspicious-utility-launched-via-proxychains, Suspicious Utility Launched via ProxyChains>> |This rule monitors for the execution of suspicious linux tools through ProxyChains. ProxyChains is a command-line tool that enables the routing of network connections through intermediary proxies, enhancing anonymity and enabling access to restricted resources. Attackers can exploit the ProxyChains utility to hide their true source IP address, evade detection, and perform malicious activities through a chain of proxy servers, potentially masking their identity and intentions. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |8.3.0 |5
 
 |<<suspicious-wmi-event-subscription-created, Suspicious WMI Event Subscription Created>> |Detects the creation of a WMI Event Subscription. Attackers can abuse this mechanism for persistence or to elevate to SYSTEM privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Sysmon Only] |8.8.0 |105
 
@@ -1882,7 +1884,7 @@ and their rule type is `machine_learning`.
 
 |<<symbolic-link-to-shadow-copy-created, Symbolic Link to Shadow Copy Created>> |Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow copy, including sensitive files such as ntds.dit, System Boot Key and browser offline credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
-|<<system-binary-copied-and-or-moved-to-suspicious-directory, System Binary Copied and/or Moved to Suspicious Directory>> |This rule monitors for the copying or moving of a system binary to a suspicious directory. Adversaries may copy/move and rename system binaries to evade detection. Copying a system binary to a different location should not occur often, so if it does, the activity should be investigated. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |5
+|<<system-binary-copied-and-or-moved-to-suspicious-directory, System Binary Copied and/or Moved to Suspicious Directory>> |This rule monitors for the copying or moving of a system binary to a suspicious directory. Adversaries may copy/move and rename system binaries to evade detection. Copying a system binary to a different location should not occur often, so if it does, the activity should be investigated. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |6
 
 |<<system-hosts-file-access, System Hosts File Access>> |Identifies the use of built-in tools to read the contents of \etc\hosts on a local machine. Attackers may use this data to discover remote machines in an environment that may be used for Lateral Movement from the current system. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |2
 
@@ -1898,7 +1900,7 @@ and their rule type is `machine_learning`.
 
 |<<system-shells-via-services, System Shells via Services>> |Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
-|<<system-time-discovery, System Time Discovery>> |Detects the usage of commonly used system time discovery techniques, which attackers may use during the reconnaissance phase after compromising a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Rule Type: BBR] |8.3.0 |5
+|<<system-time-discovery, System Time Discovery>> |Detects the usage of commonly used system time discovery techniques, which attackers may use during the reconnaissance phase after compromising a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Rule Type: BBR] |8.3.0 |6
 
 |<<systemkey-access-via-command-line, SystemKey Access via Command Line>> |Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. Adversaries may collect the keychain storage data from a system to acquire credentials. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |105
 
@@ -2030,9 +2032,9 @@ and their rule type is `machine_learning`.
 
 |<<unusual-process-execution-on-wbem-path, Unusual Process Execution on WBEM Path>> |Identifies unusual processes running from the WBEM path, uncommon outside WMI-related Windows processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
-|<<unusual-process-extension, Unusual Process Extension>> |Identifies processes running with unusual extensions that are not typically valid for Windows executables. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
+|<<unusual-process-extension, Unusual Process Extension>> |Identifies processes running with unusual extensions that are not typically valid for Windows executables. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |3
 
-|<<unusual-process-for-mssql-service-accounts, Unusual Process For MSSQL Service Accounts>> |Identifies unusual process executions using MSSQL Service accounts, which can indicate the exploitation/compromise of SQL instances. Attackers may exploit exposed MSSQL instances for initial access or lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Persistence], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
+|<<unusual-process-for-mssql-service-accounts, Unusual Process For MSSQL Service Accounts>> |Identifies unusual process executions using MSSQL Service accounts, which can indicate the exploitation/compromise of SQL instances. Attackers may exploit exposed MSSQL instances for initial access or lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Persistence], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |3
 
 |<<unusual-process-for-a-linux-host, Unusual Process For a Linux Host>> |Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Persistence] |8.3.0 |104
 
@@ -2114,7 +2116,7 @@ and their rule type is `machine_learning`.
 
 |<<wmi-wbemtest-utility-execution, WMI WBEMTEST Utility Execution>> |Adversaries may abuse the WMI diagnostic tool, wbemtest.exe, to enumerate WMI object instances or invoke methods against local or remote endpoints. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
-|<<wmic-remote-command, WMIC Remote Command>> |Identifies the use of wmic.exe to run commands on remote hosts. While this can be used by administrators legitimately, attackers can abuse this built-in utility to achieve lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
+|<<wmic-remote-command, WMIC Remote Command>> |Identifies the use of wmic.exe to run commands on remote hosts. While this can be used by administrators legitimately, attackers can abuse this built-in utility to achieve lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |3
 
 |<<wpad-service-exploit, WPAD Service Exploit>> |Identifies probable exploitation of the Web Proxy Auto-Discovery Protocol (WPAD) service. Attackers who have access to the local network or upstream DNS traffic can inject malicious JavaScript to the WPAD service which can lead to a full system compromise. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |None |1
 
diff --git a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
index 746d53b41d..313f2a9ce0 100644
--- a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
@@ -859,6 +859,7 @@ include::rule-details/suspicious-data-encryption-via-openssl-utility.asciidoc[]
 include::rule-details/suspicious-dynamic-linker-discovery-via-od.asciidoc[]
 include::rule-details/suspicious-emond-child-process.asciidoc[]
 include::rule-details/suspicious-endpoint-security-parent-process.asciidoc[]
+include::rule-details/suspicious-execution-from-inet-cache.asciidoc[]
 include::rule-details/suspicious-execution-from-a-mounted-device.asciidoc[]
 include::rule-details/suspicious-execution-via-msiexec.asciidoc[]
 include::rule-details/suspicious-execution-via-microsoft-office-add-ins.asciidoc[]
diff --git a/docs/detections/prebuilt-rules/rule-details/abnormal-process-id-or-lock-file-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/abnormal-process-id-or-lock-file-created.asciidoc
index bdd1ac0ff8..a6d7b92d2c 100644
--- a/docs/detections/prebuilt-rules/rule-details/abnormal-process-id-or-lock-file-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/abnormal-process-id-or-lock-file-created.asciidoc
@@ -48,11 +48,13 @@ Identifies the creation of a Process ID (PID), lock or reboot file created in te
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Abnormal Process ID or Lock File Created
+*Triage and analysis*
+
+
+
+*Investigating Abnormal Process ID or Lock File Created*
+
 
 Linux applications may need to save their process identification number (PID) for various purposes: from signaling that a program is running to serving as a signal that a previous instance of an application didn't exit successfully. PID files contain its creator process PID in an integer value.
 
@@ -60,7 +62,9 @@ Linux lock files are used to coordinate operations in files so that conflicts an
 
 This rule identifies the creation of PID, lock, or reboot files in the /var/run/ directory. Attackers can masquerade malware, payloads, staged data for exfiltration, and more as legitimate PID files.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Retrieve the file and determine if it is malicious:
     - Check the contents of the PID files. They should only contain integer strings.
@@ -74,12 +78,16 @@ This rule identifies the creation of PID, lock, or reboot files in the /var/run/
 - Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 - Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - False positives can appear if the PID file is legitimate and holding a process ID as intended. If the PID file is an executable or has a file size that's larger than 10 bytes, it should be ruled suspicious.
 - If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of file name and process executable conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -91,7 +99,41 @@ This rule identifies the creation of PID, lock, or reboot files in the /var/run/
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/abnormally-large-dns-response.asciidoc b/docs/detections/prebuilt-rules/rule-details/abnormally-large-dns-response.asciidoc
index 5d35480780..977bb45f63 100644
--- a/docs/detections/prebuilt-rules/rule-details/abnormally-large-dns-response.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/abnormally-large-dns-response.asciidoc
@@ -47,15 +47,19 @@ Specially crafted DNS requests can manipulate a known overflow vulnerability in
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Abnormally Large DNS Response
+*Triage and analysis*
+
+
+
+*Investigating Abnormally Large DNS Response*
+
+
+Detection alerts from this rule indicate possible anomalous activity around large byte DNS responses from a Windows DNS server. This detection rule was created based on activity represented in exploitation of vulnerability (CVE-2020-1350) also known as https://www.elastic.co/blog/detection-rules-for-sigred-vulnerability[SigRed] during July 2020.
+
 
-Detection alerts from this rule indicate possible anomalous activity around large byte DNS responses from a Windows DNS server. This detection rule was created based on activity represented in exploitation of vulnerability (CVE-2020-1350) also known as [SigRed](https://www.elastic.co/blog/detection-rules-for-sigred-vulnerability) during July 2020.
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - This specific rule is sourced from network log activity such as DNS or network level data. It's important to validate the source of the incoming traffic and determine if this activity has been observed previously within an environment.
 - Activity can be further investigated and validated by reviewing any associated Intrusion Detection Signatures (IDS) alerts.
@@ -63,25 +67,30 @@ Detection alerts from this rule indicate possible anomalous activity around larg
 - Validate the patch level and OS of the targeted DNS server to validate the observed activity was not large-scale internet vulnerability scanning.
 - Validate that the source of the network activity was not from an authorized vulnerability scan or compromise assessment.
 
-#### False positive analysis
 
-- Based on this rule, which looks for a threshold of 60k bytes, it is possible for activity to be generated under 65k bytes and related to legitimate behavior. In packet capture files received by the [SANS Internet Storm Center](https://isc.sans.edu/forums/diary/PATCH+NOW+SIGRed+CVE20201350+Microsoft+DNS+Server+Vulnerability/26356/), byte responses were all observed as greater than 65k bytes.
+*False positive analysis*
+
+
+- Based on this rule, which looks for a threshold of 60k bytes, it is possible for activity to be generated under 65k bytes and related to legitimate behavior. In packet capture files received by the https://isc.sans.edu/forums/diary/PATCH+NOW+SIGRed+CVE20201350+Microsoft+DNS+Server+Vulnerability/26356/[SANS Internet Storm Center], byte responses were all observed as greater than 65k bytes.
 - This activity can be triggered by compliance/vulnerability scanning or compromise assessment; it's important to determine the source of the activity and potentially allowlist the source host.
 
-### Related rules
+
+*Related rules*
+
 
 - Unusual Child Process of dns.exe - 8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45
 - Unusual File Modification by dns.exe - c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
-- Ensure that you have deployed the latest Microsoft [Security Update](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350) (Monthly Rollup or Security Only) and restarted the patched machines. If unable to patch immediately, Microsoft [released](https://support.microsoft.com/en-us/help/4569509/windows-dns-server-remote-code-execution-vulnerability) a registry-based workaround that doesn’t require a restart. This can be used as a temporary solution before the patch is applied.
+- Ensure that you have deployed the latest Microsoft https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350[Security Update] (Monthly Rollup or Security Only) and restarted the patched machines. If unable to patch immediately, Microsoft https://support.microsoft.com/en-us/help/4569509/windows-dns-server-remote-code-execution-vulnerability[released] a registry-based workaround that doesn’t require a restart. This can be used as a temporary solution before the patch is applied.
 - Maintain backups of your critical systems to aid in quick recovery.
-- Perform routine vulnerability scans of your systems, monitor [CISA advisories](https://us-cert.cisa.gov/ncas/current-activity) and patch identified vulnerabilities.
+- Perform routine vulnerability scans of your systems, monitor https://us-cert.cisa.gov/ncas/current-activity[CISA advisories] and patch identified vulnerabilities.
 - If you observe a true positive, implement a remediation plan and monitor host-based artifacts for additional post-exploitation behavior.
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/access-of-stored-browser-credentials.asciidoc b/docs/detections/prebuilt-rules/rule-details/access-of-stored-browser-credentials.asciidoc
index 8161f12cc7..aa7c5e5adf 100644
--- a/docs/detections/prebuilt-rules/rule-details/access-of-stored-browser-credentials.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/access-of-stored-browser-credentials.asciidoc
@@ -40,6 +40,41 @@ Identifies the execution of a process with arguments pointing to known browser f
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/access-to-a-sensitive-ldap-attribute.asciidoc b/docs/detections/prebuilt-rules/rule-details/access-to-a-sensitive-ldap-attribute.asciidoc
index 29796c3f10..827652df71 100644
--- a/docs/detections/prebuilt-rules/rule-details/access-to-a-sensitive-ldap-attribute.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/access-to-a-sensitive-ldap-attribute.asciidoc
@@ -46,6 +46,25 @@ Identify access to sensitive Active Directory object attributes that contains cr
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+The 'Audit Directory Service Access' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Access (Success,Failure)
+```
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc b/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc
index 30065393df..56a52a7d4e 100644
--- a/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/access-to-keychain-credentials-directories.asciidoc
@@ -41,6 +41,41 @@ Adversaries may collect the keychain storage data from a system to acquire crede
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc
index aa3b93dc31..447b9dfd54 100644
--- a/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc
@@ -48,40 +48,47 @@ Detects the creation and modification of an account with the "Don't Expire Passw
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Account Configured with Never-Expiring Password
+*Triage and analysis*
+
+
+
+*Investigating Account Configured with Never-Expiring Password*
+
 
 Active Directory provides a setting that prevents users' passwords from expiring. Enabling this setting is bad practice and can expose environments to vulnerabilities that weaken security posture, especially when these accounts are privileged.
 
 The setting is usually configured so a user account can act as a service account. Attackers can abuse these accounts to persist in the domain and maintain long-term access using compromised accounts with a never-expiring password set.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/source host during the past 48 hours.
 - Inspect the account for suspicious or abnormal behaviors in the alert timeframe.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
 - Using user accounts as service accounts is a bad security practice and should not be allowed in the domain. The security team should map and monitor potential benign true positives (B-TPs), especially if the account is privileged. For cases in which user accounts cannot be avoided, Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that the account password is robust and changed regularly and automatically.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
 - Reset the password of the account and update its password settings.
 - Search for other occurrences on the domain.
-    - Using the [Active Directory PowerShell module](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser):
+    - Using the https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser[Active Directory PowerShell module]:
         - `get-aduser -filter { passwordNeverExpires -eq $true  -and enabled -eq $true } | ft`
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc
index cfeb6c64bc..c7c96dc25a 100644
--- a/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc
@@ -45,28 +45,36 @@ Identifies when the SYSTEM account uses an account discovery utility. This could
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Account Discovery Command via SYSTEM Account
+*Triage and analysis*
+
+
+
+*Investigating Account Discovery Command via SYSTEM Account*
+
 
 After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
 This rule looks for the execution of account discovery utilities using the SYSTEM account, which is commonly observed after attackers successfully perform privilege escalation or exploit web applications.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
   - If the process tree includes a web-application server process such as w3wp, httpd.exe, nginx.exe and alike, investigate any suspicious file creation or modification in the last 48 hours to assess the presence of any potential webshell backdoor.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Determine how the SYSTEM account is being used. For example, users with administrator privileges can spawn a system shell using Windows services, scheduled tasks or other third party utilities.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -77,7 +85,17 @@ This rule looks for the execution of account discovery utilities using the SYSTE
 - Use the data collected through the analysis to investigate other machines affected in the environment.
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/account-password-reset-remotely.asciidoc b/docs/detections/prebuilt-rules/rule-details/account-password-reset-remotely.asciidoc
index fcba3d92a3..74513f06e6 100644
--- a/docs/detections/prebuilt-rules/rule-details/account-password-reset-remotely.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/account-password-reset-remotely.asciidoc
@@ -48,10 +48,7 @@ Identifies an attempt to reset a potentially privileged account password remotel
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 This rule may cause medium to high performance impact due to logic scoping all remote Windows logon activity.
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc b/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
index 18960d343c..34af2e95fe 100644
--- a/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
@@ -48,11 +48,13 @@ Adversaries can add the 'hidden' attribute to files to hide them from the user i
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Adding Hidden File Attribute via Attrib
+*Triage and analysis*
+
+
+
+*Investigating Adding Hidden File Attribute via Attrib*
+
 
 The `Hidden` attribute is a file or folder attribute that makes the file or folder invisible to regular directory listings when the attribute is set. 
 
@@ -61,9 +63,11 @@ Attackers can use this attribute to conceal tooling and malware to prevent admin
 This rule looks for the execution of the `attrib.exe` utility with a command line that indicates the modification of the `Hidden` attribute.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
@@ -84,11 +88,15 @@ This rule looks for the execution of the `attrib.exe` utility with a command lin
       - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -103,7 +111,6 @@ This rule looks for the execution of the `attrib.exe` utility with a command lin
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/adfind-command-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/adfind-command-activity.asciidoc
index 2f4871c6ae..3877bb8b45 100644
--- a/docs/detections/prebuilt-rules/rule-details/adfind-command-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adfind-command-activity.asciidoc
@@ -54,15 +54,19 @@ This rule detects the Active Directory query tool, AdFind.exe. AdFind has legiti
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AdFind Command Activity
+*Triage and analysis*
+
+
+
+*Investigating AdFind Command Activity*
+
 
-[AdFind](http://www.joeware.net/freetools/tools/adfind/) is a freely available command-line tool used to retrieve information from Active Directory (AD). Network discovery and enumeration tools like `AdFind` are useful to adversaries in the same ways they are effective for network administrators. This tool provides quick ability to scope AD person/computer objects and understand subnets and domain information. There are many [examples](https://thedfirreport.com/category/adfind/) of this tool being adopted by ransomware and criminal groups and used in compromises.
+http://www.joeware.net/freetools/tools/adfind/[AdFind] is a freely available command-line tool used to retrieve information from Active Directory (AD). Network discovery and enumeration tools like `AdFind` are useful to adversaries in the same ways they are effective for network administrators. This tool provides quick ability to scope AD person/computer objects and understand subnets and domain information. There are many https://thedfirreport.com/category/adfind/[examples] of this tool being adopted by ransomware and criminal groups and used in compromises.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -70,19 +74,25 @@ This rule detects the Active Directory query tool, AdFind.exe. AdFind has legiti
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This rule has a high chance to produce false positives as it is a legitimate tool used by network administrators.
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - Malicious behavior with `AdFind` should be investigated as part of a step within an attack chain. It doesn't happen in isolation, so reviewing previous logs/activity from impacted machines can be very telling.
 
-### Related rules
+
+*Related rules*
+
 
 - Windows Network Enumeration - 7b8bfc26-81d2-435e-965c-d722ee397ef1
 - Enumeration of Administrator Accounts - 871ea072-1b71-4def-b016-6278b505138d
 - Enumeration Command Spawned via WMIPrvSE - 770e0c4d-b998-41e5-a62e-c7901fd7f470
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -92,7 +102,17 @@ This rule detects the Active Directory query tool, AdFind.exe. AdFind has legiti
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/administrator-privileges-assigned-to-an-okta-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/administrator-privileges-assigned-to-an-okta-group.asciidoc
index 505e0d3ba5..875c0f4f08 100644
--- a/docs/detections/prebuilt-rules/rule-details/administrator-privileges-assigned-to-an-okta-group.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/administrator-privileges-assigned-to-an-okta-group.asciidoc
@@ -45,10 +45,12 @@ Detects when an administrator role is assigned to an Okta group. An adversary ma
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/administrator-role-assigned-to-an-okta-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/administrator-role-assigned-to-an-okta-user.asciidoc
index 7ab9be3397..65db21d0b5 100644
--- a/docs/detections/prebuilt-rules/rule-details/administrator-role-assigned-to-an-okta-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/administrator-role-assigned-to-an-okta-user.asciidoc
@@ -45,10 +45,12 @@ Identifies when an administrator role is assigned to an Okta user. An adversary
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/adminsdholder-sdprop-exclusion-added.asciidoc b/docs/detections/prebuilt-rules/rule-details/adminsdholder-sdprop-exclusion-added.asciidoc
index 6fbc41f40c..584904f841 100644
--- a/docs/detections/prebuilt-rules/rule-details/adminsdholder-sdprop-exclusion-added.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adminsdholder-sdprop-exclusion-added.asciidoc
@@ -48,11 +48,13 @@ Identifies a modification on the dsHeuristics attribute on the bit that holds th
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AdminSDHolder SDProp Exclusion Added
+*Triage and analysis*
+
+
+
+*Investigating AdminSDHolder SDProp Exclusion Added*
+
 
 The SDProp process compares the permissions on protected objects with those defined on the AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, it resets the permissions on the protected accounts and groups to match those defined in the domain AdminSDHolder object.
 
@@ -66,7 +68,9 @@ The usage of this exclusion can leave the accounts unprotected and facilitate th
 
 This rule matches changes of the dsHeuristics object where the 16th bit is set to a value other than zero.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account and system owners and confirm whether they are aware of this activity.
@@ -78,17 +82,45 @@ This rule matches changes of the dsHeuristics object where the 16th bit is set t
     - Backup Operators eq 8
     The field value can range from 0 to f (15). If more than one group is specified, the values will be summed together; for example, Backup Operators and Print Operators will set the `c` value on the bit.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - While this modification can be done legitimately, it is not a best practice. Any potential benign true positive (B-TP) should be mapped and reviewed by the security team for alternatives as this weakens the security of the privileged group.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - The change can be reverted by setting the dwAdminSDExMask (16th bit) to 0 in dSHeuristics.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'Audit Directory Service Changes' logging policy must be configured for (Success).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success)
+```
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc b/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
index e8b01c4848..8804016e91 100644
--- a/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
@@ -48,18 +48,22 @@ Detects writing executable files that will be automatically launched by Adobe on
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Adobe Hijack Persistence
+*Triage and analysis*
+
+
+
+*Investigating Adobe Hijack Persistence*
+
 
 Attackers can replace the `RdrCEF.exe` executable with their own to maintain their access, which will be launched whenever Adobe Acrobat Reader is executed.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -80,11 +84,15 @@ Attackers can replace the `RdrCEF.exe` executable with their own to maintain the
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -101,7 +109,17 @@ Attackers can replace the `RdrCEF.exe` executable with their own to maintain the
 
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-linux-population.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-linux-population.asciidoc
index b5ca2b64c4..8799f4758f 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-linux-population.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-linux-population.asciidoc
@@ -43,17 +43,21 @@ Searches for rare processes running on multiple Linux hosts in an entire fleet o
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Anomalous Process For a Linux Population
+*Triage and analysis*
+
+
+
+*Investigating Anomalous Process For a Linux Population*
+
 
 Searching for abnormal Linux processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.
 
 This rule uses a machine learning job to detect a Linux process that is rare and unusual for all of the monitored Linux hosts in your fleet.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, and whether they are located in expected locations.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -62,12 +66,16 @@ This rule uses a machine learning job to detect a Linux process that is rare and
 - Validate if the activity has a consistent cadence (for example, if it runs monthly or quarterly), as it could be part of a monthly or quarterly business process.
 - Examine the arguments and working directory of the process. These may provide indications as to the source of the program or the nature of the tasks it is performing.
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -82,7 +90,6 @@ This rule uses a machine learning job to detect a Linux process that is rare and
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
index 5132d58f73..8c0a537aa3 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
@@ -43,20 +43,24 @@ Searches for rare processes running on multiple hosts in an entire fleet or netw
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-###  Investigating Anomalous Process For a Windows Population
+*Triage and analysis*
+
+
+
+*Investigating Anomalous Process For a Windows Population*
+
 
 Searching for abnormal Windows processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.
 
 This rule uses a machine learning job to detect a Windows process that is rare and unusual for all of the monitored Windows hosts in your environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
   - If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.
@@ -80,18 +84,24 @@ This rule uses a machine learning job to detect a Windows process that is rare a
       - !{osquery{"label":"Retrieve Service Unisgned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Unusual Process For a Windows Host - 6d448b96-c922-4adb-b51c-b767f1ea5b76
 - Unusual Windows Path Activity - 445a342e-03fb-42d0-8656-0367eb2dead5
 - Unusual Windows Process Calling the Metadata Service - abae61a8-c560-4dbd-acca-1e1438bff36b
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -106,7 +116,6 @@ This rule uses a machine learning job to detect a Windows process that is rare a
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
index 95462ceaba..9fc581fe54 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
@@ -43,20 +43,24 @@ Identifies unusual parent-child process relationships that can indicate malware
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-###  Investigating Anomalous Windows Process Creation
+*Triage and analysis*
+
+
+
+*Investigating Anomalous Windows Process Creation*
+
 
 Searching for abnormal Windows processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.
 
 This rule uses a machine learning job to detect an anomalous Windows process with an unusual parent-child relationship, which could indicate malware execution or persistence activities on the host machine.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
   - If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.
@@ -80,18 +84,24 @@ This rule uses a machine learning job to detect an anomalous Windows process wit
       - !{osquery{"label":"Retrieve Service Unisgned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Unusual Process For a Windows Host - 6d448b96-c922-4adb-b51c-b767f1ea5b76
 - Unusual Windows Path Activity - 445a342e-03fb-42d0-8656-0367eb2dead5
 - Unusual Windows Process Calling the Metadata Service - abae61a8-c560-4dbd-acca-1e1438bff36b
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -106,7 +116,6 @@ This rule uses a machine learning job to detect an anomalous Windows process wit
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/apple-script-execution-followed-by-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/apple-script-execution-followed-by-network-connection.asciidoc
index 91b5aa30b4..45ef109075 100644
--- a/docs/detections/prebuilt-rules/rule-details/apple-script-execution-followed-by-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/apple-script-execution-followed-by-network-connection.asciidoc
@@ -42,6 +42,41 @@ Detects execution via the Apple script interpreter (osascript) followed by a net
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/apple-scripting-execution-with-administrator-privileges.asciidoc b/docs/detections/prebuilt-rules/rule-details/apple-scripting-execution-with-administrator-privileges.asciidoc
index e4869515be..0946e7f87a 100644
--- a/docs/detections/prebuilt-rules/rule-details/apple-scripting-execution-with-administrator-privileges.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/apple-scripting-execution-with-administrator-privileges.asciidoc
@@ -41,6 +41,41 @@ Identifies execution of the Apple script interpreter (osascript) without a passw
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/application-added-to-google-workspace-domain.asciidoc b/docs/detections/prebuilt-rules/rule-details/application-added-to-google-workspace-domain.asciidoc
index 9f0afe0333..42ea5614e7 100644
--- a/docs/detections/prebuilt-rules/rule-details/application-added-to-google-workspace-domain.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/application-added-to-google-workspace-domain.asciidoc
@@ -44,11 +44,13 @@ Detects when a Google marketplace application is added to the Google Workspace d
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Application Added to Google Workspace Domain
+*Triage and analysis*
+
+
+
+*Investigating Application Added to Google Workspace Domain*
+
 
 Google Workspace Marketplace is an online store for free and paid web applications that work with Google Workspace services and third-party software. Listed applications are based on Google APIs or on Google Apps Script and created by both Google and third-party developers.
 
@@ -58,7 +60,9 @@ Google clearly states that they are not responsible for any product on the Marke
 
 This rule checks for applications that were manually added to the Marketplace by a Google Workspace account.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
 - This rule relies on data from `google_workspace.admin`, thus indicating the associated user has administrative privileges to the Marketplace.
@@ -67,13 +71,17 @@ This rule checks for applications that were manually added to the Marketplace by
 - Re-assess the permissions and reviews of the Marketplace applications to determine if they violate organizational policies or introduce unexpected risks.
 - With access to the Google Workspace admin console, determine if the application was installed domain-wide or individually by visiting `Apps > Google Workspace Marketplace Apps`.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Google Workspace administrators might intentionally remove an application from the blocklist due to a re-assessment or a domain-wide required need for the application.
 - Identify the user account associated with this action and assess their administrative privileges with Google Workspace Marketplace.
 - Contact the user to verify that they intentionally removed the application from the blocklist and their reasoning.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -85,13 +93,15 @@ This rule checks for applications that were manually added to the Marketplace by
     - Identify any regulatory or legal ramifications related to this activity.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -99,7 +109,11 @@ This rule checks for applications that were manually added to the Marketplace by
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/application-removed-from-blocklist-in-google-workspace.asciidoc b/docs/detections/prebuilt-rules/rule-details/application-removed-from-blocklist-in-google-workspace.asciidoc
index dda82739b6..b7c8fbac35 100644
--- a/docs/detections/prebuilt-rules/rule-details/application-removed-from-blocklist-in-google-workspace.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/application-removed-from-blocklist-in-google-workspace.asciidoc
@@ -44,11 +44,13 @@ Google Workspace administrators may be aware of malicious applications within th
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Application Removed from Blocklist in Google Workspace
+*Triage and analysis*
+
+
+
+*Investigating Application Removed from Blocklist in Google Workspace*
+
 
 Google Workspace Marketplace is an online store for free and paid web applications that work with Google Workspace services and third-party software. Listed applications are based on Google APIs or Google Apps Script and created by both Google and third-party developers.
 
@@ -58,7 +60,9 @@ Google clearly states that they are not responsible for any Marketplace product
 
 This rule identifies a Marketplace blocklist update that consists of a Google Workspace account with administrative privileges manually removing a previously blocked application.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
 - This rule relies on data from `google_workspace.admin`, thus indicating the associated user has administrative privileges to the Marketplace.
@@ -67,13 +71,17 @@ This rule identifies a Marketplace blocklist update that consists of a Google Wo
 - Re-assess the permissions and reviews of the Marketplace applications to determine if they violate organizational policies or introduce unexpected risks.
 - With access to the Google Workspace admin console, determine if the application was installed domain-wide or individually by visiting `Apps > Google Workspace Marketplace Apps`.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Google Workspace administrators might intentionally remove an application from the blocklist due to a re-assessment or a domain-wide required need for the application.
 - Identify the user account associated with this action and assess their administrative privileges with Google Workspace Marketplace.
 - Contact the user to verify that they intentionally removed the application from the blocklist and their reasoning.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -85,13 +93,15 @@ This rule identifies a Marketplace blocklist update that consists of a Google Wo
     - Identify any regulatory or legal ramifications related to this activity.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -99,7 +109,11 @@ This rule identifies a Marketplace blocklist update that consists of a Google Wo
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-clear-kernel-ring-buffer.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-clear-kernel-ring-buffer.asciidoc
index 4fe2f84c81..29a0cbc8f8 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-clear-kernel-ring-buffer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-clear-kernel-ring-buffer.asciidoc
@@ -8,6 +8,9 @@ Monitors for the deletion of the kernel ring buffer events through dmesg. Attack
 *Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
 
 *Severity*: low
 
@@ -28,8 +31,10 @@ Monitors for the deletion of the kernel ring buffer events through dmesg. Attack
 * Use Case: Threat Detection
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Auditd Manager
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -38,13 +43,48 @@ Monitors for the deletion of the kernel ring buffer events through dmesg. Attack
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and
-process.name == "dmesg" and process.args : "-c"
+process where host.os.type == "linux" and event.action in ("exec", "exec_event", "executed") and
+event.type == "start" and process.name == "dmesg" and process.args : "-c"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-create-okta-api-token.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-create-okta-api-token.asciidoc
index 018da007f4..4ac3045c47 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-create-okta-api-token.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-create-okta-api-token.asciidoc
@@ -44,10 +44,12 @@ Detects attempts to create an Okta API token. An adversary may create an Okta AP
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-application.asciidoc
index 33e2435bfb..d5693fd9b8 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-application.asciidoc
@@ -45,15 +45,19 @@ Detects attempts to deactivate an Okta application. An adversary may attempt to
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Attempt to Deactivate an Okta Application
+*Triage and analysis*
+
+
+
+*Investigating Attempt to Deactivate an Okta Application*
+
 
 This rule detects attempts to deactivate an Okta application. Unauthorized deactivation could lead to disruption of services and pose a significant risk to the organization.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 - Identify the actor associated with the deactivation attempt by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
 - Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
 - If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields.
@@ -63,17 +67,25 @@ This rule detects attempts to deactivate an Okta application. Unauthorized deact
 - Analyze the `okta.transaction.id` and `okta.transaction.type` fields to understand the context of the transaction.
 - Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 - It might be a false positive if the action was part of a planned activity, performed by an authorized person, or if the `okta.outcome.result` field shows a failure.
 - An unsuccessful attempt might also indicate an authorized user having trouble rather than a malicious activity.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 - If unauthorized deactivation attempts are confirmed, initiate the incident response process.
 - Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
 - Reset the user's password and enforce MFA re-enrollment, if applicable.
 - Conduct a review of Okta policies and ensure they are in accordance with security best practices.
 - If the deactivated application was crucial for business operations, coordinate with the relevant team to reactivate it and minimize the impact.
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-network-zone.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-network-zone.asciidoc
index a7df47b956..cd212f2a27 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-network-zone.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-network-zone.asciidoc
@@ -46,15 +46,19 @@ Detects attempts to deactivate an Okta network zone. Okta network zones can be c
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Attempt to Deactivate an Okta Network Zone
+*Triage and analysis*
+
+
+
+*Investigating Attempt to Deactivate an Okta Network Zone*
+
 
 The Okta network zones can be configured to restrict or limit access to a network based on IP addresses or geolocations. Deactivating a network zone in Okta may remove or weaken the security controls of an organization, which might be an indicator of an adversary's attempt to evade defenses.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the actor related to the alert by reviewing the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields.
 - Examine the `event.action` field to confirm the deactivation of a network zone.
@@ -62,13 +66,17 @@ The Okta network zones can be configured to restrict or limit access to a networ
 - Investigate the `event.time` field to understand when the event happened.
 - Review the actor's activities before and after the event to understand the context of this event.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Check the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor. If these match the actor's normal behavior, it might be a false positive.
 - Check if the actor is a known administrator or part of the IT team who might have a legitimate reason to deactivate a network zone.
 - Verify the actor's actions with any known planned changes or maintenance activities.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - If unauthorized access or actions are confirmed, immediately lock the affected actor account and require a password change.
 - Re-enable the deactivated network zone if it was deactivated without authorization.
@@ -76,7 +84,11 @@ The Okta network zones can be configured to restrict or limit access to a networ
 - Check the security policies and procedures to identify any gaps and update them as necessary.
 - Implement additional monitoring and logging of Okta events to improve visibility of user actions.
 - Communicate and train the employees about the importance of following proper procedures for modifying network zone settings.
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy-rule.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy-rule.asciidoc
index 37ed4ddd5c..65c554124b 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy-rule.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy-rule.asciidoc
@@ -45,17 +45,21 @@ Detects attempts to deactivate a rule within an Okta policy. An adversary may at
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Attempt to Deactivate an Okta Policy Rule
+*Triage and analysis*
+
+
+
+*Investigating Attempt to Deactivate an Okta Policy Rule*
+
 
 Identity and Access Management (IAM) systems like Okta serve as the first line of defense for an organization's network, and are often targeted by adversaries. By disabling security rules, adversaries can circumvent multi-factor authentication, access controls, or other protective measures enforced by these policies, enabling unauthorized access, privilege escalation, or other malicious activities.
 
 This rule detects attempts to deactivate a rule within an Okta policy, which could be indicative of an adversary's attempt to weaken an organization's security controls. A threat actor may do this to remove barriers to their activities or enable future attacks.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 
 - Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
 - Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
@@ -65,13 +69,17 @@ This rule detects attempts to deactivate a rule within an Okta policy, which cou
 - Check for successful logins immediately following the policy rule deactivation attempt.
 - Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the deactivation attempt.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 
 - Check if there were issues with the Okta system at the time of the deactivation attempt. This could indicate a system error rather than a genuine threat activity.
 - Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the deactivation attempt. If these match the actor's normal behavior, it might be a false positive.
 - Verify the actor's administrative rights to ensure they are correctly configured.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 
 - If unauthorized policy rule deactivation is confirmed, initiate the incident response process.
 - Immediately lock the affected actor account and require a password change.
@@ -81,9 +89,13 @@ This rule detects attempts to deactivate a rule within an Okta policy, which cou
 - Assess the criticality of affected services and servers.
 - Work with your IT team to minimize the impact on users and maintain business continuity.
 - If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
-- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
+- Implement security best practices https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/[outlined] by Okta.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy.asciidoc
index fa96944dcd..519d19c5f4 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-deactivate-an-okta-policy.asciidoc
@@ -45,17 +45,21 @@ Detects attempts to deactivate an Okta policy. An adversary may attempt to deact
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Attempt to Deactivate an Okta Policy
+*Triage and analysis*
+
+
+
+*Investigating Attempt to Deactivate an Okta Policy*
+
 
 Okta policies define rules to manage user access to resources. Policies such as multi-factor authentication (MFA) are critical for enforcing strong security measures. Deactivation of an Okta policy could potentially weaken the security posture, allowing for unauthorized access or facilitating other malicious activities.
 
 This rule is designed to detect attempts to deactivate an Okta policy, which could be indicative of an adversary's attempt to weaken an organization's security controls. For example, disabling an MFA policy could lower the security of user authentication processes.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 
 - Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
 - Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
@@ -65,13 +69,17 @@ This rule is designed to detect attempts to deactivate an Okta policy, which cou
 - Check for successful logins immediately following the policy deactivation attempt.
 - Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the deactivation attempt.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 
 - Check if there were issues with the Okta system at the time of the deactivation attempt. This could indicate a system error rather than a genuine threat activity.
 - Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the deactivation attempt. If these match the actor's normal behavior, it might be a false positive.
 - Verify the actor's administrative rights to ensure they are correctly configured.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 
 - If unauthorized policy deactivation is confirmed, initiate the incident response process.
 - Immediately lock the affected actor account and require a password change.
@@ -81,9 +89,13 @@ This rule is designed to detect attempts to deactivate an Okta policy, which cou
 - Assess the criticality of affected services and servers.
 - Work with your IT team to minimize the impact on users and maintain business continuity.
 - If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
-- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
+- Implement security best practices https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/[outlined] by Okta.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-application.asciidoc
index 7c839d306b..5138fb532f 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-application.asciidoc
@@ -44,10 +44,12 @@ Detects attempts to delete an Okta application. An adversary may attempt to modi
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-network-zone.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-network-zone.asciidoc
index 45b842e9dc..9a223c4d54 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-network-zone.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-network-zone.asciidoc
@@ -46,15 +46,19 @@ Detects attempts to delete an Okta network zone. Okta network zones can be confi
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Attempt to Delete an Okta Network Zone
+*Triage and analysis*
+
+
+
+*Investigating Attempt to Delete an Okta Network Zone*
+
 
 Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. Deleting a network zone in Okta might remove or weaken the security controls of an organization, which might be an indicator of an adversary's attempt to evade defenses.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 
 - Identify the actor associated with the alert by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields.
 - Examine the `event.action` field to confirm the deletion of a network zone.
@@ -62,13 +66,17 @@ Okta network zones can be configured to limit or restrict access to a network ba
 - Review the `event.time` field to understand when the event happened.
 - Check the actor's activities before and after the event to understand the context of this event.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 
 - Verify the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor. If these match the actor's typical behavior, it might be a false positive.
 - Check if the actor is a known administrator or a member of the IT team who might have a legitimate reason to delete a network zone.
 - Cross-verify the actor's actions with any known planned changes or maintenance activities.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 
 - If unauthorized access or actions are confirmed, immediately lock the affected actor's account and require a password change.
 - If a network zone was deleted without authorization, create a new network zone with similar settings as the deleted one.
@@ -76,7 +84,11 @@ Okta network zones can be configured to limit or restrict access to a network ba
 - Identify any gaps in the security policies and procedures and update them as necessary.
 - Implement additional monitoring and logging of Okta events to improve visibility of user actions.
 - Communicate and train the employees about the importance of following proper procedures for modifying network zone settings.
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy-rule.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy-rule.asciidoc
index e3335aabdd..94b59a6aad 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy-rule.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy-rule.asciidoc
@@ -45,17 +45,21 @@ Detects attempts to delete a rule within an Okta policy. An adversary may attemp
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Attempt to Delete an Okta Policy Rule
+*Triage and analysis*
+
+
+
+*Investigating Attempt to Delete an Okta Policy Rule*
+
 
 Okta policy rules are integral components of an organization's security controls, as they define how user access to resources is managed. Deletion of a rule within an Okta policy could potentially weaken the organization's security posture, allowing for unauthorized access or facilitating other malicious activities.
 
 This rule detects attempts to delete an Okta policy rule, which could indicate an adversary's attempt to weaken an organization's security controls. Adversaries may do this to circumvent security measures and enable further malicious activities.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 
 - Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
 - Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
@@ -65,13 +69,17 @@ This rule detects attempts to delete an Okta policy rule, which could indicate a
 - Check for successful logins immediately following the policy rule deletion attempt.
 - Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the deletion attempt.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 
 - Check if there were issues with the Okta system at the time of the deletion attempt. This could indicate a system error rather than a genuine threat activity.
 - Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the deletion attempt. If these match the actor's normal behavior, it might be a false positive.
 - Verify the actor's administrative rights to ensure they are correctly configured.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 
 - If unauthorized policy rule deletion is confirmed, initiate the incident response process.
 - Immediately lock the affected actor account and require a password change.
@@ -81,9 +89,13 @@ This rule detects attempts to delete an Okta policy rule, which could indicate a
 - Assess the criticality of affected services and servers.
 - Work with your IT team to minimize the impact on users and maintain business continuity.
 - If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
-- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
+- Implement security best practices https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/[outlined] by Okta.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy.asciidoc
index 5d7cf3fb7d..8cc75e4de8 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-delete-an-okta-policy.asciidoc
@@ -45,17 +45,21 @@ Detects attempts to delete an Okta policy. An adversary may attempt to delete an
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Attempt to Delete an Okta Policy
+*Triage and analysis*
+
+
+
+*Investigating Attempt to Delete an Okta Policy*
+
 
 Okta policies are critical to managing user access and enforcing security controls within an organization. The deletion of an Okta policy could drastically weaken an organization's security posture by allowing unrestricted access or facilitating other malicious activities.
 
 This rule detects attempts to delete an Okta policy, which could be indicative of an adversary's attempt to weaken an organization's security controls. Adversaries may do this to bypass security barriers and enable further malicious activities.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 
 - Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
 - Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
@@ -65,13 +69,17 @@ This rule detects attempts to delete an Okta policy, which could be indicative o
 - Check for successful logins immediately following the policy deletion attempt.
 - Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the deletion attempt.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 
 - Check if there were issues with the Okta system at the time of the deletion attempt. This could indicate a system error rather than a genuine threat activity.
 - Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the deletion attempt. If these match the actor's normal behavior, it might be a false positive.
 - Verify the actor's administrative rights to ensure they are correctly configured.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 
 - If unauthorized policy deletion is confirmed, initiate the incident response process.
 - Immediately lock the affected actor account and require a password change.
@@ -81,9 +89,13 @@ This rule detects attempts to delete an Okta policy, which could be indicative o
 - Assess the criticality of affected services and servers.
 - Work with your IT team to minimize the impact on users and maintain business continuity.
 - If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
-- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
+- Implement security best practices https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/[outlined] by Okta.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-gatekeeper.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-gatekeeper.asciidoc
index 42508a7d3a..a85585f09b 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-gatekeeper.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-gatekeeper.asciidoc
@@ -41,6 +41,41 @@ Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security featur
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-iptables-or-firewall.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-iptables-or-firewall.asciidoc
index 661519ee88..c47623f239 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-iptables-or-firewall.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-iptables-or-firewall.asciidoc
@@ -8,6 +8,7 @@ Adversaries may attempt to disable the iptables or firewall service in an attemp
 *Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: low
 
@@ -28,8 +29,9 @@ Adversaries may attempt to disable the iptables or firewall service in an attemp
 * Use Case: Threat Detection
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
+* Data Source: Elastic Endgame
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -38,12 +40,47 @@ Adversaries may attempt to disable the iptables or firewall service in an attemp
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
+process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event") and
  (
    /* disable FW */
    (
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-syslog-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-syslog-service.asciidoc
index fbf6b7bf88..45508dfc38 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-syslog-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-disable-syslog-service.asciidoc
@@ -41,6 +41,57 @@ Adversaries may attempt to disable the syslog service in an attempt to an attemp
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-enable-the-root-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-enable-the-root-account.asciidoc
index de448d3e76..69b9f3c349 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-enable-the-root-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-enable-the-root-account.asciidoc
@@ -40,6 +40,41 @@ Identifies attempts to enable the root account using the dsenableroot command. T
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-install-root-certificate.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-install-root-certificate.asciidoc
index 490808d4e6..4b15dd3970 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-install-root-certificate.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-install-root-certificate.asciidoc
@@ -40,6 +40,41 @@ Adversaries may install a root certificate on a compromised system to avoid warn
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-application.asciidoc
index 574efdc398..1c9d6d0415 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-application.asciidoc
@@ -45,10 +45,12 @@ Detects attempts to modify an Okta application. An adversary may attempt to modi
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-network-zone.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-network-zone.asciidoc
index 3502233fad..772dd39c98 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-network-zone.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-network-zone.asciidoc
@@ -46,15 +46,19 @@ Detects attempts to modify an Okta network zone. Okta network zones can be confi
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Attempt to Modify an Okta Network Zone
+*Triage and analysis*
+
+
+
+*Investigating Attempt to Modify an Okta Network Zone*
+
 
 The modification of an Okta network zone is a critical event as it could potentially allow an adversary to gain unrestricted access to your network. This rule detects attempts to modify, delete, or deactivate an Okta network zone, which may suggest an attempt to remove or weaken an organization's security controls.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 
 - Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
 - Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
@@ -64,13 +68,17 @@ The modification of an Okta network zone is a critical event as it could potenti
 - Check for successful logins immediately following the modification attempt.
 - Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the modification attempt.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 
 - Check if there were issues with the Okta system at the time of the modification attempt. This could indicate a system error rather than a genuine threat activity.
 - Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the modification attempt. If these match the actor's normal behavior, it might be a false positive.
 - Verify the actor's administrative rights to ensure they are correctly configured.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 
 - If unauthorized modification is confirmed, initiate the incident response process.
 - Immediately lock the affected actor account and require a password change.
@@ -80,9 +88,13 @@ The modification of an Okta network zone is a critical event as it could potenti
 - Assess the criticality of affected services and servers.
 - Work with your IT team to minimize the impact on users and maintain business continuity.
 - If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
-- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
+- Implement security best practices https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/[outlined] by Okta.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy-rule.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy-rule.asciidoc
index d07bfb897c..5f371097c9 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy-rule.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy-rule.asciidoc
@@ -45,15 +45,19 @@ Detects attempts to modify a rule within an Okta policy. An adversary may attemp
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Attempt to Modify an Okta Policy Rule
+*Triage and analysis*
+
+
+
+*Investigating Attempt to Modify an Okta Policy Rule*
+
 
 The modification of an Okta policy rule can be an indication of malicious activity as it may aim to weaken an organization's security controls.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 
 - Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
 - Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
@@ -63,13 +67,17 @@ The modification of an Okta policy rule can be an indication of malicious activi
 - Check for successful logins immediately following the modification attempt.
 - Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the modification attempt.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 
 - Check if there were issues with the Okta system at the time of the modification attempt. This could indicate a system error rather than a genuine threat activity.
 - Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the modification attempt. If these match the actor's normal behavior, it might be a false positive.
 - Verify the actor's administrative rights to ensure they are correctly configured.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 
 - If unauthorized modification is confirmed, initiate the incident response process.
 - Immediately lock the affected actor account and require a password change.
@@ -79,9 +87,13 @@ The modification of an Okta policy rule can be an indication of malicious activi
 - Assess the criticality of affected services and servers.
 - Work with your IT team to minimize the impact on users and maintain business continuity.
 - If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
-- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
+- Implement security best practices https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/[outlined] by Okta.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy.asciidoc
index 67b47c287b..7e685a47d8 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-modify-an-okta-policy.asciidoc
@@ -44,34 +44,46 @@ Detects attempts to modify an Okta policy. An adversary may attempt to modify an
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Attempt to Modify an Okta Policy
+*Triage and analysis*
+
+
+
+*Investigating Attempt to Modify an Okta Policy*
+
 
 Modifications to Okta policies may indicate attempts to weaken an organization's security controls. If such an attempt is detected, consider the following steps for investigation.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 - Identify the actor associated with the event. Check the fields `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name`.
 - Determine the client used by the actor. You can look at `okta.client.device`, `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.ip_chain.ip`, and `okta.client.geographical_context`.
 - Check the nature of the policy modification. You can review the `okta.target` field, especially `okta.target.display_name` and `okta.target.id`.
 - Examine the `okta.outcome.result` and `okta.outcome.reason` fields to understand the outcome of the modification attempt.
 - Check if there have been other similar modification attempts in a short time span from the same actor or IP address.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 - This alert might be a false positive if Okta policies are regularly updated in your organization as a part of normal operations.
 - Check if the actor associated with the event has legitimate rights to modify the Okta policies.
 - Verify the actor's geographical location and the time of the modification attempt. If these align with the actor's regular behavior, it could be a false positive.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 - If unauthorized modification is confirmed, initiate the incident response process.
 - Lock the actor's account and enforce password change as an immediate response.
 - Reset MFA tokens for the actor and enforce re-enrollment, if applicable.
 - Review any other actions taken by the actor to assess the overall impact.
 - If the attack was facilitated by a particular technique, ensure your systems are patched or configured to prevent such techniques.
 - Consider a security review of your Okta policies and rules to ensure they follow security best practices.
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-mount-smb-share-via-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-mount-smb-share-via-command-line.asciidoc
index d6674fe476..515f89eedf 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-mount-smb-share-via-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-mount-smb-share-via-command-line.asciidoc
@@ -41,6 +41,41 @@ Identifies the execution of macOS built-in commands to mount a Server Message Bl
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-remove-file-quarantine-attribute.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-remove-file-quarantine-attribute.asciidoc
index a1702a0376..867da82250 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-remove-file-quarantine-attribute.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-remove-file-quarantine-attribute.asciidoc
@@ -41,6 +41,41 @@ Identifies a potential Gatekeeper bypass. In macOS, when applications or program
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-reset-mfa-factors-for-an-okta-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-reset-mfa-factors-for-an-okta-user-account.asciidoc
index d8145ce50e..8a3938e058 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-reset-mfa-factors-for-an-okta-user-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-reset-mfa-factors-for-an-okta-user-account.asciidoc
@@ -44,10 +44,12 @@ Detects attempts to reset an Okta user's enrolled multi-factor authentication (M
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-revoke-okta-api-token.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-revoke-okta-api-token.asciidoc
index 188fcadad4..08b010a324 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-revoke-okta-api-token.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-revoke-okta-api-token.asciidoc
@@ -44,15 +44,19 @@ Identifies attempts to revoke an Okta API token. An adversary may attempt to rev
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Attempt to Revoke Okta API Token
+*Triage and analysis*
+
+
+
+*Investigating Attempt to Revoke Okta API Token*
+
 
 The rule alerts when attempts are made to revoke an Okta API token. The API tokens are critical for integration services, and revoking them may lead to disruption in services. Therefore, it's important to validate these activities.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 - Identify the actor associated with the API token revocation attempt. You can use the `okta.actor.alternate_id` field for this purpose.
 - Determine the client used by the actor. Review the `okta.client.device`, `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.ip_chain.ip`, and `okta.client.geographical_context` fields.
 - Verify if the API token revocation was authorized or part of some planned activity.
@@ -60,16 +64,24 @@ The rule alerts when attempts are made to revoke an Okta API token. The API toke
 - Analyze the past activities of the actor involved in this action. An actor who usually performs such activities may indicate a legitimate reason.
 - Evaluate the actions that happened just before and after this event. It can help understand the full context of the activity.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 - It might be a false positive if the action was part of a planned activity or was performed by an authorized person.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 - If unauthorized revocation attempts are confirmed, initiate the incident response process.
 - Block the IP address or device used in the attempts, if they appear suspicious.
 - Reset the user's password and enforce MFA re-enrollment, if applicable.
 - Conduct a review of Okta policies and ensure they are in accordance with security best practices.
 - If the revoked token was used for critical integrations, coordinate with the relevant team to minimize the impact.
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc
index 227025a5ac..672efb4e38 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-unload-elastic-endpoint-security-kernel-extension.asciidoc
@@ -38,6 +38,41 @@ Identifies attempts to unload the Elastic Endpoint Security kernel extension via
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempted-bypass-of-okta-mfa.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempted-bypass-of-okta-mfa.asciidoc
index a827aebf32..ea3909be9f 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempted-bypass-of-okta-mfa.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempted-bypass-of-okta-mfa.asciidoc
@@ -44,17 +44,21 @@ Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Attempted Bypass of Okta MFA
+*Triage and analysis*
+
+
+
+*Investigating Attempted Bypass of Okta MFA*
+
 
 Multi-factor authentication (MFA) is a crucial security measure in preventing unauthorized access. Okta MFA, like other MFA solutions, requires the user to provide multiple means of identification at login. An adversary might attempt to bypass Okta MFA to gain unauthorized access to an application.
 
 This rule detects attempts to bypass Okta MFA. It might indicate a serious attempt to compromise a user account within the organization's network.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
 - Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
@@ -64,13 +68,17 @@ This rule detects attempts to bypass Okta MFA. It might indicate a serious attem
 - Check for successful logins immediately following the MFA bypass attempt.
 - Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the bypass attempt.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Check if there were issues with the MFA system at the time of the bypass attempt. This could indicate a system error rather than a genuine bypass attempt.
 - Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the login attempt. If these match the actor's normal behavior, it might be a false positive.
 - Verify the actor's MFA settings to ensure they are correctly configured.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - If unauthorized access is confirmed, initiate the incident response process.
 - Immediately lock the affected actor account and require a password change.
@@ -80,9 +88,13 @@ This rule detects attempts to bypass Okta MFA. It might indicate a serious attem
 - Assess the criticality of affected services and servers.
 - Work with your IT team to minimize the impact on users and maintain business continuity.
 - If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
-- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
+- Implement security best practices https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/[outlined] by Okta.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-a-microsoft-365-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-a-microsoft-365-user-account.asciidoc
index ae622e98fd..5b88719c51 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-a-microsoft-365-user-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-a-microsoft-365-user-account.asciidoc
@@ -45,10 +45,12 @@ Identifies attempts to brute force a Microsoft 365 user account. An adversary ma
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-an-okta-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-an-okta-user-account.asciidoc
index c837806e1f..53cbe29f84 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-an-okta-user-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-an-okta-user-account.asciidoc
@@ -46,17 +46,21 @@ Identifies when an Okta user account is locked out 3 times within a 3 hour windo
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Attempts to Brute Force an Okta User Account
+*Triage and analysis*
+
+
+
+*Investigating Attempts to Brute Force an Okta User Account*
+
 
 Brute force attacks aim to guess user credentials through exhaustive trial-and-error attempts. In this context, Okta accounts are targeted.
 
 This rule fires when an Okta user account has been locked out 3 times within a 3-hour window. This could indicate an attempted brute force or password spraying attack to gain unauthorized access to the user account. Okta's default authentication policy locks a user account after 10 failed authentication attempts.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 
 - Identify the actor related to the alert by reviewing `okta.actor.alternate_id` field in the alert. This should give the username of the account being targeted.
 - Review the `okta.event_type` field to understand the nature of the events that led to the account lockout.
@@ -66,12 +70,16 @@ This rule fires when an Okta user account has been locked out 3 times within a 3
 - Determine if the lockout events occurred during the user's regular activity hours. Unusual timing may indicate malicious activity.
 - Examine the authentication methods used during the lockout events by checking the `okta.authentication_context.credential_type` field.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 
 - Determine whether the account owner or an internal user made repeated mistakes in entering their credentials, leading to the account lockout.
 - Ensure there are no known network or application issues that might cause these events.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 
 - Alert the user and your IT department immediately.
 - If unauthorized access is confirmed, initiate your incident response process.
@@ -81,7 +89,11 @@ This rule fires when an Okta user account has been locked out 3 times within a 3
 - Implement account lockout policies to limit the impact of brute force attacks.
 - Encourage users to use complex, unique passwords and consider implementing multi-factor authentication.
 - Check if the compromised account was used to access or alter any sensitive data or systems.
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/authorization-plugin-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/authorization-plugin-modification.asciidoc
index 39fbb16f25..2025d21c25 100644
--- a/docs/detections/prebuilt-rules/rule-details/authorization-plugin-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/authorization-plugin-modification.asciidoc
@@ -41,6 +41,41 @@ Authorization plugins are used to extend the authorization services API and impl
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-created.asciidoc
index a07323325e..9877d0d043 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-created.asciidoc
@@ -45,10 +45,12 @@ Identifies the creation of an AWS log trail that specifies the settings for deli
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-deleted.asciidoc
index 1101846b83..840bdbab51 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-deleted.asciidoc
@@ -46,17 +46,21 @@ Identifies the deletion of an AWS log trail. An adversary may delete trails in a
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS CloudTrail Log Deleted
+*Triage and analysis*
+
+
+
+*Investigating AWS CloudTrail Log Deleted*
+
 
 Amazon CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your Amazon Web Services account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your Amazon Web Services infrastructure. CloudTrail provides event history of your Amazon Web Services account activity, including actions taken through the Amazon Management Console, Amazon SDKs, command line tools, and other Amazon Web Services services. This event history simplifies security analysis, resource change tracking, and troubleshooting.
 
 This rule identifies the deletion of an AWS log trail using the API `DeleteTrail` action. Attackers can do this to cover their tracks and impact security monitoring that relies on this source.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -69,11 +73,15 @@ This rule identifies the deletion of an AWS log trail using the API `DeleteTrail
 - Investigate the deleted log trail's criticality and whether the responsible team is aware of the deletion.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -87,11 +95,15 @@ This rule identifies the deletion of an AWS log trail using the API `DeleteTrail
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-suspended.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-suspended.asciidoc
index 180831ac5b..c21a20945e 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-suspended.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-suspended.asciidoc
@@ -46,17 +46,21 @@ Identifies suspending the recording of AWS API calls and log file delivery for t
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS CloudTrail Log Suspended
+*Triage and analysis*
+
+
+
+*Investigating AWS CloudTrail Log Suspended*
+
 
 Amazon CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your Amazon Web Services account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your Amazon Web Services infrastructure. CloudTrail provides event history of your Amazon Web Services account activity, including actions taken through the Amazon Management Console, Amazon SDKs, command line tools, and other Amazon Web Services services. This event history simplifies security analysis, resource change tracking, and troubleshooting.
 
 This rule identifies the suspension of an AWS log trail using the API `StopLogging` action. Attackers can do this to cover their tracks and impact security monitoring that relies on this source.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -69,11 +73,15 @@ This rule identifies the suspension of an AWS log trail using the API `StopLoggi
 - Investigate the deleted log trail's criticality and whether the responsible team is aware of the deletion.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -87,11 +95,15 @@ This rule identifies the suspension of an AWS log trail using the API `StopLoggi
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-updated.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-updated.asciidoc
index 48da7776ca..97a92df190 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-updated.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-cloudtrail-log-updated.asciidoc
@@ -46,17 +46,21 @@ Identifies an update to an AWS log trail setting that specifies the delivery of
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS CloudTrail Log Updated
+*Triage and analysis*
+
+
+
+*Investigating AWS CloudTrail Log Updated*
+
 
 Amazon CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your Amazon Web Services account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your Amazon Web Services infrastructure. CloudTrail provides event history of your Amazon Web Services account activity, including actions taken through the Amazon Management Console, Amazon SDKs, command line tools, and other Amazon Web Services services. This event history simplifies security analysis, resource change tracking, and troubleshooting.
 
 This rule identifies a modification on CloudTrail settings using the API `UpdateTrail` action. Attackers can do this to cover their tracks and impact security monitoring that relies on this source.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Examine the response elements of the event to determine the scope of the changes.
@@ -69,11 +73,15 @@ This rule identifies a modification on CloudTrail settings using the API `Update
     - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -87,11 +95,15 @@ This rule identifies a modification on CloudTrail settings using the API `Update
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-alarm-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-alarm-deletion.asciidoc
index 78c56cf933..826f5c2699 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-alarm-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-alarm-deletion.asciidoc
@@ -45,11 +45,13 @@ Identifies the deletion of an AWS CloudWatch alarm. An adversary may delete alar
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS CloudWatch Alarm Deletion
+*Triage and analysis*
+
+
+
+*Investigating AWS CloudWatch Alarm Deletion*
+
 
 Amazon CloudWatch is a monitoring and observability service that collects monitoring and operational data in the form of
 logs, metrics, and events for resources and applications. This data can be used to detect anomalous behavior in your environments, set alarms, visualize
@@ -62,7 +64,9 @@ fall outside of the levels (high or low thresholds) that you configure.
 This rule looks for the deletion of a alarm using the API `DeleteAlarms` action. Attackers can do this to cover their
 tracks and evade security defenses.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -74,11 +78,15 @@ tracks and evade security defenses.
     - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -92,11 +100,15 @@ tracks and evade security defenses.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-group-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-group-deletion.asciidoc
index f1057330e7..ca568b1643 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-group-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-group-deletion.asciidoc
@@ -46,11 +46,13 @@ Identifies the deletion of a specified AWS CloudWatch log group. When a log grou
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS CloudWatch Log Group Deletion
+*Triage and analysis*
+
+
+
+*Investigating AWS CloudWatch Log Group Deletion*
+
 
 Amazon CloudWatch is a monitoring and observability service that collects monitoring and operational data in the form of logs, metrics, and events for resources and applications. This data can be used to detect anomalous behavior in your environments, set alarms, visualize logs and metrics side by side, take automated actions, troubleshoot issues, and discover insights to keep your applications running smoothly.
 
@@ -58,7 +60,9 @@ A log group is a group of log streams that share the same retention, monitoring,
 
 This rule looks for the deletion of a log group using the API `DeleteLogGroup` action. Attackers can do this to cover their tracks and impact security monitoring that relies on these sources.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -71,11 +75,15 @@ This rule looks for the deletion of a log group using the API `DeleteLogGroup` a
 - Investigate the deleted log group's criticality and whether the responsible team is aware of the deletion.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -89,11 +97,15 @@ This rule looks for the deletion of a log group using the API `DeleteLogGroup` a
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-stream-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-stream-deletion.asciidoc
index 7c5151dfbb..d2d553963a 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-stream-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-cloudwatch-log-stream-deletion.asciidoc
@@ -46,11 +46,13 @@ Identifies the deletion of an AWS CloudWatch log stream, which permanently delet
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS CloudWatch Log Stream Deletion
+*Triage and analysis*
+
+
+
+*Investigating AWS CloudWatch Log Stream Deletion*
+
 
 Amazon CloudWatch is a monitoring and observability service that collects monitoring and operational data in the form of logs, metrics, and events for resources and applications. This data can be used to detect anomalous behavior in your environments, set alarms, visualize logs and metrics side by side, take automated actions, troubleshoot issues, and discover insights to keep your applications running smoothly.
 
@@ -58,7 +60,9 @@ A log stream is a sequence of log events that share the same source. Each separa
 
 This rule looks for the deletion of a log stream using the API `DeleteLogStream` action. Attackers can do this to cover their tracks and impact security monitoring that relies on these sources.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -71,11 +75,15 @@ This rule looks for the deletion of a log stream using the API `DeleteLogStream`
 - Investigate the deleted log stream's criticality and whether the responsible team is aware of the deletion.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -89,11 +97,15 @@ This rule looks for the deletion of a log stream using the API `DeleteLogStream`
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-config-resource-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-config-resource-deletion.asciidoc
index 4fb0f0813b..eefccda5eb 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-config-resource-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-config-resource-deletion.asciidoc
@@ -46,17 +46,21 @@ Identifies attempts to delete an AWS Config Service resource. An adversary may t
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS Config Resource Deletion
+*Triage and analysis*
+
+
+
+*Investigating AWS Config Resource Deletion*
+
 
 AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This includes how the resources are related to one another and how they were configured in the past so that you can see how the configurations and relationships change over time.
 
 This rule looks for the deletion of AWS Config resources using various API actions. Attackers can do this to cover their tracks and impact security monitoring that relies on these sources.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Identify the AWS resource that was involved and its criticality, ownership, and role in the environment. Also investigate if the resource is security-related.
@@ -69,11 +73,15 @@ This rule looks for the deletion of AWS Config resources using various API actio
     - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -87,11 +95,15 @@ This rule looks for the deletion of AWS Config resources using various API actio
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-configuration-recorder-stopped.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-configuration-recorder-stopped.asciidoc
index c40ff55ddd..54155e4bbb 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-configuration-recorder-stopped.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-configuration-recorder-stopped.asciidoc
@@ -44,10 +44,12 @@ Identifies an AWS configuration change to stop recording a designated set of res
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-deletion-of-rds-instance-or-cluster.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-deletion-of-rds-instance-or-cluster.asciidoc
index 31ede4dc18..700b29b47f 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-deletion-of-rds-instance-or-cluster.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-deletion-of-rds-instance-or-cluster.asciidoc
@@ -49,10 +49,12 @@ Identifies the deletion of an Amazon Relational Database Service (RDS) Aurora da
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-encryption-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-encryption-disabled.asciidoc
index abb6999466..c34558ca29 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-ec2-encryption-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-encryption-disabled.asciidoc
@@ -45,10 +45,12 @@ Identifies disabling of Amazon Elastic Block Store (EBS) encryption by default i
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-full-network-packet-capture-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-full-network-packet-capture-detected.asciidoc
index 797aa13b14..1b45cf701e 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-ec2-full-network-packet-capture-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-full-network-packet-capture-detected.asciidoc
@@ -47,10 +47,12 @@ Identifies potential Traffic Mirroring in an Amazon Elastic Compute Cloud (EC2)
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-creation.asciidoc
index cb045eb6d5..f4848771f7 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-creation.asciidoc
@@ -47,10 +47,12 @@ Identifies the creation of an AWS Elastic Compute Cloud (EC2) network access con
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-deletion.asciidoc
index c3f23b0bec..b9cf8ac990 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-network-access-control-list-deletion.asciidoc
@@ -47,10 +47,12 @@ Identifies the deletion of an Amazon Elastic Compute Cloud (EC2) network access
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-snapshot-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-snapshot-activity.asciidoc
index 2efd8eb714..7a1dd22ad2 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-ec2-snapshot-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-snapshot-activity.asciidoc
@@ -46,17 +46,21 @@ An attempt was made to modify AWS EC2 snapshot attributes. Snapshots are sometim
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS EC2 Snapshot Activity
+*Triage and analysis*
+
+
+
+*Investigating AWS EC2 Snapshot Activity*
+
 
 Amazon EC2 snapshots are a mechanism to create point-in-time references to data that reside in storage volumes. System administrators commonly use this for backup operations and data recovery.
 
 This rule looks for the modification of snapshot attributes using the API `ModifySnapshotAttribute` action. This can be used to share snapshots with unauthorized third parties, giving others access to all the data on the snapshot.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Search for dry run attempts against the resource ID of the snapshot from other user accounts within CloudTrail.
@@ -71,11 +75,15 @@ This rule looks for the modification of snapshot attributes using the API `Modif
 - Check if the shared permissions of the snapshot were modified to `Public` or include unknown account IDs.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -89,11 +97,15 @@ This rule looks for the modification of snapshot attributes using the API `Modif
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-vm-export-failure.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-vm-export-failure.asciidoc
index cc36bf6ad5..6285bea33c 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-ec2-vm-export-failure.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-vm-export-failure.asciidoc
@@ -46,10 +46,12 @@ Identifies an attempt to export an AWS EC2 instance. A virtual machine (VM) expo
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-efs-file-system-or-mount-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-efs-file-system-or-mount-deleted.asciidoc
index e5b98eb398..68439e15bd 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-efs-file-system-or-mount-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-efs-file-system-or-mount-deleted.asciidoc
@@ -44,10 +44,12 @@ Detects when an EFS File System or Mount is deleted. An adversary could break an
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-created.asciidoc
index 8ba3d86c1e..1612280584 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-created.asciidoc
@@ -43,10 +43,12 @@ Identifies when an ElastiCache security group has been created.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-modified-or-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-modified-or-deleted.asciidoc
index 2a24a6de94..c016a6da3d 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-modified-or-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-elasticache-security-group-modified-or-deleted.asciidoc
@@ -43,10 +43,12 @@ Identifies when an ElastiCache security group has been modified or deleted.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-eventbridge-rule-disabled-or-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-eventbridge-rule-disabled-or-deleted.asciidoc
index 169ded4b69..cf383b6410 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-eventbridge-rule-disabled-or-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-eventbridge-rule-disabled-or-deleted.asciidoc
@@ -44,10 +44,12 @@ Identifies when a user has disabled or deleted an EventBridge rule. This activit
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-execution-via-system-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-execution-via-system-manager.asciidoc
index 5a16856614..0680ce2f7d 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-execution-via-system-manager.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-execution-via-system-manager.asciidoc
@@ -45,17 +45,21 @@ Identifies the execution of commands and scripts via System Manager. Execution m
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS Execution via System Manager
+*Triage and analysis*
+
+
+
+*Investigating AWS Execution via System Manager*
+
 
 Amazon EC2 Systems Manager is a management service designed to help users automatically collect software inventory, apply operating system patches, create system images, and configure Windows and Linux operating systems.
 
 This rule looks for the execution of commands and scripts using System Manager. Note that the actual contents of these scripts and commands are not included in the event, so analysts must gain visibility using an host-level security product.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -70,11 +74,15 @@ This rule looks for the execution of commands and scripts using System Manager.
 - Check if this operation was approved and performed according to the organization's change management policy.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -88,11 +96,15 @@ This rule looks for the execution of commands and scripts using System Manager.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-guardduty-detector-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-guardduty-detector-deletion.asciidoc
index 27eb953909..baeccefce9 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-guardduty-detector-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-guardduty-detector-deletion.asciidoc
@@ -44,10 +44,12 @@ Identifies the deletion of an Amazon GuardDuty detector. Upon deletion, GuardDut
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-assume-role-policy-update.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-assume-role-policy-update.asciidoc
index 5837358d87..61657975f2 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-assume-role-policy-update.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-assume-role-policy-update.asciidoc
@@ -45,17 +45,21 @@ Identifies attempts to modify an AWS IAM Assume Role Policy. An adversary may at
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS IAM Assume Role Policy Update
+*Triage and analysis*
+
+
+
+*Investigating AWS IAM Assume Role Policy Update*
+
 
 An IAM role is an IAM identity that you can create in your account that has specific permissions. An IAM role is similar to an IAM user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. Also, a role does not have standard long-term credentials such as a password or access keys associated with it. Instead, when you assume a role, it provides you with temporary security credentials for your role session.
 
 The role trust policy is a JSON document in which you define the principals you trust to assume the role. This policy is a required resource-based policy that is attached to a role in IAM. An attacker may attempt to modify this policy by using the `UpdateAssumeRolePolicy` API action to gain the privileges of that role.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -63,11 +67,15 @@ The role trust policy is a JSON document in which you define the principals you
 - Check if this operation was approved and performed according to the organization's change management policy.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - False positives may occur due to the intended usage of the service. Tuning is needed in order to have higher confidence. Consider adding exceptions — preferably with a combination of the user agent and user ID conditions — to cover administrator activities and infrastructure as code tooling.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -77,15 +85,19 @@ The role trust policy is a JSON document in which you define the principals you
     - Work with your IT team to identify and minimize the impact on users.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify any regulatory or legal ramifications related to this activity.
-- Use AWS [policy versioning](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html) to restore the trust policy to the desired state.
+- Use AWS https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html[policy versioning] to restore the trust policy to the desired state.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-brute-force-of-assume-role-policy.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-brute-force-of-assume-role-policy.asciidoc
index 9824af60e1..fa5e5f67af 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-brute-force-of-assume-role-policy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-brute-force-of-assume-role-policy.asciidoc
@@ -46,17 +46,21 @@ Identifies a high number of failed attempts to assume an AWS Identity and Access
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS IAM Brute Force of Assume Role Policy
+*Triage and analysis*
+
+
+
+*Investigating AWS IAM Brute Force of Assume Role Policy*
+
 
 An IAM role is an IAM identity that you can create in your account that has specific permissions. An IAM role is similar to an IAM user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. Also, a role does not have standard long-term credentials such as a password or access keys associated with it. Instead, when you assume a role, it provides you with temporary security credentials for your role session.
 
 Attackers may attempt to enumerate IAM roles in order to determine if a role exists before attempting to assume or hijack the discovered role.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Verify if the `RoleName` parameter contains a unique value in all requests or if the activity is potentially a brute force attack.
@@ -68,11 +72,15 @@ Attackers may attempt to enumerate IAM roles in order to determine if a role exi
 - Examine the account's commands, API calls, and data management actions in the last 24 hours.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Verify the roles targeted in the failed attempts, and whether the subject role previously existed in the environment. If only one role was targeted in the requests and that role previously existed, it may be a false positive, since automations can continue targeting roles that existed in the environment in the past and cause false positives (FPs).
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -86,10 +94,14 @@ Attackers may attempt to enumerate IAM roles in order to determine if a role exi
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-deactivation-of-mfa-device.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-deactivation-of-mfa-device.asciidoc
index b393f6b4f2..99a6511a57 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-deactivation-of-mfa-device.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-deactivation-of-mfa-device.asciidoc
@@ -46,19 +46,23 @@ Identifies the deactivation of a specified multi-factor authentication (MFA) dev
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS IAM Deactivation of MFA Device
+*Triage and analysis*
+
+
+
+*Investigating AWS IAM Deactivation of MFA Device*
+
 
 Multi-factor authentication (MFA) in AWS is a simple best practice that adds an extra layer of protection on top of your user name and password. With MFA enabled, when a user signs in to an AWS Management Console, they will be prompted for their user name and password (the first factor—what they know), as well as for an authentication code from their AWS MFA device (the second factor—what they have). Taken together, these multiple factors provide increased security for your AWS account settings and resources.
 
-For more information about using MFA in AWS, access the [official documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html).
+For more information about using MFA in AWS, access the https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html[official documentation].
 
 This rule looks for the deactivation or deletion of AWS MFA devices. These modifications weaken account security and can lead to the compromise of accounts and other assets.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -66,11 +70,15 @@ This rule looks for the deactivation or deletion of AWS MFA devices. These modif
 - Check if this operation was approved and performed according to the organization's change management policy.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - While this activity can be done by administrators, all users must use MFA. The security team should address any potential benign true positive (B-TP), as this configuration can risk the user and domain.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -83,10 +91,14 @@ This rule looks for the deactivation or deletion of AWS MFA devices. These modif
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Reactivate multi-factor authentication for the user.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-group-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-group-creation.asciidoc
index 1e9af572ef..85b90cede0 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-group-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-group-creation.asciidoc
@@ -45,10 +45,12 @@ Identifies the creation of a group in AWS Identity and Access Management (IAM).
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-group-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-group-deletion.asciidoc
index 68b0e124bc..ef86b8b7fc 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-group-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-group-deletion.asciidoc
@@ -44,10 +44,12 @@ Identifies the deletion of a specified AWS Identity and Access Management (IAM)
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-password-recovery-requested.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-password-recovery-requested.asciidoc
index 5a93c59a62..e837be1457 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-password-recovery-requested.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-password-recovery-requested.asciidoc
@@ -44,10 +44,12 @@ Identifies AWS IAM password recovery requests. An adversary may attempt to gain
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-user-addition-to-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-user-addition-to-group.asciidoc
index 79c3de8735..dc229951d2 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-user-addition-to-group.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-user-addition-to-group.asciidoc
@@ -46,17 +46,21 @@ Identifies the addition of a user to a specified group in AWS Identity and Acces
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS IAM User Addition to Group
+*Triage and analysis*
+
+
+
+*Investigating AWS IAM User Addition to Group*
+
 
 AWS Identity and Access Management (IAM) provides fine-grained access control across all of AWS. With IAM, you can specify who can access which services and resources, and under which conditions. With IAM policies, you manage permissions to your workforce and systems to ensure least-privilege permissions.
 
 This rule looks for the addition of users to a specified user group.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -64,11 +68,15 @@ This rule looks for the addition of users to a specified user group.
 - Check if this operation was approved and performed according to the organization's change management policy.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - False positives may occur due to the intended usage of the service. Tuning is needed in order to have higher confidence. Consider adding exceptions — preferably with a combination of user agent and IP address conditions — to reduce noise from onboarding processes and administrator activities.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -82,10 +90,14 @@ This rule looks for the addition of users to a specified user group.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-kms-customer-managed-key-disabled-or-scheduled-for-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-kms-customer-managed-key-disabled-or-scheduled-for-deletion.asciidoc
index 8c9865e19e..157c545318 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-kms-customer-managed-key-disabled-or-scheduled-for-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-kms-customer-managed-key-disabled-or-scheduled-for-deletion.asciidoc
@@ -45,10 +45,12 @@ Identifies attempts to disable or schedule the deletion of an AWS KMS Customer M
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-management-console-brute-force-of-root-user-identity.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-management-console-brute-force-of-root-user-identity.asciidoc
index 3fdd9889e2..62b8b47091 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-management-console-brute-force-of-root-user-identity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-management-console-brute-force-of-root-user-identity.asciidoc
@@ -44,10 +44,12 @@ Identifies a high number of failed authentication attempts to the AWS management
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-management-console-root-login.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-management-console-root-login.asciidoc
index 6f0010ac85..510f672a7e 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-management-console-root-login.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-management-console-root-login.asciidoc
@@ -45,17 +45,21 @@ Identifies a successful login to the AWS Management Console by the Root user.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS Management Console Root Login
+*Triage and analysis*
+
+
+
+*Investigating AWS Management Console Root Login*
 
-The AWS root account is the one identity that has complete access to all AWS services and resources in the account, which is created when the AWS account is created. AWS strongly recommends that you do not use the root user for your everyday tasks, even the administrative ones. Instead, adhere to the best practice of using the root user only to create your first IAM user. Then securely lock away the root user credentials and use them to perform only a few account and service management tasks. AWS provides a [list of the tasks that require root user](https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html#aws_tasks-that-require-root).
+
+The AWS root account is the one identity that has complete access to all AWS services and resources in the account, which is created when the AWS account is created. AWS strongly recommends that you do not use the root user for your everyday tasks, even the administrative ones. Instead, adhere to the best practice of using the root user only to create your first IAM user. Then securely lock away the root user credentials and use them to perform only a few account and service management tasks. AWS provides a https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html#aws_tasks-that-require-root[list of the tasks that require root user].
 
 This rule looks for attempts to log in to the AWS Management Console as the root user.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Examine whether this activity is common in the environment by looking for past occurrences on your logs.
@@ -65,11 +69,15 @@ This rule looks for attempts to log in to the AWS Management Console as the root
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking access to servers,
 services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - The alert can be dismissed if this operation is done under change management and approved according to the organization's policy for performing a task that needs this privilege level.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
@@ -79,9 +87,13 @@ services, and data accessed by the account in the last 24 hours.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify if there are any regulatory or legal ramifications related to this activity.
 - Configure multi-factor authentication for the user.
-- Follow security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Follow security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-rds-cluster-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-rds-cluster-creation.asciidoc
index e5429685a2..42fcfc6c65 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-rds-cluster-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-rds-cluster-creation.asciidoc
@@ -47,10 +47,12 @@ Identifies the creation of a new Amazon Relational Database Service (RDS) Aurora
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-cluster-stoppage.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-cluster-stoppage.asciidoc
index 021a3d5159..e9934186a7 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-cluster-stoppage.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-cluster-stoppage.asciidoc
@@ -47,10 +47,12 @@ Identifies that an Amazon Relational Database Service (RDS) cluster or instance
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-creation.asciidoc
index 73759b3ba2..bd91121169 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-rds-instance-creation.asciidoc
@@ -45,10 +45,12 @@ Identifies the creation of an Amazon Relational Database Service (RDS) Aurora da
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-creation.asciidoc
index 2d661d926c..add3251c94 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-creation.asciidoc
@@ -44,10 +44,12 @@ Identifies the creation of an Amazon Relational Database Service (RDS) Security
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-deletion.asciidoc
index fb99882493..d676f448b2 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-rds-security-group-deletion.asciidoc
@@ -44,10 +44,12 @@ Identifies the deletion of an Amazon Relational Database Service (RDS) Security
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-export.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-export.asciidoc
index 5e7d339bab..dcaaae4057 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-export.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-export.asciidoc
@@ -45,10 +45,12 @@ Identifies the export of an Amazon Relational Database Service (RDS) Aurora data
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-restored.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-restored.asciidoc
index bcdbc4d9a5..4887f0e0c4 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-restored.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-rds-snapshot-restored.asciidoc
@@ -45,10 +45,12 @@ Identifies when an attempt was made to restore an RDS Snapshot. Snapshots are so
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-redshift-cluster-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-redshift-cluster-creation.asciidoc
index 4a0264c25c..ffad4dd9b3 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-redshift-cluster-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-redshift-cluster-creation.asciidoc
@@ -44,10 +44,12 @@ Identifies the creation of an Amazon Redshift cluster. Unexpected creation of th
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-root-login-without-mfa.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-root-login-without-mfa.asciidoc
index 94620b3416..58b51d897d 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-root-login-without-mfa.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-root-login-without-mfa.asciidoc
@@ -45,21 +45,25 @@ Identifies attempts to login to AWS as the root user without using multi-factor
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS Root Login Without MFA
+*Triage and analysis*
+
+
+
+*Investigating AWS Root Login Without MFA*
+
 
 Multi-factor authentication (MFA) in AWS is a simple best practice that adds an extra layer of protection on top of your user name and password. With MFA enabled, when a user signs in to an AWS Management Console, they will be prompted for their user name and password, as well as for an authentication code from their AWS MFA device. Taken together, these multiple factors provide increased security for your AWS account settings and resources.
 
-For more information about using MFA in AWS, access the [official documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html).
+For more information about using MFA in AWS, access the https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html[official documentation].
 
-The AWS root account is the one identity that has complete access to all AWS services and resources in the account, which is created when the AWS account is created. AWS strongly recommends that you do not use the root user for your everyday tasks, even the administrative ones. Instead, adhere to the best practice of using the root user only to create your first IAM user. Then securely lock away the root user credentials and use them to perform only a few account and service management tasks. Amazon provides a [list of the tasks that require root user](https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html#aws_tasks-that-require-root).
+The AWS root account is the one identity that has complete access to all AWS services and resources in the account, which is created when the AWS account is created. AWS strongly recommends that you do not use the root user for your everyday tasks, even the administrative ones. Instead, adhere to the best practice of using the root user only to create your first IAM user. Then securely lock away the root user credentials and use them to perform only a few account and service management tasks. Amazon provides a https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html#aws_tasks-that-require-root[list of the tasks that require root user].
 
 This rule looks for attempts to log in to AWS as the root user without using multi-factor authentication (MFA), meaning the account is not secured properly.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate other alerts associated with the user account during the past 48 hours.
 - Examine whether this activity is common in the environment by looking for past occurrences on your logs.
@@ -69,11 +73,15 @@ This rule looks for attempts to log in to AWS as the root user without using mul
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking access to servers,
 services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - While this activity is not inherently malicious, the root account must use MFA. The security team should address any potential benign true positive (B-TP), as this configuration can risk the entire cloud environment.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
@@ -83,9 +91,13 @@ services, and data accessed by the account in the last 24 hours.
     - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
     - Identify if there are any regulatory or legal ramifications related to this activity.
 - Configure multi-factor authentication for the user.
-- Follow security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Follow security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transfer-lock-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transfer-lock-disabled.asciidoc
index fe87560f89..f3b255d034 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transfer-lock-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transfer-lock-disabled.asciidoc
@@ -46,10 +46,12 @@ Identifies when a transfer lock was removed from a Route 53 domain. It is recomm
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transferred-to-another-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transferred-to-another-account.asciidoc
index 751ab4cdff..13b3567114 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transferred-to-another-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-route-53-domain-transferred-to-another-account.asciidoc
@@ -45,10 +45,12 @@ Identifies when a request has been made to transfer a Route 53 domain to another
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-route-table-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-route-table-created.asciidoc
index aba024afba..cf4eb40ca7 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-route-table-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-route-table-created.asciidoc
@@ -47,10 +47,12 @@ Identifies when an AWS Route Table has been created.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-route-table-modified-or-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-route-table-modified-or-deleted.asciidoc
index 3d20fc1c68..de65d17e38 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-route-table-modified-or-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-route-table-modified-or-deleted.asciidoc
@@ -51,10 +51,12 @@ Identifies when an AWS Route Table has been modified or deleted.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-route53-private-hosted-zone-associated-with-a-vpc.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-route53-private-hosted-zone-associated-with-a-vpc.asciidoc
index 3a9b8bbdd2..9dfc19c2e2 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-route53-private-hosted-zone-associated-with-a-vpc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-route53-private-hosted-zone-associated-with-a-vpc.asciidoc
@@ -44,10 +44,12 @@ Identifies when a Route53 private hosted zone has been associated with VPC.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-s3-bucket-configuration-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-s3-bucket-configuration-deletion.asciidoc
index b84acc6666..68f214add9 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-s3-bucket-configuration-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-s3-bucket-configuration-deletion.asciidoc
@@ -48,10 +48,12 @@ Identifies the deletion of various Amazon Simple Storage Service (S3) bucket con
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-saml-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-saml-activity.asciidoc
index 99a1c887fd..ebea91aafe 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-saml-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-saml-activity.asciidoc
@@ -45,10 +45,12 @@ Identifies when SAML activity has occurred in AWS. An adversary could manipulate
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-security-group-configuration-change-detection.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-security-group-configuration-change-detection.asciidoc
index d357739fca..5d048fefb8 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-security-group-configuration-change-detection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-security-group-configuration-change-detection.asciidoc
@@ -45,10 +45,12 @@ Identifies a change to an AWS Security Group Configuration. A security group is
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-security-token-service-sts-assumerole-usage.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-security-token-service-sts-assumerole-usage.asciidoc
index cfad4bcd1d..6e4e97df28 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-security-token-service-sts-assumerole-usage.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-security-token-service-sts-assumerole-usage.asciidoc
@@ -44,10 +44,12 @@ Identifies the use of AssumeRole. AssumeRole returns a set of temporary security
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-sts-getsessiontoken-abuse.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-sts-getsessiontoken-abuse.asciidoc
index 13932b6d0c..80a71c097c 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-sts-getsessiontoken-abuse.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-sts-getsessiontoken-abuse.asciidoc
@@ -44,10 +44,12 @@ Identifies the suspicious use of GetSessionToken. Tokens could be created and us
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-vpc-flow-logs-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-vpc-flow-logs-deletion.asciidoc
index eee7ed7680..17e36de61c 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-vpc-flow-logs-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-vpc-flow-logs-deletion.asciidoc
@@ -46,17 +46,21 @@ Identifies the deletion of one or more flow logs in AWS Elastic Compute Cloud (E
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating AWS VPC Flow Logs Deletion
+*Triage and analysis*
+
+
+
+*Investigating AWS VPC Flow Logs Deletion*
+
 
 VPC Flow Logs is an AWS feature that enables you to capture information about the IP traffic going to and from network interfaces in your virtual private cloud (VPC). Flow log data can be published to Amazon CloudWatch Logs or Amazon S3.
 
 This rule identifies the deletion of VPC flow logs using the API `DeleteFlowLogs` action. Attackers can do this to cover their tracks and impact security monitoring that relies on this source.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -68,12 +72,16 @@ This rule identifies the deletion of VPC flow logs using the API `DeleteFlowLogs
     - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and IP address conditions.
 - Administrators may rotate these logs after a certain period as part of their retention policy or after importing them to a SIEM.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -87,11 +95,15 @@ This rule identifies the deletion of VPC flow logs using the API `DeleteFlowLogs
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-waf-access-control-list-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-waf-access-control-list-deletion.asciidoc
index fa1b60867c..d0795f5334 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-waf-access-control-list-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-waf-access-control-list-deletion.asciidoc
@@ -45,10 +45,12 @@ Identifies the deletion of a specified AWS Web Application Firewall (WAF) access
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-waf-rule-or-rule-group-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-waf-rule-or-rule-group-deletion.asciidoc
index d780f96e5e..bfb705b49a 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-waf-rule-or-rule-group-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-waf-rule-or-rule-group-deletion.asciidoc
@@ -45,10 +45,12 @@ Identifies the deletion of a specified AWS Web Application Firewall (WAF) rule o
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-sign-in.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-sign-in.asciidoc
index 52bbdfe300..529072efc1 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-sign-in.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-sign-in.asciidoc
@@ -47,19 +47,23 @@ Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsof
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Azure Active Directory High Risk Sign-in
+*Triage and analysis*
+
+
+
+*Investigating Azure Active Directory High Risk Sign-in*
+
 
 Microsoft Identity Protection is an Azure AD security tool that detects various types of identity risks and attacks.
 
 This rule identifies events produced by Microsoft Identity Protection with high risk levels or high aggregated risk level.
 
-#### Possible investigation steps
 
-- Identify the Risk Detection that triggered the event. A list with descriptions can be found [here](https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#risk-types-and-detection).
+*Possible investigation steps*
+
+
+- Identify the Risk Detection that triggered the event. A list with descriptions can be found https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#risk-types-and-detection[here].
 - Identify the user account involved and validate whether the suspicious activity is normal for that user.
   - Consider the source IP address and geolocation for the involved user account. Do they look normal?
   - Consider the device used to sign in. Is it registered and compliant?
@@ -68,11 +72,15 @@ This rule identifies events produced by Microsoft Identity Protection with high
 - Check if this operation was approved and performed according to the organization's change management policy.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and device conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -85,10 +93,17 @@ If this rule is noisy in your environment due to expected activity, consider add
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
-- Follow security best practices [outlined](https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices) by Microsoft.
+- Follow security best practices https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices[outlined] by Microsoft.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
+Note that details for `azure.signinlogs.properties.risk_level_during_signin` and `azure.signinlogs.properties.risk_level_aggregated`
+are only available for Azure AD Premium P2 customers. All other customers will be returned `hidden`.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-user-sign-in-heuristic.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-user-sign-in-heuristic.asciidoc
index bbc7978c2b..cfe91e75a9 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-user-sign-in-heuristic.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-active-directory-high-risk-user-sign-in-heuristic.asciidoc
@@ -47,19 +47,23 @@ Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsof
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Azure Active Directory High Risk User Sign-in Heuristic
+*Triage and analysis*
+
+
+
+*Investigating Azure Active Directory High Risk User Sign-in Heuristic*
+
 
 Microsoft Identity Protection is an Azure AD security tool that detects various types of identity risks and attacks.
 
 This rule identifies events produced by the Microsoft Identity Protection with a risk state equal to `confirmedCompromised` or `atRisk`.
 
-#### Possible investigation steps
 
-- Identify the Risk Detection that triggered the event. A list with descriptions can be found [here](https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#risk-types-and-detection).
+*Possible investigation steps*
+
+
+- Identify the Risk Detection that triggered the event. A list with descriptions can be found https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#risk-types-and-detection[here].
 - Identify the user account involved and validate whether the suspicious activity is normal for that user.
   - Consider the source IP address and geolocation for the involved user account. Do they look normal?
   - Consider the device used to sign in. Is it registered and compliant?
@@ -68,11 +72,15 @@ This rule identifies events produced by the Microsoft Identity Protection with a
 - Check if this operation was approved and performed according to the organization's change management policy.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and device conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -85,10 +93,14 @@ If this rule is noisy in your environment due to expected activity, consider add
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
-- Follow security best practices [outlined](https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices) by Microsoft.
+- Follow security best practices https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices[outlined] by Microsoft.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-active-directory-powershell-sign-in.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-active-directory-powershell-sign-in.asciidoc
index 2f4d67829a..ec0bfa36ee 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-active-directory-powershell-sign-in.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-active-directory-powershell-sign-in.asciidoc
@@ -45,17 +45,21 @@ Identifies a sign-in using the Azure Active Directory PowerShell module. PowerSh
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Azure Active Directory PowerShell Sign-in
+*Triage and analysis*
+
+
+
+*Investigating Azure Active Directory PowerShell Sign-in*
+
 
 Azure Active Directory PowerShell for Graph (Azure AD PowerShell) is a module IT professionals commonly use to manage their Azure Active Directory. The cmdlets in the Azure AD PowerShell module enable you to retrieve data from the directory, create new objects in the directory, update existing objects, remove objects, as well as configure the directory and its features.
 
 This rule identifies sign-ins that use the Azure Active Directory PowerShell module, which can indicate unauthorized access if done outside of IT or engineering.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Evaluate whether the user needs to access Azure AD using PowerShell to complete its tasks.
@@ -65,11 +69,15 @@ This rule identifies sign-ins that use the Azure Active Directory PowerShell mod
 - Investigate suspicious actions taken by the user using the module, for example, modifications in security settings that weakens the security policy, persistence-related tasks, and data access.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is expected and noisy in your environment, consider adding IT, Engineering, and other authorized users as exceptions — preferably with a combination of user and device conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -82,10 +90,14 @@ This rule identifies sign-ins that use the Azure Active Directory PowerShell mod
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
-- Follow security best practices [outlined](https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices) by Microsoft.
+- Follow security best practices https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices[outlined] by Microsoft.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-ad-global-administrator-role-assigned.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-ad-global-administrator-role-assigned.asciidoc
index 481a3798c7..d3b938651f 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-ad-global-administrator-role-assigned.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-ad-global-administrator-role-assigned.asciidoc
@@ -43,10 +43,12 @@ In Azure Active Directory (Azure AD), permissions to manage resources are assign
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-alert-suppression-rule-created-or-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-alert-suppression-rule-created-or-modified.asciidoc
index 7c4a8a7936..4b5dc4df05 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-alert-suppression-rule-created-or-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-alert-suppression-rule-created-or-modified.asciidoc
@@ -44,10 +44,12 @@ Identifies the creation of suppression rules in Azure. Suppression rules are a m
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-application-credential-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-application-credential-modification.asciidoc
index b20e83c829..5cc744d3f3 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-application-credential-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-application-credential-modification.asciidoc
@@ -43,10 +43,12 @@ Identifies when a new credential is added to an application in Azure. An applica
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-automation-account-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-automation-account-created.asciidoc
index 5576427780..519032bb63 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-automation-account-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-automation-account-created.asciidoc
@@ -46,10 +46,12 @@ Identifies when an Azure Automation account is created. Azure Automation account
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-created-or-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-created-or-modified.asciidoc
index 5ceb539cb2..4880ac8a61 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-created-or-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-created-or-modified.asciidoc
@@ -46,10 +46,12 @@ Identifies when an Azure Automation runbook is created or modified. An adversary
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-deleted.asciidoc
index 309833f4fd..73fef69a8c 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-automation-runbook-deleted.asciidoc
@@ -46,10 +46,12 @@ Identifies when an Azure Automation runbook is deleted. An adversary may delete
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-automation-webhook-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-automation-webhook-created.asciidoc
index 5d76b6e861..194b7f2c7c 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-automation-webhook-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-automation-webhook-created.asciidoc
@@ -46,10 +46,12 @@ Identifies when an Azure Automation webhook is created. Azure Automation runbook
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-blob-container-access-level-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-blob-container-access-level-modification.asciidoc
index f2b2a2dcb2..5840cf54b2 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-blob-container-access-level-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-blob-container-access-level-modification.asciidoc
@@ -43,10 +43,12 @@ Identifies changes to container access levels in Azure. Anonymous public read ac
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-blob-permissions-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-blob-permissions-modification.asciidoc
index 3e7d67a10d..50d7162ba7 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-blob-permissions-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-blob-permissions-modification.asciidoc
@@ -44,10 +44,12 @@ Identifies when the Azure role-based access control (Azure RBAC) permissions are
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-command-execution-on-virtual-machine.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-command-execution-on-virtual-machine.asciidoc
index 571caaa1e5..4b80d45043 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-command-execution-on-virtual-machine.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-command-execution-on-virtual-machine.asciidoc
@@ -45,10 +45,12 @@ Identifies command execution on a virtual machine (VM) in Azure. A Virtual Machi
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-conditional-access-policy-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-conditional-access-policy-modified.asciidoc
index 708bdff0e8..241467380a 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-conditional-access-policy-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-conditional-access-policy-modified.asciidoc
@@ -43,10 +43,12 @@ Identifies when an Azure Conditional Access policy is modified. Azure Conditiona
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-diagnostic-settings-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-diagnostic-settings-deletion.asciidoc
index 2ba4ca859e..b1db211369 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-diagnostic-settings-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-diagnostic-settings-deletion.asciidoc
@@ -42,10 +42,12 @@ Identifies the deletion of diagnostic settings in Azure, which send platform log
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-event-hub-authorization-rule-created-or-updated.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-event-hub-authorization-rule-created-or-updated.asciidoc
index 426015a78d..c50bc8cba5 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-event-hub-authorization-rule-created-or-updated.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-event-hub-authorization-rule-created-or-updated.asciidoc
@@ -43,10 +43,12 @@ Identifies when an Event Hub Authorization Rule is created or updated in Azure.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-event-hub-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-event-hub-deletion.asciidoc
index d14060328b..40100f4fa7 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-event-hub-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-event-hub-deletion.asciidoc
@@ -45,10 +45,12 @@ Identifies an Event Hub deletion in Azure. An Event Hub is an event processing s
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-external-guest-user-invitation.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-external-guest-user-invitation.asciidoc
index c84bb7b894..935f9289a3 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-external-guest-user-invitation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-external-guest-user-invitation.asciidoc
@@ -43,10 +43,12 @@ Identifies an invitation to an external user in Azure Active Directory (AD). Azu
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-firewall-policy-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-firewall-policy-deletion.asciidoc
index 114e2b6a33..134b0fe1ad 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-firewall-policy-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-firewall-policy-deletion.asciidoc
@@ -43,10 +43,12 @@ Identifies the deletion of a firewall policy in Azure. An adversary may delete a
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-frontdoor-web-application-firewall-waf-policy-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-frontdoor-web-application-firewall-waf-policy-deleted.asciidoc
index 315d0a2c8c..6096391642 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-frontdoor-web-application-firewall-waf-policy-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-frontdoor-web-application-firewall-waf-policy-deleted.asciidoc
@@ -43,10 +43,12 @@ Identifies the deletion of a Frontdoor Web Application Firewall (WAF) Policy in
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-full-network-packet-capture-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-full-network-packet-capture-detected.asciidoc
index f0350e0323..a982b7fcb2 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-full-network-packet-capture-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-full-network-packet-capture-detected.asciidoc
@@ -42,10 +42,12 @@ Identifies potential full network packet capture in Azure. Packet Capture is an
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-global-administrator-role-addition-to-pim-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-global-administrator-role-addition-to-pim-user.asciidoc
index 5343ac7f7b..f0d4509d1d 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-global-administrator-role-addition-to-pim-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-global-administrator-role-addition-to-pim-user.asciidoc
@@ -43,10 +43,12 @@ Identifies an Azure Active Directory (AD) Global Administrator role addition to
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-key-vault-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-key-vault-modified.asciidoc
index 3cf20294f6..9bb8de5557 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-key-vault-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-key-vault-modified.asciidoc
@@ -44,10 +44,12 @@ Identifies modifications to a Key Vault in Azure. The Key Vault is a service tha
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-events-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-events-deleted.asciidoc
index 803416351d..0c7d31b4e9 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-events-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-events-deleted.asciidoc
@@ -43,10 +43,12 @@ Identifies when events are deleted in Azure Kubernetes. Kubernetes events are ob
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-pods-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-pods-deleted.asciidoc
index 62e26f3bfe..95a4a94c60 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-pods-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-pods-deleted.asciidoc
@@ -43,10 +43,12 @@ Identifies the deletion of Azure Kubernetes Pods. Adversaries may delete a Kuber
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-rolebindings-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-rolebindings-created.asciidoc
index 50d87dfe47..737d0a3ff3 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-rolebindings-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-kubernetes-rolebindings-created.asciidoc
@@ -44,10 +44,12 @@ Identifies the creation of role binding or cluster role bindings. You can assign
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-network-watcher-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-network-watcher-deletion.asciidoc
index d94f3640f8..b8744e98e2 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-network-watcher-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-network-watcher-deletion.asciidoc
@@ -43,10 +43,12 @@ Identifies the deletion of a Network Watcher in Azure. Network Watchers are used
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-privilege-identity-management-role-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-privilege-identity-management-role-modified.asciidoc
index 2b76402507..e3e0e0c3d9 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-privilege-identity-management-role-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-privilege-identity-management-role-modified.asciidoc
@@ -45,17 +45,21 @@ Azure Active Directory (AD) Privileged Identity Management (PIM) is a service th
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Azure Privilege Identity Management Role Modified
+*Triage and analysis*
+
+
+
+*Investigating Azure Privilege Identity Management Role Modified*
+
 
 Azure Active Directory (AD) Privileged Identity Management (PIM) is a service that enables you to manage, control, and monitor access to important resources in an organization. PIM can be used to manage the built-in Azure resource roles such as Global Administrator and Application Administrator.
 
 This rule identifies the update of PIM role settings, which can indicate that an attacker has already gained enough access to modify role assignment settings.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -66,11 +70,15 @@ This rule identifies the update of PIM role settings, which can indicate that an
 - Examine the account's commands, API calls, and data management actions in the last 24 hours.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity didn't follow your organization's change management policies, it should be reviewed by the security team.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -84,10 +92,14 @@ This rule identifies the update of PIM role settings, which can indicate that an
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Restore the PIM roles to the desired state.
 - Consider enabling multi-factor authentication for users.
-- Follow security best practices [outlined](https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices) by Microsoft.
+- Follow security best practices https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices[outlined] by Microsoft.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-resource-group-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-resource-group-deletion.asciidoc
index 5dcd685891..e7df96f6bd 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-resource-group-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-resource-group-deletion.asciidoc
@@ -43,10 +43,12 @@ Identifies the deletion of a resource group in Azure, which includes all resourc
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-service-principal-addition.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-service-principal-addition.asciidoc
index be292479fb..d344f3fa76 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-service-principal-addition.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-service-principal-addition.asciidoc
@@ -45,17 +45,21 @@ Identifies when a new service principal is added in Azure. An application, hoste
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Azure Service Principal Addition
+*Triage and analysis*
+
+
+
+*Investigating Azure Service Principal Addition*
+
 
 Service Principals are identities used by applications, services, and automation tools to access specific resources. They grant specific access based on the assigned API permissions. Most organizations that work a lot with Azure AD make use of service principals. Whenever an application is registered, it automatically creates an application object and a service principal in an Azure AD tenant.
 
 This rule looks for the addition of service principals. This behavior may enable attackers to impersonate legitimate service principals to camouflage their activities among noisy automations/apps.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -66,11 +70,15 @@ This rule looks for the addition of service principals. This behavior may enable
 - Examine the account's commands, API calls, and data management actions in the last 24 hours.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and device conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -83,10 +91,14 @@ If this rule is noisy in your environment due to expected activity, consider add
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
-- Follow security best practices [outlined](https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices) by Microsoft.
+- Follow security best practices https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices[outlined] by Microsoft.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-service-principal-credentials-added.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-service-principal-credentials-added.asciidoc
index 42459bb422..53800ee2f7 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-service-principal-credentials-added.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-service-principal-credentials-added.asciidoc
@@ -44,10 +44,12 @@ Identifies when new Service Principal credentials have been added in Azure. In m
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-storage-account-key-regenerated.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-storage-account-key-regenerated.asciidoc
index 04e8f8637f..8a90fd6d03 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-storage-account-key-regenerated.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-storage-account-key-regenerated.asciidoc
@@ -43,10 +43,12 @@ Identifies a rotation to storage account access keys in Azure. Regenerating acce
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-virtual-network-device-modified-or-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-virtual-network-device-modified-or-deleted.asciidoc
index d7cbdd5d9b..84e971662a 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-virtual-network-device-modified-or-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-virtual-network-device-modified-or-deleted.asciidoc
@@ -43,10 +43,12 @@ Identifies when a virtual network device is modified or deleted. This can be a n
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/base16-or-base32-encoding-decoding-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/base16-or-base32-encoding-decoding-activity.asciidoc
index a0d3d1e857..4aab16a074 100644
--- a/docs/detections/prebuilt-rules/rule-details/base16-or-base32-encoding-decoding-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/base16-or-base32-encoding-decoding-activity.asciidoc
@@ -3,13 +3,14 @@
 
 Adversaries may encode/decode data in an attempt to evade detection by host- or network-based security controls.
 
-*Rule type*: query
+*Rule type*: eql
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 * endgame-*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
 
 *Severity*: low
 
@@ -31,8 +32,9 @@ Adversaries may encode/decode data in an attempt to evade detection by host- or
 * Tactic: Defense Evasion
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
+* Data Source: Auditd Manager
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
@@ -41,13 +43,64 @@ Adversaries may encode/decode data in an attempt to evade detection by host- or
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-event.category:process and host.os.type:linux and event.type:(start or process_started) and
-  process.name:(base16 or base32 or base32plain or base32hex)
+process where host.os.type == "linux" and event.type in ("start", "process_started") and
+process.name in ("base16", "base32", "base32plain", "base32hex") and not process.args in ("--help", "--version")
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/binary-executed-from-shared-memory-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/binary-executed-from-shared-memory-directory.asciidoc
index 42b10a0d11..35a2d8cb79 100644
--- a/docs/detections/prebuilt-rules/rule-details/binary-executed-from-shared-memory-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/binary-executed-from-shared-memory-directory.asciidoc
@@ -45,6 +45,41 @@ Identifies the execution of a binary by root in Linux shared memory directories:
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/bpf-filter-applied-using-tc.asciidoc b/docs/detections/prebuilt-rules/rule-details/bpf-filter-applied-using-tc.asciidoc
index 4fabe76455..1ae910ea42 100644
--- a/docs/detections/prebuilt-rules/rule-details/bpf-filter-applied-using-tc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/bpf-filter-applied-using-tc.asciidoc
@@ -44,6 +44,41 @@ Detects when the tc (transmission control) binary is utilized to set a BPF (Berk
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
index a192627abb..4e53153f12 100644
--- a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
@@ -48,22 +48,26 @@ Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Bypass UAC via Event Viewer
+*Triage and analysis*
+
+
+
+*Investigating Bypass UAC via Event Viewer*
+
 
 Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.
 
-For more information about the UAC and how it works, check the [official Microsoft docs page](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works).
+For more information about the UAC and how it works, check the https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works[official Microsoft docs page].
 
 During startup, `eventvwr.exe` checks the registry value of the `HKCU\Software\Classes\mscfile\shell\open\command` registry key for the location of `mmc.exe`, which is used to open the `eventvwr.msc` saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user. This rule detects this UAC bypass by monitoring processes spawned by `eventvwr.exe` other than `mmc.exe` and `werfault.exe`.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -85,11 +89,15 @@ During startup, `eventvwr.exe` checks the registry value of the `HKCU\Software\C
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -105,7 +113,17 @@ During startup, `eventvwr.exe` checks the registry value of the `HKCU\Software\C
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/cap-sys-admin-assigned-to-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/cap-sys-admin-assigned-to-binary.asciidoc
index fda72bbedd..cb52866b5f 100644
--- a/docs/detections/prebuilt-rules/rule-details/cap-sys-admin-assigned-to-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/cap-sys-admin-assigned-to-binary.asciidoc
@@ -39,6 +39,41 @@ Identifies instances where a binary is granted the CAP_SYS_ADMIN capability. In
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/chkconfig-service-add.asciidoc b/docs/detections/prebuilt-rules/rule-details/chkconfig-service-add.asciidoc
index e8032a3170..2d777eb8f4 100644
--- a/docs/detections/prebuilt-rules/rule-details/chkconfig-service-add.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/chkconfig-service-add.asciidoc
@@ -46,11 +46,13 @@ Detects the use of the chkconfig binary to manually add a service for management
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Chkconfig Service Add
+*Triage and analysis*
+
+
+
+*Investigating Chkconfig Service Add*
+
 Service files are configuration files in Linux systems used to define and manage system services. The `Chkconfig` binary can be used to manually add, delete or modify a service. 
 
 Malicious actors can leverage services to achieve persistence by creating or modifying service files to execute malicious commands or payloads during system startup. This allows them to maintain unauthorized access, execute additional malicious activities, or evade detection.
@@ -58,10 +60,12 @@ Malicious actors can leverage services to achieve persistence by creating or mod
 This rule monitors the usage of the `chkconfig` binary to manually add a service for management by `chkconfig`, potentially indicating the creation of a persistence mechanism.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible Investigation Steps*
 
-#### Possible Investigation Steps
 
 - Investigate the service that was created or modified.
 - Investigate the currently enabled system services through the following commands `sudo chkconfig --list | grep on` and `sudo systemctl list-unit-files`.
@@ -94,13 +98,17 @@ This rule monitors the usage of the `chkconfig` binary to manually add a service
 - Investigate whether the user is currently logged in and active.
     - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator who uses the `chkconfig` binary for administrative purposes, consider adding exceptions for this specific administrator user account. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Suspicious File Creation in /etc for Persistence - 1c84dd64-7e6c-4bad-ac73-a5014ee37042
 - Potential Persistence Through Run Control Detected - 0f4d35e4-925e-4959-ab24-911be207ee6f
@@ -108,7 +116,9 @@ This rule monitors the usage of the `chkconfig` binary to manually add a service
 - New Systemd Timer Created - 7fb500fa-8e24-4bd1-9480-2a819352602c
 - New Systemd Service Created by Previously Unknown Process - 17b0a495-4d9f-414c-8ad0-92f018b8e001
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -123,7 +133,41 @@ This rule monitors the usage of the `chkconfig` binary to manually add a service
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc b/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc
index 08f847f364..42a385a7af 100644
--- a/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc
@@ -52,17 +52,21 @@ Identifies when a user attempts to clear console history. An adversary may clear
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Clearing Windows Console History
+*Triage and analysis*
+
+
+
+*Investigating Clearing Windows Console History*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
 Attackers can try to cover their tracks by clearing PowerShell console history. PowerShell has two different ways of logging commands: the built-in history and the command history managed by the PSReadLine module. This rule looks for the execution of commands that can clear the built-in PowerShell logs or delete the `ConsoleHost_history.txt` file.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -71,11 +75,15 @@ Attackers can try to cover their tracks by clearing PowerShell console history.
   - Verify if any other anti-forensics behaviors were observed.
 - Investigate the PowerShell logs on the SIEM to determine if there was suspicious behavior that an attacker may be trying to cover up.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -86,7 +94,17 @@ Attackers can try to cover their tracks by clearing PowerShell console history.
   - Ensure that PowerShell auditing policies and log collection are in place to grant future visibility.
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc b/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc
index 4eda719eba..1571fc5dcb 100644
--- a/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc
@@ -47,17 +47,21 @@ Identifies attempts to clear or disable Windows event log stores using Windows w
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Clearing Windows Event Logs
+*Triage and analysis*
+
+
+
+*Investigating Clearing Windows Event Logs*
+
 
 Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.
 
 This rule looks for the execution of the `wevtutil.exe` utility or the `Clear-EventLog` cmdlet to clear event logs.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -66,12 +70,16 @@ This rule looks for the execution of the `wevtutil.exe` utility or the `Clear-Ev
   - Verify if any other anti-forensics behaviors were observed.
 - Investigate the event logs prior to the action for suspicious behaviors that an attacker may be trying to cover up.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and there are justifications for this action.
 - Analyze whether the cleared event log is pertinent to security and general monitoring. Administrators can clear non-relevant event logs using this mechanism. If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
   - This activity is potentially done after the adversary achieves its objectives on the host. Ensure that previous actions, if any, are investigated accordingly with their response playbooks.
@@ -82,7 +90,17 @@ This rule looks for the execution of the `wevtutil.exe` utility or the `Clear-Ev
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/cobalt-strike-command-and-control-beacon.asciidoc b/docs/detections/prebuilt-rules/rule-details/cobalt-strike-command-and-control-beacon.asciidoc
index 51031a227b..66b8182f29 100644
--- a/docs/detections/prebuilt-rules/rule-details/cobalt-strike-command-and-control-beacon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/cobalt-strike-command-and-control-beacon.asciidoc
@@ -46,12 +46,11 @@ Cobalt Strike is a threat emulation platform commonly modified and used by adver
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Threat intel
+
+*Threat intel*
+
 
 This activity has been observed in FIN7 campaigns.
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
index c03bd5fa1f..4657a1bd14 100644
--- a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
@@ -47,11 +47,13 @@ Identifies attempts to disable/modify the code signing policy through system nat
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Code Signing Policy Modification Through Built-in tools
+*Triage and analysis*
+
+
+
+*Investigating Code Signing Policy Modification Through Built-in tools*
+
 
 Windows Driver Signature Enforcement (DSE) is a security feature introduced by Microsoft to enforce that only signed drivers can be loaded and executed into the kernel (ring 0). This feature was introduced to prevent attackers from loading their malicious drivers on targets. If the driver has an invalid signature, the system will not allow it to be loaded.
 
@@ -60,9 +62,11 @@ This protection is essential for maintaining the security of the system. However
 This rule identifies commands that can disable the Driver Signature Enforcement feature.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -73,17 +77,23 @@ This rule identifies commands that can disable the Driver Signature Enforcement
 - Identify the driver's `Device Name` and `Service Name`.
 - Check for alerts from the rules specified in the `Related Rules` section.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
 
-### Related Rules
+
+*Related Rules*
+
 
 - First Time Seen Driver Loaded - df0fd41e-5590-4965-ad5e-cd079ec22fa9
 - Untrusted Driver Loaded - d8ab1ec1-feeb-48b9-89e7-c12e189448aa
 - Code Signing Policy Modification Through Registry - da7733b1-fe08-487e-b536-0a04c6d8b0cd
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -97,7 +107,6 @@ This rule identifies commands that can disable the Driver Signature Enforcement
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
index f85b9c4154..bb0166e16b 100644
--- a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
@@ -46,11 +46,13 @@ Identifies attempts to disable the code signing policy through the registry. Cod
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Code Signing Policy Modification Through Registry
+*Triage and analysis*
+
+
+
+*Investigating Code Signing Policy Modification Through Registry*
+
 
 Microsoft created the Windows Driver Signature Enforcement (DSE) security feature to prevent drivers with invalid signatures from loading and executing into the kernel (ring 0). DSE aims to protect systems by blocking attackers from loading malicious drivers on targets. 
 
@@ -59,9 +61,11 @@ This protection is essential for maintaining system security. However, attackers
 This rule identifies registry modifications that can disable DSE.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -72,17 +76,23 @@ This rule identifies registry modifications that can disable DSE.
 - Identify the driver's `Device Name` and `Service Name`.
 - Check for alerts from the rules specified in the `Related Rules` section.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
 
-### Related Rules
+
+*Related Rules*
+
 
 - First Time Seen Driver Loaded - df0fd41e-5590-4965-ad5e-cd079ec22fa9
 - Untrusted Driver Loaded - d8ab1ec1-feeb-48b9-89e7-c12e189448aa
 - Code Signing Policy Modification Through Built-in tools - b43570de-a908-4f7f-8bdb-b2df6ffd8c80
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -96,7 +106,6 @@ This rule identifies registry modifications that can disable DSE.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/command-execution-via-solarwinds-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/command-execution-via-solarwinds-process.asciidoc
index a34e821cf5..5cdc1ae891 100644
--- a/docs/detections/prebuilt-rules/rule-details/command-execution-via-solarwinds-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/command-execution-via-solarwinds-process.asciidoc
@@ -47,6 +47,17 @@ A suspicious SolarWinds child process (Cmd.exe or Powershell.exe) was detected.
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
index 34694449ce..995f1d0396 100644
--- a/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
@@ -46,20 +46,24 @@ Identifies cmd.exe making a network connection. Adversaries could abuse cmd.exe
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Command Prompt Network Connection
+*Triage and analysis*
+
+
+
+*Investigating Command Prompt Network Connection*
+
 
 Attackers commonly transfer tooling or malware from external systems into a compromised environment using a command and control channel. However, they can also abuse signed utilities to drop these files.
 
 This rule looks for a network connection to an external address from the `cmd.exe` utility, which can indicate the abuse of the utility to download malicious files and tools.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -84,11 +88,15 @@ This rule looks for a network connection to an external address from the `cmd.ex
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of destination IP address and file name conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -102,7 +110,6 @@ This rule looks for a network connection to an external address from the `cmd.ex
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/command-shell-activity-started-via-rundll32.asciidoc b/docs/detections/prebuilt-rules/rule-details/command-shell-activity-started-via-rundll32.asciidoc
index 22fd7634c5..caae6cfb6f 100644
--- a/docs/detections/prebuilt-rules/rule-details/command-shell-activity-started-via-rundll32.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/command-shell-activity-started-via-rundll32.asciidoc
@@ -44,6 +44,17 @@ Identifies command shell activity started via RunDLL32, which is commonly abused
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc b/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc
index 21968e230a..07478c7499 100644
--- a/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc
@@ -47,15 +47,19 @@ Identifies Component Object Model (COM) hijacking via registry modification. Adv
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Component Object Model Hijacking
+*Triage and analysis*
+
+
+
+*Investigating Component Object Model Hijacking*
+
 
 Adversaries can insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means of persistence.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -71,11 +75,15 @@ Adversaries can insert malicious code that can be executed in place of legitimat
   - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Some Microsoft executables will reference the LocalServer32 registry key value for the location of external COM objects.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -92,7 +100,17 @@ Adversaries can insert malicious code that can be executed in place of legitimat
 
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/conhost-spawned-by-suspicious-parent-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/conhost-spawned-by-suspicious-parent-process.asciidoc
index 3fedaa14ce..c68e105da8 100644
--- a/docs/detections/prebuilt-rules/rule-details/conhost-spawned-by-suspicious-parent-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/conhost-spawned-by-suspicious-parent-process.asciidoc
@@ -50,17 +50,21 @@ Detects when the Console Window Host (conhost.exe) process is spawned by a suspi
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Conhost Spawned By Suspicious Parent Process
+*Triage and analysis*
+
+
+
+*Investigating Conhost Spawned By Suspicious Parent Process*
+
 
 The Windows Console Host, or `conhost.exe`, is both the server application for all of the Windows Console APIs as well as the classic Windows user interface for working with command-line applications.
 
 Attackers often rely on custom shell implementations to avoid using built-in command interpreters like `cmd.exe` and `PowerShell.exe` and bypass application allowlisting and security features. Attackers commonly inject these implementations into legitimate system processes.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
@@ -76,16 +80,22 @@ Attackers often rely on custom shell implementations to avoid using built-in com
   - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Related rules
+
+*Related rules*
+
 
 - Suspicious Process from Conhost - 28896382-7d4f-4d50-9b72-67091901fd26
 - Suspicious PowerShell Engine ImageLoad - 852c1f19-68e8-43a6-9dce-340771fe1be3
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -101,7 +111,17 @@ Attackers often rely on custom shell implementations to avoid using built-in com
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc
index 9caed9bfb2..de8c7a4b7c 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc
@@ -40,6 +40,17 @@ Identifies unusual processes connecting to domains using known free SSL certific
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
index d39903b20b..96a9f618ae 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
@@ -42,21 +42,25 @@ Adversaries may implement command and control (C2) communications that use commo
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Connection to Commonly Abused Web Services
+*Triage and analysis*
+
+
+
+*Investigating Connection to Commonly Abused Web Services*
+
 
 Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.
 
 This rule looks for processes outside known legitimate program locations communicating with a list of services that can be abused for exfiltration or command and control.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses the {security-guide}/security/master/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -79,11 +83,15 @@ This rule looks for processes outside known legitimate program locations communi
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This rule has a high chance to produce false positives because it detects communication with legitimate services. Noisy false positives can be added as exceptions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -97,7 +105,6 @@ This rule looks for processes outside known legitimate program locations communi
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-external-network-via-telnet.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-external-network-via-telnet.asciidoc
index c1e6ec5185..b48ecb8ca0 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-external-network-via-telnet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-external-network-via-telnet.asciidoc
@@ -41,6 +41,57 @@ Telnet provides a command line interface for communication with a remote device
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-internal-network-via-telnet.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-internal-network-via-telnet.asciidoc
index 3a91d4f2fd..8e2ea3fb25 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-internal-network-via-telnet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-internal-network-via-telnet.asciidoc
@@ -41,6 +41,57 @@ Telnet provides a command line interface for communication with a remote device
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/control-panel-process-with-unusual-arguments.asciidoc b/docs/detections/prebuilt-rules/rule-details/control-panel-process-with-unusual-arguments.asciidoc
index 8bff7e56e1..7d65300e38 100644
--- a/docs/detections/prebuilt-rules/rule-details/control-panel-process-with-unusual-arguments.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/control-panel-process-with-unusual-arguments.asciidoc
@@ -46,6 +46,17 @@ Identifies unusual instances of Control Panel with suspicious keywords or paths
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc
index 45ad1fca43..f11df7ed44 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc
@@ -49,27 +49,35 @@ Identifies the creation of a hidden local user account by appending the dollar s
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Creation of a Hidden Local User Account
+*Triage and analysis*
+
+
+
+*Investigating Creation of a Hidden Local User Account*
+
 
 Attackers can create accounts ending with a `$` symbol to make the account hidden to user enumeration utilities and bypass detections that identify computer accounts by this pattern to apply filters.
 
 This rule uses registry events to identify the creation of local hidden accounts.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positive (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -79,7 +87,17 @@ This rule uses registry events to identify the creation of local hidden accounts
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc
index b5ca363806..279692449e 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc
@@ -7,7 +7,6 @@ Users can mark specific files as hidden simply by putting a "." as the first cha
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: medium
@@ -30,7 +29,7 @@ Users can mark specific files as hidden simply by putting a "." as the first cha
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
@@ -39,12 +38,68 @@ Users can mark specific files as hidden simply by putting a "." as the first cha
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Custom Ingest Pipeline*
+
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html[guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-process where host.os.type == "linux" and event.type == "start" and
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
 process.working_directory in ("/tmp", "/var/tmp", "/dev/shm") and
 process.args regex~ """\.[a-z0-9_\-][a-z0-9_\-\.]{1,254}""" and
 not process.name in ("ls", "find", "grep", "git", "jq", "basename")
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-launch-agent-or-daemon.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-launch-agent-or-daemon.asciidoc
index 9667325f4d..20dbc300da 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-launch-agent-or-daemon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-launch-agent-or-daemon.asciidoc
@@ -41,6 +41,41 @@ Identifies the creation of a hidden launch agent or daemon. An adversary may est
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-login-item-via-apple-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-login-item-via-apple-script.asciidoc
index dc052f78df..ab340f9895 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-login-item-via-apple-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-login-item-via-apple-script.asciidoc
@@ -39,6 +39,41 @@ Identifies the execution of osascript to create a hidden login item. This may in
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc
index 03b9f05085..dc26b21fbd 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc
@@ -32,7 +32,7 @@ Identifies the creation of a hidden shared object (.so) file. Users can mark spe
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
@@ -41,12 +41,69 @@ Identifies the creation of a hidden shared object (.so) file. Users can mark spe
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Custom Ingest Pipeline*
+
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html[guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-file where host.os.type == "linux" and event.type == "creation" and file.extension == "so" and file.name : ".*.so"
+file where host.os.type == "linux" and event.type == "creation" and file.extension == "so" and file.name : ".*.so" and
+not process.name == "dockerd"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-settingcontent-ms-files.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-settingcontent-ms-files.asciidoc
index c9c725382f..3a7e88ded2 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-settingcontent-ms-files.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-settingcontent-ms-files.asciidoc
@@ -32,7 +32,7 @@ Identifies the suspicious creation of SettingContents-ms files, which have been
 * Data Source: Elastic Defend
 * Rule Type: BBR
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -47,7 +47,8 @@ Identifies the suspicious creation of SettingContents-ms files, which have been
 [source, js]
 ----------------------------------
 file where host.os.type == "windows" and event.type == "creation" and
-  file.extension : "settingcontent-ms"
+  file.extension : "settingcontent-ms" and
+  not file.path : "?:\\Users\\*\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_*\\LocalState\\Indexed\\Settings\\*"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc
index 57a8f62dc3..96c20bef91 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc
@@ -43,6 +43,17 @@ Detects the creation or modification of a new Group Policy based scheduled task
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc
index 39d078f720..fe49d272fa 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc
@@ -48,14 +48,24 @@ Identifies the creation or modification of Domain Backup private keys. Adversari
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
+
+*Triage and analysis*
+
 
 Domain DPAPI Backup keys are stored on domain controllers and can be dumped remotely with tools such as Mimikatz. The resulting .pvk private key can be used to decrypt ANY domain user masterkeys, which then can be used to decrypt any secrets protected by those keys.
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-root-certificate.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-root-certificate.asciidoc
index edcb7c30d5..cc032effeb 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-root-certificate.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-root-certificate.asciidoc
@@ -49,19 +49,23 @@ Identifies the creation or modification of a local trusted root certificate in W
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Creation or Modification of Root Certificate
+*Triage and analysis*
+
+
+
+*Investigating Creation or Modification of Root Certificate*
+
 
 Root certificates are the primary level of certifications that tell a browser that the communication is trusted and legitimate. This verification is based upon the identification of a certification authority. Windows adds several trusted root certificates so browsers can use them to communicate with websites.
 
-[Check out this post](https://www.thewindowsclub.com/what-are-root-certificates-windows) for more details on root certificates and the involved cryptography.
+https://www.thewindowsclub.com/what-are-root-certificates-windows[Check out this post] for more details on root certificates and the involved cryptography.
 
 This rule identifies the creation or modification of a root certificate by monitoring registry modifications. The installation of a malicious root certificate would allow an attacker the ability to masquerade malicious files as valid signed components from any entity (for example, Microsoft). It could also allow an attacker to decrypt SSL traffic.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -76,11 +80,15 @@ This rule identifies the creation or modification of a root certificate by monit
   - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This detection may be triggered by certain applications that install root certificates for the purpose of inspecting SSL traffic. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -97,7 +105,17 @@ This rule identifies the creation or modification of a root certificate by monit
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/credential-acquisition-via-registry-hive-dumping.asciidoc b/docs/detections/prebuilt-rules/rule-details/credential-acquisition-via-registry-hive-dumping.asciidoc
index 57eff26c80..75262db7d1 100644
--- a/docs/detections/prebuilt-rules/rule-details/credential-acquisition-via-registry-hive-dumping.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/credential-acquisition-via-registry-hive-dumping.asciidoc
@@ -50,11 +50,13 @@ Identifies attempts to export a registry hive which may contain credentials usin
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Credential Acquisition via Registry Hive Dumping
+*Triage and analysis*
+
+
+
+*Investigating Credential Acquisition via Registry Hive Dumping*
+
 
 Dumping registry hives is a common way to access credential information as some hives store credential material.
 
@@ -64,7 +66,9 @@ Dumping these hives in combination with the SYSTEM hive enables the attacker to
 
 This rule identifies the usage of `reg.exe` to dump SECURITY and/or SAM hives, which potentially indicates the compromise of the credentials stored in the host.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -73,15 +77,21 @@ This rule identifies the usage of `reg.exe` to dump SECURITY and/or SAM hives, w
 - Investigate if the credential material was exfiltrated or processed locally by other tools.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Administrators can export registry hives for backup purposes using command line tools like `reg.exe`. Check whether the user is legitamitely performing this kind of activity.
 
-### Related rules
+
+*Related rules*
+
 
 - Registry Hive File Creation via SMB - a4c7473a-5cb4-4bc1-9d06-e4a75adbc494
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -92,7 +102,17 @@ This rule identifies the usage of `reg.exe` to dump SECURITY and/or SAM hives, w
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/cron-job-created-or-changed-by-previously-unknown-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/cron-job-created-or-changed-by-previously-unknown-process.asciidoc
index 94c44f3ec5..d950e53d2d 100644
--- a/docs/detections/prebuilt-rules/rule-details/cron-job-created-or-changed-by-previously-unknown-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/cron-job-created-or-changed-by-previously-unknown-process.asciidoc
@@ -47,11 +47,13 @@ Linux cron jobs are scheduled tasks that can be leveraged by malicious actors fo
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Cron Job Created or Changed by Previously Unknown Process
+*Triage and analysis*
+
+
+
+*Investigating Cron Job Created or Changed by Previously Unknown Process*
+
 Linux cron jobs are scheduled tasks that run at specified intervals or times, managed by the cron daemon. 
 
 By creating or modifying cron job configurations, attackers can execute malicious commands or scripts at predefined intervals, ensuring their continued presence and enabling unauthorized activities.
@@ -59,10 +61,12 @@ By creating or modifying cron job configurations, attackers can execute maliciou
 This rule monitors the creation of previously unknown cron jobs by monitoring for file creation events in the most common cron job task location directories.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible Investigation Steps*
 
-#### Possible Investigation Steps
 
 - Investigate the cron job file that was created or modified.
 - Investigate whether any other files in any of the available cron job directories have been altered through OSQuery.
@@ -90,13 +94,17 @@ This rule monitors the creation of previously unknown cron jobs by monitoring fo
 - Investigate whether the user is currently logged in and active.
     - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator who uses cron jobs for administrative purposes, consider adding exceptions for this specific administrator user account. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Suspicious File Creation in /etc for Persistence - 1c84dd64-7e6c-4bad-ac73-a5014ee37042
 - Potential Persistence Through Run Control Detected - 0f4d35e4-925e-4959-ab24-911be207ee6f
@@ -104,7 +112,9 @@ This rule monitors the creation of previously unknown cron jobs by monitoring fo
 - New Systemd Timer Created - 7fb500fa-8e24-4bd1-9480-2a819352602c
 - New Systemd Service Created by Previously Unknown Process - 17b0a495-4d9f-414c-8ad0-92f018b8e001
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -119,7 +129,41 @@ This rule monitors the creation of previously unknown cron jobs by monitoring fo
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-error.asciidoc b/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-error.asciidoc
index 3b5e3a23a9..81ec894e42 100644
--- a/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-error.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-error.asciidoc
@@ -43,13 +43,17 @@ Identifies the occurrence of a CyberArk Privileged Access Security (PAS) error l
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
+
+*Triage and analysis*
+
 
 This is a promotion rule for CyberArk error events, which are alertable events per the vendor.
 Consult vendor documentation on interpreting specific events.
-----------------------------------
+
+==== Setup
+
+
+The CyberArk Privileged Access Security (PAS) Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-recommended-monitor.asciidoc b/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-recommended-monitor.asciidoc
index 77ab8d1406..301ecf129f 100644
--- a/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-recommended-monitor.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/cyberark-privileged-access-security-recommended-monitor.asciidoc
@@ -43,13 +43,17 @@ Identifies the occurrence of a CyberArk Privileged Access Security (PAS) non-err
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
+
+*Triage and analysis*
+
 
 This is a promotion rule for CyberArk events, which the vendor recommends should be monitored.
 Consult vendor documentation on interpreting specific events.
-----------------------------------
+
+==== Setup
+
+
+The CyberArk Privileged Access Security (PAS) Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/default-cobalt-strike-team-server-certificate.asciidoc b/docs/detections/prebuilt-rules/rule-details/default-cobalt-strike-team-server-certificate.asciidoc
index 43265bce43..1c67b0915e 100644
--- a/docs/detections/prebuilt-rules/rule-details/default-cobalt-strike-team-server-certificate.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/default-cobalt-strike-team-server-certificate.asciidoc
@@ -50,12 +50,11 @@ This rule detects the use of the default Cobalt Strike Team Server TLS certifica
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Threat intel
+
+*Threat intel*
+
 
 While Cobalt Strike is intended to be used for penetration tests and IR training, it is frequently used by actual threat actors (TA) such as APT19, APT29, APT32, APT41, FIN6, DarkHydrus, CopyKittens, Cobalt Group, Leviathan, and many other unnamed criminal TAs. This rule uses high-confidence atomic indicators, so alerts should be investigated rapidly.
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/delete-volume-usn-journal-with-fsutil.asciidoc b/docs/detections/prebuilt-rules/rule-details/delete-volume-usn-journal-with-fsutil.asciidoc
index 7941cef950..c2ad7a21a8 100644
--- a/docs/detections/prebuilt-rules/rule-details/delete-volume-usn-journal-with-fsutil.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/delete-volume-usn-journal-with-fsutil.asciidoc
@@ -47,11 +47,13 @@ Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Delete Volume USN Journal with Fsutil
+*Triage and analysis*
+
+
+
+*Investigating Delete Volume USN Journal with Fsutil*
+
 
 The Update Sequence Number (USN) Journal is a feature in the NTFS file system used by Microsoft Windows operating systems to keep track of changes made to files and directories on a disk volume. The journal records metadata for changes such as file creation, deletion, modification, and permission changes. It is used by the operating system for various purposes, including backup and recovery, file indexing, and file replication.
 
@@ -59,7 +61,9 @@ This artifact can provide valuable information in forensic analysis, such as pro
 
 Consider using the Elastic Defend integration instead of USN Journal, as the Elastic Defend integration provides more visibility and context in the file operations it records.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -68,11 +72,15 @@ Consider using the Elastic Defend integration instead of USN Journal, as the Ela
   - Verify if any other anti-forensics behaviors were observed.
 - Review file operation logs from Elastic Defend for suspicious activity the attacker tried to hide.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -81,7 +89,6 @@ Consider using the Elastic Defend integration instead of USN Journal, as the Ela
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/deleting-backup-catalogs-with-wbadmin.asciidoc b/docs/detections/prebuilt-rules/rule-details/deleting-backup-catalogs-with-wbadmin.asciidoc
index 3a2b06c883..b3cda04ef8 100644
--- a/docs/detections/prebuilt-rules/rule-details/deleting-backup-catalogs-with-wbadmin.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/deleting-backup-catalogs-with-wbadmin.asciidoc
@@ -47,17 +47,21 @@ Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and o
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Deleting Backup Catalogs with Wbadmin
+*Triage and analysis*
+
+
+
+*Investigating Deleting Backup Catalogs with Wbadmin*
+
 
 Windows Server Backup stores the details about your backups (what volumes are backed up and where the backups are located) in a file called a backup catalog, which ransomware victims can use to recover corrupted backup files. Deleting these files is a common step in threat actor playbooks.
 
 This rule identifies the deletion of the backup catalog using the `wbadmin.exe` utility.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -66,18 +70,24 @@ This rule identifies the deletion of the backup catalog using the `wbadmin.exe`
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 - Check if any files on the host machine have been encrypted.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Administrators can use this command to delete corrupted catalogs, but overall the activity is unlikely to be legitimate.
 
-### Related rules
+
+*Related rules*
+
 
 - Third-party Backup Files Deleted via Unexpected Process - 11ea6bec-ebde-4d71-a8e9-784948f8e3e9
 - Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921
 - Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4
 - Volume Shadow Copy Deletion via WMIC - dc9c1f74-dac3-48e3-b47f-eb79db358f57
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.
@@ -89,7 +99,17 @@ This rule identifies the deletion of the backup catalog using the `wbadmin.exe`
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
index 96f4750e33..85c1a74507 100644
--- a/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
@@ -42,18 +42,22 @@ Identifies unexpected processes making network connections over port 445. Window
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Direct Outbound SMB Connection
+*Triage and analysis*
+
+
+
+*Investigating Direct Outbound SMB Connection*
+
 
 This rule looks for unexpected processes making network connections over port 445. Windows file sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel (PID 4). Occurrences of non-system processes using this port can indicate port scanners, exploits, and tools used to move laterally on the environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -75,11 +79,15 @@ This rule looks for unexpected processes making network connections over port 44
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -93,7 +101,6 @@ This rule looks for unexpected processes making network connections over port 44
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
index e445897d51..9c5443e925 100644
--- a/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
@@ -52,17 +52,21 @@ Identifies attempts to disable EventLog via the logman Windows utility, PowerShe
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Disable Windows Event and Security Logs Using Built-in Tools
+*Triage and analysis*
+
+
+
+*Investigating Disable Windows Event and Security Logs Using Built-in Tools*
+
 
 Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.
 
 This rule looks for the usage of different utilities to disable the EventLog service or specific event logs.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -71,11 +75,15 @@ This rule looks for the usage of different utilities to disable the EventLog ser
   - Verify if any other anti-forensics behaviors were observed.
 - Investigate the event logs prior to the action for suspicious behaviors that an attacker may be trying to cover up.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -86,7 +94,17 @@ This rule looks for the usage of different utilities to disable the EventLog ser
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/disable-windows-firewall-rules-via-netsh.asciidoc b/docs/detections/prebuilt-rules/rule-details/disable-windows-firewall-rules-via-netsh.asciidoc
index 567332f70c..5e45278333 100644
--- a/docs/detections/prebuilt-rules/rule-details/disable-windows-firewall-rules-via-netsh.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/disable-windows-firewall-rules-via-netsh.asciidoc
@@ -47,11 +47,13 @@ Identifies use of the netsh.exe to disable or weaken the local firewall. Attacke
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Disable Windows Firewall Rules via Netsh
+*Triage and analysis*
+
+
+
+*Investigating Disable Windows Firewall Rules via Netsh*
+
 
 The Windows Defender Firewall is a native component which provides host-based, two-way network traffic filtering for a device, and blocks unauthorized network traffic flowing into or out of the local device.
 
@@ -59,19 +61,25 @@ Attackers can disable the Windows firewall or its rules to enable lateral moveme
 
 This rule identifies patterns related to disabling the Windows firewall or its rules using the `netsh.exe` utility.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the user to check if they are aware of the operation.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Check whether the user is an administrator and is legitimately performing troubleshooting.
 - In case of an allowed benign true positive (B-TP), assess adding rules to allow needed traffic and re-enable the firewall.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -80,7 +88,17 @@ This rule identifies patterns related to disabling the Windows firewall or its r
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/disabling-user-account-control-via-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/disabling-user-account-control-via-registry-modification.asciidoc
index 45cc0ed2a5..01ba87a833 100644
--- a/docs/detections/prebuilt-rules/rule-details/disabling-user-account-control-via-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/disabling-user-account-control-via-registry-modification.asciidoc
@@ -50,19 +50,23 @@ User Account Control (UAC) can help mitigate the impact of malware on Windows ho
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Disabling User Account Control via Registry Modification
+*Triage and analysis*
+
+
+
+*Investigating Disabling User Account Control via Registry Modification*
+
 
 Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.
 
-For more information about the UAC and how it works, check the [official Microsoft docs page](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works).
+For more information about the UAC and how it works, check the https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works[official Microsoft docs page].
 
 Attackers may disable UAC to execute code directly in high integrity. This rule identifies registry value changes to bypass the UAC protection.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -79,11 +83,15 @@ Attackers may disable UAC to execute code directly in high integrity. This rule
   - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -100,7 +108,17 @@ Attackers may disable UAC to execute code directly in high integrity. This rule
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc
index 9a36907e25..ce7fd9f083 100644
--- a/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc
@@ -49,17 +49,21 @@ Identifies use of the Set-MpPreference PowerShell command to disable or weaken c
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Disabling Windows Defender Security Settings via PowerShell
+*Triage and analysis*
+
+
+
+*Investigating Disabling Windows Defender Security Settings via PowerShell*
+
 
 Microsoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple environments. Disabling it is a common step in threat actor playbooks.
 
 This rule monitors the execution of commands that can tamper the Windows Defender antivirus features.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
@@ -68,16 +72,22 @@ This rule monitors the execution of commands that can tamper the Windows Defende
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Examine the command line to determine which action was executed. Based on that, examine exceptions, antivirus state, sample submission, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity, the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting), and no other suspicious activity has been observed.
 
-### Related rules
+
+*Related rules*
+
 
 - Windows Defender Disabled via Registry Modification - 2ffa1f1e-b6db-47fa-994b-1512743847eb
 - Microsoft Windows Defender Tampering - fe794edd-487f-4a90-b285-3ee54f2af2d3
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -89,7 +99,17 @@ This rule monitors the execution of commands that can tamper the Windows Defende
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/discovery-of-internet-capabilities-via-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/rule-details/discovery-of-internet-capabilities-via-built-in-tools.asciidoc
index 827a8afc22..dd2e2cf749 100644
--- a/docs/detections/prebuilt-rules/rule-details/discovery-of-internet-capabilities-via-built-in-tools.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/discovery-of-internet-capabilities-via-built-in-tools.asciidoc
@@ -30,7 +30,7 @@ Identifies the use of built-in tools attackers can use to check for Internet con
 * Rule Type: BBR
 * Data Source: Elastic Defend
 
-*Version*: 101
+*Version*: 102
 
 *Rule authors*: 
 
@@ -46,7 +46,7 @@ Identifies the use of built-in tools attackers can use to check for Internet con
 ----------------------------------
 host.os.type:windows and event.category:process and event.type:start and 
 process.name.caseless:("ping.exe" or "tracert.exe" or "pathping.exe") and
-not process.args:("127.0.0.1" or "0.0.0.0" or "localhost" or "1.1.1.1" or "1.2.3.4" or "::1")
+not process.args:("127.0.0.1" or "0.0.0.0" or "localhost" or "::1")
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/dns-over-https-enabled-via-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/dns-over-https-enabled-via-registry.asciidoc
index 358bc518c4..8b4b9749a3 100644
--- a/docs/detections/prebuilt-rules/rule-details/dns-over-https-enabled-via-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/dns-over-https-enabled-via-registry.asciidoc
@@ -45,6 +45,17 @@ Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/domain-added-to-google-workspace-trusted-domains.asciidoc b/docs/detections/prebuilt-rules/rule-details/domain-added-to-google-workspace-trusted-domains.asciidoc
index 55687c359d..8b92c2ec78 100644
--- a/docs/detections/prebuilt-rules/rule-details/domain-added-to-google-workspace-trusted-domains.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/domain-added-to-google-workspace-trusted-domains.asciidoc
@@ -44,11 +44,13 @@ Detects when a domain is added to the list of trusted Google Workspace domains.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Domain Added to Google Workspace Trusted Domains
+*Triage and analysis*
+
+
+
+*Investigating Domain Added to Google Workspace Trusted Domains*
+
 
 Organizations use trusted domains in Google Workspace to give external users access to resources.
 
@@ -56,7 +58,9 @@ A threat actor with administrative privileges may be able to add a malicious dom
 
 This rule detects when a third-party domain is added to the list of trusted domains in Google Workspace.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
 - After identifying the user, verify if the user should have administrative privileges to add external domains.
@@ -65,12 +69,16 @@ This rule detects when a third-party domain is added to the list of trusted doma
 - Filter your data. Create a filter where `event.dataset` is `google_workspace.drive` and `google_workspace.drive.file.owner.email` is being compared to `user.email`.
     - If mismatches are identified, this could indicate access from an external Google Workspace domain.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Verify that the user account should have administrative privileges that allow them to edit trusted domains in Google Workspace.
 - Talk to the user to evaluate why they added the third-party domain and if the domain has confidentiality risks.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -82,13 +90,15 @@ This rule detects when a third-party domain is added to the list of trusted doma
     - Identify any regulatory or legal ramifications related to this activity.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -96,7 +106,11 @@ This rule detects when a third-party domain is added to the list of trusted doma
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/dumping-account-hashes-via-built-in-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/dumping-account-hashes-via-built-in-commands.asciidoc
index 6e7bf05d70..201343c073 100644
--- a/docs/detections/prebuilt-rules/rule-details/dumping-account-hashes-via-built-in-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/dumping-account-hashes-via-built-in-commands.asciidoc
@@ -41,6 +41,41 @@ Identifies the execution of macOS built-in commands used to dump user account ha
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/dumping-of-keychain-content-via-security-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/dumping-of-keychain-content-via-security-command.asciidoc
index a07e5e9cdd..a7d33585a0 100644
--- a/docs/detections/prebuilt-rules/rule-details/dumping-of-keychain-content-via-security-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/dumping-of-keychain-content-via-security-command.asciidoc
@@ -40,6 +40,41 @@ Adversaries may dump the content of the keychain storage data from a system to a
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/dynamic-linker-copy.asciidoc b/docs/detections/prebuilt-rules/rule-details/dynamic-linker-copy.asciidoc
index 2dc8e6a542..c41f3ed748 100644
--- a/docs/detections/prebuilt-rules/rule-details/dynamic-linker-copy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/dynamic-linker-copy.asciidoc
@@ -44,11 +44,13 @@ Detects the copying of the Linux dynamic loader binary and subsequent file creat
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Dynamic Linker Copy
+*Triage and analysis*
+
+
+
+*Investigating Dynamic Linker Copy*
+
 
 The Linux dynamic linker is responsible for loading shared libraries required by executables at runtime. It is a critical component of the Linux operating system and should not be tampered with. 
 
@@ -57,10 +59,12 @@ Adversaries may attempt to copy the dynamic linker binary and create a backup co
 The detection rule 'Dynamic Linker Copy' is designed to identify such abuse by monitoring for processes with names "cp" or "rsync" that involve copying the dynamic linker binary ("/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2") and modifying the "/etc/ld.so.preload" file. Additionally, the rule checks for the creation of new files with the "so" extension on Linux systems. By detecting these activities within a short time span (1 minute), the rule aims to alert security analysts to potential malicious behavior.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Investigate the dynamic linker that was copied or altered.
   - !{osquery{"label":"Osquery - Retrieve File Listing Information","query":"SELECT * FROM file WHERE (\n  path = '/etc/ld.so.preload' OR\n  path = '/lib64/ld-linux-x86-64.so.2' OR\n  path = '/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2' OR\n  path = '/usr/lib64/ld-linux-x86-64.so.2' OR\n  path = '/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2'\n)\n"}}
@@ -86,20 +90,26 @@ The detection rule 'Dynamic Linker Copy' is designed to identify such abuse by m
 - Investigate whether the user is currently logged in and active.
     - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 - Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 - The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Modification of Dynamic Linker Preload Shared Object Inside A Container - 342f834b-21a6-41bf-878c-87d116eba3ee
 - Modification of Dynamic Linker Preload Shared Object - 717f82c2-7741-4f9b-85b8-d06aeb853f4f
 - Shared Object Created or Changed by Previously Unknown Process - aebaa51f-2a91-4f6a-850b-b601db2293f4
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -113,7 +123,41 @@ The detection rule 'Dynamic Linker Copy' is designed to identify such abuse by m
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/elastic-agent-service-terminated.asciidoc b/docs/detections/prebuilt-rules/rule-details/elastic-agent-service-terminated.asciidoc
index 370cf8146d..6127155e0d 100644
--- a/docs/detections/prebuilt-rules/rule-details/elastic-agent-service-terminated.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/elastic-agent-service-terminated.asciidoc
@@ -40,6 +40,17 @@ Identifies the Elastic endpoint agent has stopped and is no longer running on th
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/emond-rules-creation-or-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/emond-rules-creation-or-modification.asciidoc
index 89e8a444c8..a92edf9ce1 100644
--- a/docs/detections/prebuilt-rules/rule-details/emond-rules-creation-or-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/emond-rules-creation-or-modification.asciidoc
@@ -41,6 +41,41 @@ Identifies the creation or modification of the Event Monitor Daemon (emond) rule
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enable-host-network-discovery-via-netsh.asciidoc b/docs/detections/prebuilt-rules/rule-details/enable-host-network-discovery-via-netsh.asciidoc
index ee56aa1d20..60c4083e98 100644
--- a/docs/detections/prebuilt-rules/rule-details/enable-host-network-discovery-via-netsh.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enable-host-network-discovery-via-netsh.asciidoc
@@ -46,17 +46,21 @@ Identifies use of the netsh.exe program to enable host discovery via the network
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Enable Host Network Discovery via Netsh
+*Triage and analysis*
+
+
+
+*Investigating Enable Host Network Discovery via Netsh*
+
 
 The Windows Defender Firewall is a native component that provides host-based, two-way network traffic filtering for a device and blocks unauthorized network traffic flowing into or out of the local device.
 
 Attackers can enable Network Discovery on the Windows firewall to find other systems present in the same network. Systems with this setting enabled will communicate with other systems using broadcast messages, which can be used to identify targets for lateral movement. This rule looks for the setup of this setting using the netsh utility.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -64,11 +68,15 @@ Attackers can enable Network Discovery on the Windows firewall to find other sys
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Analysts can dismiss the alert if the Administrator is aware of the activity and there are justifications for this configuration.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -80,7 +88,17 @@ Attackers can enable Network Discovery on the Windows firewall to find other sys
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc b/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc
index f65076ae78..17c40b670a 100644
--- a/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc
@@ -48,17 +48,21 @@ Identifies use of WinRar or 7z to create an encrypted files. Adversaries will of
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Encrypting Files with WinRar or 7z
+*Triage and analysis*
+
+
+
+*Investigating Encrypting Files with WinRar or 7z*
+
 
 Attackers may compress and/or encrypt data collected before exfiltration. Compressing the data can help obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less apparent upon inspection by a defender.
 
 These steps are usually done in preparation for exfiltration, meaning the attack may be in its final stages.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Retrieve the encrypted file.
@@ -68,11 +72,15 @@ These steps are usually done in preparation for exfiltration, meaning the attack
 - If the password is not available, and the format is `.zip` or the option used in WinRAR is not the `-hp`, list the file names included in the encrypted file.
 - Investigate if the file was transferred to an attacker-controlled server.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Backup software can use these utilities. Check the `process.parent.executable` and `process.parent.command_line` fields to determine what triggered the encryption.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Prioritize cases that involve personally identifiable information (PII) or other classified data.
@@ -84,7 +92,17 @@ These steps are usually done in preparation for exfiltration, meaning the attack
 
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-dsquery-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-dsquery-exe.asciidoc
index b328ce4b42..935295d2d0 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-dsquery-exe.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-dsquery-exe.asciidoc
@@ -50,31 +50,41 @@ Identifies the use of dsquery.exe for domain trust discovery purposes. Adversari
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Enumerating Domain Trusts via DSQUERY.EXE
+*Triage and analysis*
+
+
+
+*Investigating Enumerating Domain Trusts via DSQUERY.EXE*
+
 
 Active Directory (AD) domain trusts define relationships between domains within a Windows AD environment. In this setup, a "trusting" domain permits users from a "trusted" domain to access resources. These trust relationships can be configurable as one-way, two-way, transitive, or non-transitive, enabling controlled access and resource sharing across domains.
 
 This rule identifies the usage of the `dsquery.exe` utility to enumerate domain trusts. Attackers can use this information to enable the next actions in a target environment, such as lateral movement.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities are not inherently malicious if they occur in isolation and are done within the user business context (e.g., an administrator in this context). As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
-### Related rules
+
+*Related rules*
+
 
 - Enumerating Domain Trusts via NLTEST.EXE - 84da2554-e12a-11ec-b896-f661ea17fbcd
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -83,7 +93,6 @@ This rule identifies the usage of the `dsquery.exe` utility to enumerate domain
 - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest-exe.asciidoc
index b2a88968a6..d53bcd677c 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest-exe.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest-exe.asciidoc
@@ -50,31 +50,41 @@ Identifies the use of nltest.exe for domain trust discovery purposes. Adversarie
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Enumerating Domain Trusts via NLTEST.EXE
+*Triage and analysis*
+
+
+
+*Investigating Enumerating Domain Trusts via NLTEST.EXE*
+
 
 Active Directory (AD) domain trusts define relationships between domains within a Windows AD environment. In this setup, a "trusting" domain permits users from a "trusted" domain to access resources. These trust relationships can be configurable as one-way, two-way, transitive, or non-transitive, enabling controlled access and resource sharing across domains.
 
 This rule identifies the usage of the `nltest.exe` utility to enumerate domain trusts. Attackers can use this information to enable the next actions in a target environment, such as lateral movement.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities are not inherently malicious if they occur in isolation and are done within the user business context (e.g., an administrator in this context). As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
-### Related rules
+
+*Related rules*
+
 
 - Enumerating Domain Trusts via DSQUERY.EXE - 06a7a03c-c735-47a6-a313-51c354aef6c3
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -83,7 +93,6 @@ This rule identifies the usage of the `nltest.exe` utility to enumerate domain t
 - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-command-spawned-via-wmiprvse.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-command-spawned-via-wmiprvse.asciidoc
index 1208161295..ae65116427 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-command-spawned-via-wmiprvse.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-command-spawned-via-wmiprvse.asciidoc
@@ -43,6 +43,17 @@ Identifies native Windows host and network enumeration commands spawned by the W
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-administrator-accounts.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-administrator-accounts.asciidoc
index 5574aa8c96..1b4536b9b5 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-administrator-accounts.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-administrator-accounts.asciidoc
@@ -47,32 +47,42 @@ Identifies instances of lower privilege accounts enumerating Administrator accou
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Enumeration of Administrator Accounts
+*Triage and analysis*
+
+
+
+*Investigating Enumeration of Administrator Accounts*
+
 
 After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
 This rule looks for the execution of the `net` and `wmic` utilities to enumerate administrator-related users or groups in the domain and local machine scope. Attackers can use this information to plan their next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
-### Related rules
+
+*Related rules*
+
 
 - AdFind Command Activity - eda499b8-a073-4e35-9733-22ec71f57f3a
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -82,7 +92,17 @@ This rule looks for the execution of the `net` and `wmic` utilities to enumerate
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules-via-proc.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules-via-proc.asciidoc
index 74d8b276ac..c6c43fb6eb 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules-via-proc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules-via-proc.asciidoc
@@ -24,12 +24,13 @@ Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unlo
 
 *Tags*: 
 
+* Data Source: Auditd Manager
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Discovery
 * Rule Type: BBR
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
@@ -38,6 +39,26 @@ Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unlo
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.
+```
+Kibana -->
+Management -->
+Integrations -->
+Auditd Manager -->
+Add Auditd Manager
+```
+`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+For this detection rule to trigger, the following additional audit rules are required to be added to the integration:
+```
+-w /proc/ -p r -k audit_proc
+```
+Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules.asciidoc
index 93113594d7..9d45e5197d 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-kernel-modules.asciidoc
@@ -38,6 +38,41 @@ Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unlo
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
index 126558f510..ecde7e6b95 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
@@ -43,20 +43,24 @@ Identifies instances of an unusual process enumerating built-in Windows privileg
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Enumeration of Privileged Local Groups Membership
+*Triage and analysis*
+
+
+
+*Investigating Enumeration of Privileged Local Groups Membership*
+
 
 After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
 This rule looks for the enumeration of privileged local groups' membership by suspicious processes, and excludes known legitimate utilities and programs installed. Attackers can use this information to decide the next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify the process, host and user involved on the event.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -77,12 +81,16 @@ This rule looks for the enumeration of privileged local groups' membership by su
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -92,7 +100,33 @@ This rule looks for the enumeration of privileged local groups' membership by su
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'Audit Security Group Management' audit policy must be configured (Success).
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+Account Management >
+Audit Security Group Management (Success)
+```
+
+Microsoft introduced the https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4799[event used] in this detection rule on Windows 10 and Windows Server 2016 or later operating systems.
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-users-or-groups-via-built-in-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-users-or-groups-via-built-in-commands.asciidoc
index 4dbe25bc90..e0af26fd1a 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-users-or-groups-via-built-in-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-users-or-groups-via-built-in-commands.asciidoc
@@ -38,6 +38,41 @@ Identifies the execution of macOS built-in commands related to account or group
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-find.asciidoc b/docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-find.asciidoc
index e78a2e5b10..e409f5c30d 100644
--- a/docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-find.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-find.asciidoc
@@ -40,6 +40,41 @@ Identifies instances where the 'find' command is started on a Linux system with
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-grep.asciidoc b/docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-grep.asciidoc
index 9a10db4a18..480cacb367 100644
--- a/docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-grep.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/esxi-discovery-via-grep.asciidoc
@@ -40,6 +40,41 @@ Identifies instances where a process named 'grep', 'egrep', or 'pgrep' is starte
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/esxi-timestomping-using-touch-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/esxi-timestomping-using-touch-command.asciidoc
index 4a407cda00..532229f2ba 100644
--- a/docs/detections/prebuilt-rules/rule-details/esxi-timestomping-using-touch-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/esxi-timestomping-using-touch-command.asciidoc
@@ -8,6 +8,9 @@ Identifies instances where the 'touch' command is executed on a Linux system wit
 *Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
 
 *Severity*: medium
 
@@ -29,9 +32,11 @@ Identifies instances where the 'touch' command is executed on a Linux system wit
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 * Data Source: Elastic Defend
+* Data Source: Auditd Manager
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -40,13 +45,48 @@ Identifies instances where the 'touch' command is executed on a Linux system wit
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
-process.name : "touch" and process.args : "-r" and process.args : ("/etc/vmware/*", "/usr/lib/vmware/*", "/vmfs/*")
+process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "executed")
+and process.name : "touch" and process.args : "-r" and process.args : ("/etc/vmware/*", "/usr/lib/vmware/*", "/vmfs/*")
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc
index b046cb1f6e..6405144658 100644
--- a/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc
@@ -47,16 +47,20 @@ Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest,
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Exchange Mailbox Export via PowerShell
+*Triage and analysis*
+
+
+
+*Investigating Exchange Mailbox Export via PowerShell*
+
 
 The `New-MailBoxExportRequest` cmdlet is used to begin the process of exporting contents of a primary mailbox or archive to a .pst file. Note that this is done on a per-mailbox basis and this cmdlet is available only in on-premises Exchange.
 Attackers can abuse this functionality in preparation for exfiltrating contents, which is likely to contain sensitive and strategic data.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -71,11 +75,15 @@ Attackers can abuse this functionality in preparation for exfiltrating contents,
   - Check if the file is on the path specified in the command.
   - Investigate if the file was compressed, archived, or retrieved by the attacker for exfiltration.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.
@@ -87,7 +95,6 @@ Attackers can abuse this functionality in preparation for exfiltrating contents,
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/executable-file-creation-with-multiple-extensions.asciidoc b/docs/detections/prebuilt-rules/rule-details/executable-file-creation-with-multiple-extensions.asciidoc
index a51363b7ea..ae8228ee89 100644
--- a/docs/detections/prebuilt-rules/rule-details/executable-file-creation-with-multiple-extensions.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/executable-file-creation-with-multiple-extensions.asciidoc
@@ -42,6 +42,17 @@ Masquerading can allow an adversary to evade defenses and better blend in with t
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/executable-masquerading-as-kernel-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/executable-masquerading-as-kernel-process.asciidoc
index 7979b2f45d..32a234c4d2 100644
--- a/docs/detections/prebuilt-rules/rule-details/executable-masquerading-as-kernel-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/executable-masquerading-as-kernel-process.asciidoc
@@ -42,6 +42,41 @@ Monitors for kernel processes with associated process executable fields that are
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-from-a-removable-media-with-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-from-a-removable-media-with-network-connection.asciidoc
index 0e11fc74b6..6f858e686c 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-from-a-removable-media-with-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-from-a-removable-media-with-network-connection.asciidoc
@@ -27,10 +27,9 @@ Identifies process execution from a removable media and by an unusual process. A
 * OS: Windows
 * Use Case: Threat Detection
 * Tactic: Initial Access
-* Rule Type: BBR
 * Data Source: Elastic Defend
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
index da9f68a2a6..47bbd374dc 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
@@ -48,18 +48,22 @@ Identifies process execution from suspicious default Windows directories. This m
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Execution from Unusual Directory - Command Line
+*Triage and analysis*
+
+
+
+*Investigating Execution from Unusual Directory - Command Line*
+
 
 This rule looks for the execution of scripts from unusual directories. Attackers can use system or application paths to hide malware and make the execution less suspicious.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -79,15 +83,21 @@ This rule looks for the execution of scripts from unusual directories. Attackers
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of parent process executable and command line conditions.
 
-### Related rules
+
+*Related rules*
+
 
 - Process Execution from an Unusual Directory - ebfe1448-7fac-4d59-acea-181bd89b1f7f
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -102,7 +112,17 @@ This rule looks for the execution of scripts from unusual directories. Attackers
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-of-an-unsigned-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-of-an-unsigned-service.asciidoc
index 397c3b3b16..cbd2370624 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-of-an-unsigned-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-of-an-unsigned-service.asciidoc
@@ -31,7 +31,7 @@ This rule identifies the execution of unsigned executables via service control m
 * Rule Type: BBR
 * Data Source: Elastic Defend
 
-*Version*: 103
+*Version*: 104
 
 *Rule authors*: 
 
@@ -47,7 +47,8 @@ This rule identifies the execution of unsigned executables via service control m
 ----------------------------------
 host.os.type:windows and event.category:process and event.type:start and 
 process.parent.executable:"C:\\Windows\\System32\\services.exe" and 
-(process.code_signature.exists:false or process.code_signature.trusted:false)
+(process.code_signature.exists:false or process.code_signature.trusted:false) and
+not process.code_signature.status : (errorCode_endpoint* or "errorChaining")
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-of-com-object-via-xwizard.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-of-com-object-via-xwizard.asciidoc
index ce57d322e4..eb39c11022 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-of-com-object-via-xwizard.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-of-com-object-via-xwizard.asciidoc
@@ -45,6 +45,17 @@ Windows Component Object Model (COM) is an inter-process communication (IPC) com
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-microsoft-office.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-microsoft-office.asciidoc
index 50bc486b2d..57c8508a97 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-microsoft-office.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-microsoft-office.asciidoc
@@ -46,17 +46,21 @@ Identifies an executable created by a Microsoft Office application and subsequen
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Execution of File Written or Modified by Microsoft Office
+*Triage and analysis*
+
+
+
+*Investigating Execution of File Written or Modified by Microsoft Office*
+
 
 Microsoft Office, a widely used suite of productivity applications, is frequently targeted by attackers due to its popularity in corporate environments. Attackers exploit its extensive capabilities, like macro scripts in Word and Excel, to gain initial access to systems. They often use Office documents as delivery mechanisms for malware or phishing attempts, taking advantage of their trusted status in professional settings.
 
 This rule searches for executable files written by MS Office applications executed in sequence. This is most likely the result of the execution of malicious documents or exploitation for initial access or privilege escalation. This rule can also detect suspicious processes masquerading as the MS Office applications.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -71,11 +75,15 @@ This rule searches for executable files written by MS Office applications execut
   - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -95,7 +103,6 @@ This rule searches for executable files written by MS Office applications execut
     - Consider improvements to the security awareness program.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-pdf-reader.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-pdf-reader.asciidoc
index 9c6ea43dd3..ada1e65678 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-pdf-reader.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-of-file-written-or-modified-by-pdf-reader.asciidoc
@@ -46,17 +46,21 @@ Identifies a suspicious file that was written by a PDF reader application and su
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Execution of File Written or Modified by PDF Reader
+*Triage and analysis*
+
+
+
+*Investigating Execution of File Written or Modified by PDF Reader*
+
 
 PDF is a common file type used in corporate environments and most machines have software to handle these files. This creates a vector where attackers can exploit the engines and technology behind this class of software for initial access or privilege escalation.
 
 This rule searches for executable files written by PDF reader software and executed in sequence. This is most likely the result of exploitation for privilege escalation or initial access. This rule can also detect suspicious processes masquerading as PDF readers.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -71,11 +75,15 @@ This rule searches for executable files written by PDF reader software and execu
   - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -95,7 +103,6 @@ This rule searches for executable files written by PDF reader software and execu
     - Consider improvements to the security awareness program.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node-js-module.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node-js-module.asciidoc
index 267f6da361..acc2e82f48 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node-js-module.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-electron-child-process-node-js-module.asciidoc
@@ -43,6 +43,41 @@ Identifies attempts to execute a child process from within the context of an Ele
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-local-sxs-shared-module.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-local-sxs-shared-module.asciidoc
index 056f51fcf7..f34a8b804e 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-via-local-sxs-shared-module.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-local-sxs-shared-module.asciidoc
@@ -47,14 +47,24 @@ Identifies the creation, change, or deletion of a DLL module within a Windows Sx
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
+
+*Triage and analysis*
+
 
 The SxS DotLocal folder is a legitimate feature that can be abused to hijack standard modules loading order by forcing an executable on the same application.exe.local folder to load a malicious DLL module from the same directory.
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
index 603bfd8fd8..0f021b7048 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
@@ -49,17 +49,21 @@ Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Execution via MSSQL xp_cmdshell Stored Procedure
+*Triage and analysis*
+
+
+
+*Investigating Execution via MSSQL xp_cmdshell Stored Procedure*
+
 
 Microsoft SQL Server (MSSQL) has procedures meant to extend its functionality, the Extended Stored Procedures. These procedures are external functions written in C/C++; some provide interfaces for external programs. This is the case for xp_cmdshell, which spawns a Windows command shell and passes in a string for execution. Attackers can use this to execute commands on the system running the SQL server, commonly to escalate their privileges and establish persistence.
 
 The xp_cmdshell procedure is disabled by default, but when used, it has the same security context as the MSSQL Server service account, which is often privileged.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -68,11 +72,15 @@ The xp_cmdshell procedure is disabled by default, but when used, it has the same
 - Examine the command line to determine if the command executed is potentially harmful or malicious.
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately, but it brings inherent risk. The security team must monitor any activity of it. If recurrent tasks are being executed using this mechanism, consider adding exceptions — preferably with a full command line.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -85,7 +93,17 @@ The xp_cmdshell procedure is disabled by default, but when used, it has the same
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-tsclient-mountpoint.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-tsclient-mountpoint.asciidoc
index fca7d51732..bbcc39a5aa 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-via-tsclient-mountpoint.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-tsclient-mountpoint.asciidoc
@@ -44,6 +44,17 @@ Identifies execution from the Remote Desktop Protocol (RDP) shared mountpoint ts
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-with-explicit-credentials-via-scripting.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-with-explicit-credentials-via-scripting.asciidoc
index cac7f21a4c..19686ed85e 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-with-explicit-credentials-via-scripting.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-with-explicit-credentials-via-scripting.asciidoc
@@ -42,6 +42,41 @@ Identifies execution of the security_authtrampoline process via a scripting inte
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/exporting-exchange-mailbox-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/exporting-exchange-mailbox-via-powershell.asciidoc
index 5bf72b323c..d38447c85d 100644
--- a/docs/detections/prebuilt-rules/rule-details/exporting-exchange-mailbox-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/exporting-exchange-mailbox-via-powershell.asciidoc
@@ -50,11 +50,13 @@ Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest,
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Exporting Exchange Mailbox via PowerShell
+*Triage and analysis*
+
+
+
+*Investigating Exporting Exchange Mailbox via PowerShell*
+
 
 Email mailboxes and their information can be valuable assets for attackers. Company mailboxes often contain sensitive information such as login credentials, intellectual property, financial data, and personal information, making them high-value targets for malicious actors.
 
@@ -62,7 +64,9 @@ The `New-MailBoxExportRequest` cmdlet is used to begin the process of exporting
 
 Attackers can abuse this functionality in preparation for exfiltrating contents, which is likely to contain sensitive and strategic data.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -77,11 +81,15 @@ Attackers can abuse this functionality in preparation for exfiltrating contents,
   - Check if the file is on the path specified in the command.
   - Investigate if the file was compressed, archived, or retrieved by the attacker for exfiltration.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.
@@ -94,7 +102,17 @@ Attackers can abuse this functionality in preparation for exfiltrating contents,
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/external-ip-lookup-from-non-browser-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/external-ip-lookup-from-non-browser-process.asciidoc
index 6dc52cd04b..2d6d5e95c5 100644
--- a/docs/detections/prebuilt-rules/rule-details/external-ip-lookup-from-non-browser-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/external-ip-lookup-from-non-browser-process.asciidoc
@@ -46,17 +46,21 @@ Identifies domains commonly used by adversaries for post-exploitation IP lookups
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating External IP Lookup from Non-Browser Process
+*Triage and analysis*
+
+
+
+*Investigating External IP Lookup from Non-Browser Process*
+
 
 After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
 This rule looks for connections to known IP lookup services through non-browser processes or non-installed programs. Using only the IP address of the compromised system, attackers can obtain valuable information such as the system's geographic location, the company that owns the IP, whether the system is cloud-hosted, and more.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -64,12 +68,16 @@ This rule looks for connections to known IP lookup services through non-browser
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -79,7 +87,6 @@ This rule looks for connections to known IP lookup services through non-browser
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/external-user-added-to-google-workspace-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/external-user-added-to-google-workspace-group.asciidoc
index 2c39b4437b..c1f92def32 100644
--- a/docs/detections/prebuilt-rules/rule-details/external-user-added-to-google-workspace-group.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/external-user-added-to-google-workspace-group.asciidoc
@@ -44,11 +44,13 @@ Detects an external Google Workspace user account being added to an existing gro
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating External User Added to Google Workspace Group
+*Triage and analysis*
+
+
+
+*Investigating External User Added to Google Workspace Group*
+
 
 Google Workspace groups allow organizations to assign specific users to a group that can share resources. Application specific roles can be manually set for each group, but if not inherit permissions from the top-level organizational unit.
 
@@ -56,7 +58,9 @@ Threat actors may use phishing techniques and container-bound scripts to add ext
 
 This rule identifies when an external user account is added to an organization's groups where the domain name of the target does not match the Google Workspace domain.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 - Identify user account(s) associated by reviewing `user.name` or `user.email` in the alert
   - The `user.target.email` field contains the user added to the groups
   - The `group.name` field contains the group the target user was added to
@@ -68,12 +72,16 @@ This rule identifies when an external user account is added to an organization's
 - Review Gmail logs where emails were sent to and from the `group.name` value
   - This may indicate potential internal spearphishing
 
-### False positive analysis
+
+*False positive analysis*
+
 - With the user account whom added the new user, verify this action was intentional
 - Verify that the target whom was added to the group is expected to have access to the organization's resources and data
 - If other members have been added to groups that are external, this may indicate historically that this action is expected
 
-### Response and remediation
+
+*Response and remediation*
+
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
 - Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
@@ -85,13 +93,15 @@ This rule identifies when an external user account is added to an organization's
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Reactivate multi-factor authentication for the user.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security defaults [provided by Google](https://cloud.google.com/security-command-center/docs/how-to-investigate-threats).
+- Implement security defaults https://cloud.google.com/security-command-center/docs/how-to-investigate-threats[provided by Google].
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -99,7 +109,11 @@ This rule identifies when an external user account is added to an organization's
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/file-creation-execution-and-self-deletion-in-suspicious-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/file-creation-execution-and-self-deletion-in-suspicious-directory.asciidoc
index df12059236..8242efd16a 100644
--- a/docs/detections/prebuilt-rules/rule-details/file-creation-execution-and-self-deletion-in-suspicious-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/file-creation-execution-and-self-deletion-in-suspicious-directory.asciidoc
@@ -38,6 +38,41 @@ This rule monitors for the creation of a file, followed by its execution and sel
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/file-deletion-via-shred.asciidoc b/docs/detections/prebuilt-rules/rule-details/file-deletion-via-shred.asciidoc
index 07501b3d05..a7280ee735 100644
--- a/docs/detections/prebuilt-rules/rule-details/file-deletion-via-shred.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/file-deletion-via-shred.asciidoc
@@ -3,11 +3,12 @@
 
 Malware or other files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process.
 
-*Rule type*: query
+*Rule type*: eql
 
 *Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: low
 
@@ -28,8 +29,9 @@ Malware or other files dropped or created on a system by an adversary may leave
 * Use Case: Threat Detection
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
+* Data Source: Elastic Endgame
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
@@ -38,13 +40,49 @@ Malware or other files dropped or created on a system by an adversary may leave
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-event.category:process and host.os.type:linux and event.type:start and process.name:shred and
-process.args:("-u" or "--remove" or "-z" or "--zero") and not process.parent.name:logrotate
+process where host.os.type == "linux" and event.type == "start" and process.name == "shred" and process.args in (
+  "-u", "--remove", "-z", "--zero"
+) and not process.parent.name == "logrotate"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc b/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc
index 41cd68043e..7c1b870733 100644
--- a/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc
@@ -41,6 +41,62 @@ Detects a file being made immutable using the chattr binary. Making a file immut
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Custom Ingest Pipeline*
+
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html[guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/file-permission-modification-in-writable-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/file-permission-modification-in-writable-directory.asciidoc
index 1f854efa95..b170b66fbc 100644
--- a/docs/detections/prebuilt-rules/rule-details/file-permission-modification-in-writable-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/file-permission-modification-in-writable-directory.asciidoc
@@ -7,7 +7,6 @@ Identifies file permission modifications in common writable directories by a non
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 
 *Severity*: low
@@ -30,7 +29,7 @@ Identifies file permission modifications in common writable directories by a non
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 208
+*Version*: 209
 
 *Rule authors*: 
 
@@ -39,15 +38,65 @@ Identifies file permission modifications in common writable directories by a non
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
 host.os.type:linux and event.category:process and event.type:start and
-process.name:((chattr or chgrp or chmod or chown) and
-not (apt-key or update-motd-updates-available)) and
-process.working_directory:(/dev/shm or /tmp or /var/tmp)
+process.name:(chattr or chgrp or chmod or chown) and process.working_directory:(/dev/shm or /tmp or /var/tmp) and
+not process.parent.name:(apt-key or update-motd-updates-available)
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/file-transfer-or-listener-established-via-netcat.asciidoc b/docs/detections/prebuilt-rules/rule-details/file-transfer-or-listener-established-via-netcat.asciidoc
index 0f945a6ef2..eebd9adbb6 100644
--- a/docs/detections/prebuilt-rules/rule-details/file-transfer-or-listener-established-via-netcat.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/file-transfer-or-listener-established-via-netcat.asciidoc
@@ -50,11 +50,13 @@ A netcat process is engaging in network activity on a Linux host. Netcat is ofte
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Netcat Network Activity
+*Triage and analysis*
+
+
+
+*Investigating Netcat Network Activity*
+
 
 Netcat is a dual-use command line tool that can be used for various purposes, such as port scanning, file transfers, and connection tests. Attackers can abuse its functionality for malicious purposes such creating bind shells or reverse shells to gain access to the target system.
 
@@ -64,7 +66,9 @@ A bind shell is a type of backdoor that attackers set up on the target host and
 
 This rule identifies potential reverse shell or bind shell activity using Netcat by checking for the execution of Netcat followed by a network connection.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the command line to identify if the command is suspicious.
 - Extract and examine the target domain or IP address.
@@ -75,11 +79,15 @@ This rule identifies potential reverse shell or bind shell activity using Netcat
 - Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 - Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Netcat is a dual-use tool that can be used for benign or malicious activity. It is included in some Linux distributions, so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may originate from scripts, automation tools, and frameworks.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -91,7 +99,57 @@ This rule identifies potential reverse shell or bind shell activity using Netcat
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/file-with-suspicious-extension-downloaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/file-with-suspicious-extension-downloaded.asciidoc
index b5f5a57ff4..839ca6fe3c 100644
--- a/docs/detections/prebuilt-rules/rule-details/file-with-suspicious-extension-downloaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/file-with-suspicious-extension-downloaded.asciidoc
@@ -33,7 +33,7 @@ Identifies unusual files downloaded from outside the local network that have the
 * Data Source: Elastic Defend
 * Rule Type: BBR
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -54,7 +54,11 @@ file where host.os.type == "windows" and event.type == "creation" and
   ) and file.Ext.windows.zone_identifier > 1 and
   not
   (
-    file.extension : "msix" and file.path : "?:\\Users\\*\\AppData\\Local\\Temp\\WinGet\\Microsoft.Winget.Source*"
+    file.extension : "msix" and 
+    file.path : (
+      "?:\\Users\\*\\AppData\\Local\\Temp\\WinGet\\Microsoft.Winget.Source*",
+      "?:\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\WinGet\\State\\defaultState\\Microsoft.PreIndexed.Package\\Microsoft.Winget.Source*"
+    )
   )
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/finder-sync-plugin-registered-and-enabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/finder-sync-plugin-registered-and-enabled.asciidoc
index 7714029b55..2bf3f0fecc 100644
--- a/docs/detections/prebuilt-rules/rule-details/finder-sync-plugin-registered-and-enabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/finder-sync-plugin-registered-and-enabled.asciidoc
@@ -40,6 +40,41 @@ Finder Sync plugins enable users to extend Finder’s functionality by modifying
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-occurrence-of-okta-user-session-started-via-proxy.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-occurrence-of-okta-user-session-started-via-proxy.asciidoc
index c42e1e4e1b..21dac0d0e4 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-occurrence-of-okta-user-session-started-via-proxy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-occurrence-of-okta-user-session-started-via-proxy.asciidoc
@@ -46,15 +46,19 @@ Identifies the first occurrence of an Okta user session started via a proxy.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating First Occurrence of Okta User Session Started via Proxy
+*Triage and analysis*
+
+
+
+*Investigating First Occurrence of Okta User Session Started via Proxy*
+
 
 This rule detects the first occurrence of an Okta user session started via a proxy. This rule is designed to help identify suspicious authentication behavior that may be indicative of an attacker attempting to gain access to an Okta account while remaining anonymous. This rule leverages the New Terms rule type feature where the `okta.actor.id` value is checked against the previous 7 days of data to determine if the value has been seen before for this activity.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 - Identify the user involved in this action by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
 - Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
 - Examine the `okta.debug_context.debug_data.flattened` field for more information about the proxy used.
@@ -62,10 +66,14 @@ This rule detects the first occurrence of an Okta user session started via a pro
 - Review the past activities of the actor involved in this action by checking their previous actions.
 - Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 - A user may have legitimately started a session via a proxy for security or privacy reasons.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 - Review the profile of the user involved in this action to determine if proxy usage may be expected.
 - If the user is legitimate and the authentication behavior is not suspicious, no action is required.
 - If the user is legitimate but the authentication behavior is suspicious, consider resetting the user's password and enabling multi-factor authentication (MFA).
@@ -73,8 +81,14 @@ This rule detects the first occurrence of an Okta user session started via a pro
 - If the user is not legitimate, consider deactivating the user's account.
 - Conduct a review of Okta policies and ensure they are in accordance with security best practices.
 
-## Setup
-----------------------------------
+
+*Setup*
+
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
index bf58ea2539..59b4fd0db8 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
@@ -46,17 +46,21 @@ An adversary equipped with compromised credentials may attempt to access the sec
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating First Time Seen AWS Secret Value Accessed in Secrets Manager
+*Triage and analysis*
+
+
+
+*Investigating First Time Seen AWS Secret Value Accessed in Secrets Manager*
+
 
 AWS Secrets Manager is a service that enables the replacement of hardcoded credentials in code, including passwords, with an API call to Secrets Manager to retrieve the secret programmatically.
 
-This rule looks for the retrieval of credentials using `GetSecretValue` action in Secrets Manager programmatically. This is a {security-guide}/security/master/rules-ui-create.html#create-new-terms-rule[New Terms] rule indicating this is the first time a specific user identity has successfuly retrieved a secret value from Secrets Manager.
+This rule looks for the retrieval of credentials using `GetSecretValue` action in Secrets Manager programmatically. This is a https://www.elastic.co/guide/en/security/master/rules-ui-create.html#create-new-terms-rule[New Terms] rule indicating this is the first time a specific user identity has successfuly retrieved a secret value from Secrets Manager.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify the account and its role in the environment, and inspect the related policy.
 - Identify the applications that should use this account.
@@ -72,11 +76,15 @@ This rule looks for the retrieval of credentials using `GetSecretValue` action i
 - Examine the request parameters. These might indicate the source of the program or the nature of its tasks.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - False positives may occur due to the intended usage of the service. Tuning is needed in order to have higher confidence. Consider adding exceptions — preferably with a combination of user agent and IP address conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -90,11 +98,15 @@ This rule looks for the retrieval of credentials using `GetSecretValue` action i
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
index 23d85e53d5..22335b7994 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
@@ -47,11 +47,13 @@ Adversaries may install legitimate remote access tools (RAT) to compromised endp
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating First Time Seen Commonly Abused Remote Access Tool Execution
+*Triage and analysis*
+
+
+
+*Investigating First Time Seen Commonly Abused Remote Access Tool Execution*
+
 
 Remote access software is a class of tools commonly used by IT departments to provide support by connecting securely to users' computers. Remote access is an ever-growing market where new companies constantly offer new ways of quickly accessing remote systems.
 
@@ -59,7 +61,9 @@ At the same pace as IT departments adopt these tools, the attackers also adopt t
 
 This rule detects when a remote access tool is seen in the environment for the first time in the last 15 days, enabling analysts to investigate and enforce the correct usage of such tools.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Check if the execution of the remote access tool is approved by the organization's IT department.
@@ -68,11 +72,15 @@ This rule detects when a remote access tool is seen in the environment for the f
   - If the tool is not approved for use in the organization, the employee could have been tricked into installing it and providing access to a malicious third party. Investigate whether this third party could be attempting to scam the end-user or gain access to the environment through social engineering.
 - Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If an authorized support person or administrator used the tool to conduct legitimate support or remote access, consider reinforcing that only tooling approved by the IT policy should be used. The analyst can dismiss the alert if no other suspicious behavior is observed involving the host or users.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -82,7 +90,6 @@ This rule detects when a remote access tool is seen in the environment for the f
 - Enforce that only tooling approved by the IT policy should be used for remote access purposes and only by authorized staff.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
index 995a424d7f..186364fdda 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
@@ -45,24 +45,28 @@ Identifies the load of a driver with an original file name and signature values
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating First Time Seen Driver Loaded
+*Triage and analysis*
+
+
+
+*Investigating First Time Seen Driver Loaded*
+
 
 A driver is a software component that allows the operating system to communicate with hardware devices. It works at a high privilege level, the kernel level, having high control over the system's security and stability.
 
 Attackers may exploit known good but vulnerable drivers to execute code in their context because once an attacker can execute code in the kernel, security tools can no longer effectively protect the host. They can leverage these drivers to tamper, bypass and terminate security software, elevate privileges, create persistence mechanisms, and disable operating system protections and monitoring features. Attackers were seen in the wild conducting these actions before acting on their objectives, such as ransomware.
 
-Read the complete research on "Stopping Vulnerable Driver Attacks" done by Elastic Security Labs [here](https://www.elastic.co/kr/security-labs/stopping-vulnerable-driver-attacks).
+Read the complete research on "Stopping Vulnerable Driver Attacks" done by Elastic Security Labs https://www.elastic.co/kr/security-labs/stopping-vulnerable-driver-attacks[here].
 
 This rule identifies the load of a driver with an original file name and signature values observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Examine the driver loaded to identify potentially suspicious characteristics. The following actions can help you gain context:
   - Identify the path that the driver was loaded from. If using Elastic Defend, this information can be found in the `dll.path` field.
@@ -80,17 +84,23 @@ This rule identifies the load of a driver with an original file name and signatu
 - Identify the driver's `Device Name` and `Service Name`.
 - Check for alerts from the rules specified in the `Related Rules` section.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Matches derived from these rules are not inherently malicious. The security team should investigate them to ensure they are legitimate and needed, then include them in an allowlist only if required. The security team should address any vulnerable driver installation as it can put the user and the domain at risk.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Untrusted Driver Loaded - d8ab1ec1-feeb-48b9-89e7-c12e189448aa
 - Code Signing Policy Modification Through Registry - da7733b1-fe08-487e-b536-0a04c6d8b0cd
 - Code Signing Policy Modification Through Built-in tools - b43570de-a908-4f7f-8bdb-b2df6ffd8c80
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -109,7 +119,6 @@ This rule identifies the load of a driver with an original file name and signatu
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-google-workspace-oauth-login-from-third-party-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-google-workspace-oauth-login-from-third-party-application.asciidoc
index 34a09a1e3d..ad54698d6a 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-google-workspace-oauth-login-from-third-party-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-google-workspace-oauth-login-from-third-party-application.asciidoc
@@ -45,11 +45,13 @@ Detects the first time a third-party application logs in and authenticated with
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Setup
 
-### Important Information Regarding Google Workspace Event Lag Times
+*Setup*
+
+
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -57,7 +59,11 @@ Detects the first time a third-party application logs in and authenticated with
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-newcredentials-logon-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-newcredentials-logon-process.asciidoc
index af60619374..573d47359a 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-newcredentials-logon-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-newcredentials-logon-process.asciidoc
@@ -32,7 +32,7 @@ Identifies a new credentials logon type performed by an unusual process. This ma
 * Use Case: Threat Detection
 * Tactic: Privilege Escalation
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -46,7 +46,7 @@ Identifies a new credentials logon type performed by an unusual process. This ma
 
 [source, js]
 ----------------------------------
-event.category:"authentication" and host.os.type:"windows" and winlog.logon.type:"NewCredentials" and winlog.event_data.LogonProcessName:(Advapi* or "Advapi  ")
+event.category:"authentication" and host.os.type:"windows" and winlog.logon.type:"NewCredentials" and winlog.event_data.LogonProcessName:(Advapi* or "Advapi  ") and not winlog.event_data.SubjectUserName:*$ and not process.executable :???\\Program?Files*
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/firsttime-seen-account-performing-dcsync.asciidoc b/docs/detections/prebuilt-rules/rule-details/firsttime-seen-account-performing-dcsync.asciidoc
index 4a9247a12e..cd5acb5ef4 100644
--- a/docs/detections/prebuilt-rules/rule-details/firsttime-seen-account-performing-dcsync.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/firsttime-seen-account-performing-dcsync.asciidoc
@@ -53,11 +53,13 @@ This rule identifies when a User Account starts the Active Directory Replication
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating FirstTime Seen Account Performing DCSync
+*Triage and analysis*
+
+
+
+*Investigating FirstTime Seen Account Performing DCSync*
+
 
 Active Directory replication is the process by which the changes that originate on one domain controller are automatically transferred to other domain controllers that store the same data.
 
@@ -65,11 +67,13 @@ Active Directory data consists of objects that have properties, or attributes. E
 
 Adversaries can use the DCSync technique that uses Windows Domain Controller's API to simulate the replication process from a remote domain controller, compromising major credential material such as the Kerberos krbtgt keys that are used legitimately for creating tickets, but also for forging tickets by attackers. This attack requires some extended privileges to succeed (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), which are granted by default to members of the Administrators, Domain Admins, Enterprise Admins, and Domain Controllers groups. Privileged accounts can be abused to grant controlled objects the right to DCsync/Replicate.
 
-More details can be found on [Threat Hunter Playbook](https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing) and [The Hacker Recipes](https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync).
+More details can be found on https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing[Threat Hunter Playbook] and https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync[The Hacker Recipes].
 
 This rule monitors for when a Windows Event ID 4662 (Operation was performed on an Active Directory object) with the access mask 0x100 (Control Access) and properties that contain at least one of the following or their equivalent Schema-Id-GUID (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set) is seen in the environment for the first time in the last 15 days.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account and system owners and confirm whether they are aware of this activity.
@@ -77,12 +81,16 @@ This rule monitors for when a Windows Event ID 4662 (Operation was performed on
 - Correlate security events 4662 and 4624 (Logon Type 3) by their Logon ID (`winlog.logon.id`) on the Domain Controller (DC) that received the replication request. This will tell you where the AD replication request came from, and if it came from another DC or not.
 - Scope which credentials were compromised (for example, whether all accounts were replicated or specific ones).
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Administrators may use custom accounts on Azure AD Connect; investigate if this is part of a new Azure AD account setup, and ensure it is properly secured. If the activity was expected and there is no other suspicious activity involving the host or user, the analyst can dismiss the alert.
 - Although replicating Active Directory (AD) data to non-Domain Controllers is not a common practice and is generally not recommended from a security perspective, some software vendors may require it for their products to function correctly. Investigate if this is part of a new product setup, and ensure it is properly secured. If the activity was expected and there is no other suspicious activity involving the host or user, the analyst can dismiss the alert.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
@@ -93,7 +101,25 @@ This rule monitors for when a Windows Event ID 4662 (Operation was performed on
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'Audit Directory Service Access' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Access (Success,Failure)
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/forwarded-google-workspace-security-alert.asciidoc b/docs/detections/prebuilt-rules/rule-details/forwarded-google-workspace-security-alert.asciidoc
index 23fa88904b..ec6d61fdb6 100644
--- a/docs/detections/prebuilt-rules/rule-details/forwarded-google-workspace-security-alert.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/forwarded-google-workspace-security-alert.asciidoc
@@ -43,13 +43,17 @@ Identifies the occurrence of a security alert from the Google Workspace alerts c
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
+
+*Triage and analysis*
+
 
 This is a promotion rule for Google Workspace security events, which are alertable events per the vendor.
 Consult vendor documentation on interpreting specific events.
-----------------------------------
+
+==== Setup
+
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-creation.asciidoc
index 483866214b..d4698d11ad 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-creation.asciidoc
@@ -45,10 +45,12 @@ Identifies when a firewall rule is created in Google Cloud Platform (GCP) for Vi
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-deletion.asciidoc
index 1142bcb2ab..2f4d3283ef 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-deletion.asciidoc
@@ -45,10 +45,12 @@ Identifies when a firewall rule is deleted in Google Cloud Platform (GCP) for Vi
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-modification.asciidoc
index 4d76276ac0..888affbb54 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-firewall-rule-modification.asciidoc
@@ -45,10 +45,12 @@ Identifies when a firewall rule is modified in Google Cloud Platform (GCP) for V
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-iam-custom-role-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-iam-custom-role-creation.asciidoc
index 9dd08f1cae..2d53439fb0 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-iam-custom-role-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-iam-custom-role-creation.asciidoc
@@ -44,10 +44,12 @@ Identifies an Identity and Access Management (IAM) custom role creation in Googl
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-iam-role-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-iam-role-deletion.asciidoc
index bc883d4bd1..e78ee5c7b4 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-iam-role-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-iam-role-deletion.asciidoc
@@ -44,10 +44,12 @@ Identifies an Identity and Access Management (IAM) role deletion in Google Cloud
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-iam-service-account-key-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-iam-service-account-key-deletion.asciidoc
index ccece3ab62..e15e969355 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-iam-service-account-key-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-iam-service-account-key-deletion.asciidoc
@@ -45,10 +45,12 @@ Identifies the deletion of an Identity and Access Management (IAM) service accou
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-logging-bucket-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-logging-bucket-deletion.asciidoc
index 98080df83a..66ec80cd6e 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-logging-bucket-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-logging-bucket-deletion.asciidoc
@@ -45,10 +45,12 @@ Identifies a Logging bucket deletion in Google Cloud Platform (GCP). Log buckets
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-deletion.asciidoc
index df69a232ca..449a0cede1 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-deletion.asciidoc
@@ -44,10 +44,12 @@ Identifies a Logging sink deletion in Google Cloud Platform (GCP). Every time a
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-modification.asciidoc
index f55ad399b4..8eaebfe034 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-logging-sink-modification.asciidoc
@@ -44,10 +44,12 @@ Identifies a modification to a Logging sink in Google Cloud Platform (GCP). Logg
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-creation.asciidoc
index fd938f3a21..bab25d82e6 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-creation.asciidoc
@@ -44,10 +44,12 @@ Identifies the creation of a subscription in Google Cloud Platform (GCP). In GCP
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-deletion.asciidoc
index 5680e414e4..a8f3714eba 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-subscription-deletion.asciidoc
@@ -44,10 +44,12 @@ Identifies the deletion of a subscription in Google Cloud Platform (GCP). In GCP
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-creation.asciidoc
index 8bed9079a8..0ef956fb06 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-creation.asciidoc
@@ -44,10 +44,12 @@ Identifies the creation of a topic in Google Cloud Platform (GCP). In GCP, the p
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-deletion.asciidoc
index 2f93815def..5a0126ae43 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-pub-sub-topic-deletion.asciidoc
@@ -44,10 +44,12 @@ Identifies the deletion of a topic in Google Cloud Platform (GCP). In GCP, the p
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-creation.asciidoc
index 4ec9a4a6ef..742f8a9397 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-creation.asciidoc
@@ -44,10 +44,12 @@ Identifies when a new service account is created in Google Cloud Platform (GCP).
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-deletion.asciidoc
index 293bda6650..42f55398b0 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-deletion.asciidoc
@@ -44,10 +44,12 @@ Identifies when a service account is deleted in Google Cloud Platform (GCP). A s
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-disabled.asciidoc
index bd0e54748c..23cb8e212b 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-disabled.asciidoc
@@ -44,10 +44,12 @@ Identifies when a service account is disabled in Google Cloud Platform (GCP). A
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-key-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-key-creation.asciidoc
index 4e2ef5fc3c..854977a31b 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-service-account-key-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-service-account-key-creation.asciidoc
@@ -45,10 +45,12 @@ Identifies when a new key is created for a service account in Google Cloud Platf
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-configuration-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-configuration-modification.asciidoc
index 362d6fd8b7..99dd060d49 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-configuration-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-configuration-modification.asciidoc
@@ -44,10 +44,12 @@ Identifies when the configuration is modified for a storage bucket in Google Clo
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-deletion.asciidoc
index baa04dc345..03c7e0b298 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-deletion.asciidoc
@@ -43,10 +43,12 @@ Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adve
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-permissions-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-permissions-modification.asciidoc
index 847cafaa78..99e956306a 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-permissions-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-storage-bucket-permissions-modification.asciidoc
@@ -44,10 +44,12 @@ Identifies when the Identity and Access Management (IAM) permissions are modifie
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-network-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-network-deletion.asciidoc
index d95bc6d53c..1a24d40d55 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-network-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-network-deletion.asciidoc
@@ -44,10 +44,12 @@ Identifies when a Virtual Private Cloud (VPC) network is deleted in Google Cloud
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-creation.asciidoc
index 109afd60a2..bf2fe436c3 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-creation.asciidoc
@@ -45,10 +45,12 @@ Identifies when a virtual private cloud (VPC) route is created in Google Cloud P
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-deletion.asciidoc
index c0da77fbc0..93a1a531b5 100644
--- a/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/gcp-virtual-private-cloud-route-deletion.asciidoc
@@ -45,10 +45,12 @@ Identifies when a Virtual Private Cloud (VPC) route is deleted in Google Cloud P
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-drive-ownership-transferred-via-google-workspace.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-drive-ownership-transferred-via-google-workspace.asciidoc
index 317d90a9f6..b2fda9be13 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-drive-ownership-transferred-via-google-workspace.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-drive-ownership-transferred-via-google-workspace.asciidoc
@@ -43,11 +43,13 @@ Drive and Docs is a Google Workspace service that allows users to leverage Googl
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Google Drive Ownership Transferred via Google Workspace
+*Triage and analysis*
+
+
+
+*Investigating Google Drive Ownership Transferred via Google Workspace*
+
 
 Google Drive is a cloud storage service that allows users to store and access files. It is available to users with a Google Workspace account.
 
@@ -55,7 +57,9 @@ Google Workspace administrators consider users' roles and organizational units w
 
 This rule identifies when the ownership of a shared drive within a Google Workspace organization is transferred to another internal user.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - From the admin console, review admin logs for involved user accounts. To find admin logs, go to `Security > Reporting > Audit and investigation > Admin log events`.
 - Determine if involved user accounts are active. To view user activity, go to `Directory > Users`.
@@ -65,11 +69,15 @@ This rule identifies when the ownership of a shared drive within a Google Worksp
 - If a shared drive, access requirements based on Organizational Units in `Apps > Google Workspace > Drive and Docs > Manage shared drives`.
 - Triage potentially related alerts based on the users involved. To find alerts, go to `Security > Alerts`.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Transferring drives requires Google Workspace administration permissions related to Google Drive. Check if this action was planned/expected from the requester and is appropriately targeting the correct receiver.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -81,13 +89,15 @@ This rule identifies when the ownership of a shared drive within a Google Worksp
     - Identify any regulatory or legal ramifications related to this activity.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -95,7 +105,11 @@ This rule identifies when the ownership of a shared drive within a Google Worksp
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-2sv-policy-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-2sv-policy-disabled.asciidoc
index f82feabb61..e103530d51 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-2sv-policy-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-2sv-policy-disabled.asciidoc
@@ -44,11 +44,13 @@ Google Workspace admins may setup 2-step verification (2SV) to add an extra laye
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Google Workspace 2SV Policy Disabled
+*Triage and analysis*
+
+
+
+*Investigating Google Workspace 2SV Policy Disabled*
+
 
 Google Workspace administrators manage password policies to enforce password requirements for an organization's compliance needs. Administrators have the capability to set restrictions on password length, reset frequencies, reuse capability, expiration, and much more. Google Workspace also allows multi-factor authentication (MFA) and 2-step verification (2SV) for authentication. 2SV allows users to verify their identity using security keys, Google prompt, authentication codes, text messages, and more.
 
@@ -56,7 +58,9 @@ Google Workspace administrators manage password policies to enforce password req
 
 This rule detects when a 2SV policy is disabled in Google Workspace.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the associated user account(s) by reviewing `user.name` or `source.user.email` in the alert.
 - Identify what password setting was created or adjusted by reviewing `google_workspace.admin.setting.name`.
@@ -65,13 +69,17 @@ This rule detects when a 2SV policy is disabled in Google Workspace.
 - Filter `event.dataset` for `google_workspace.login` and aggregate by `user.name`, `event.action`.
   - The `google_workspace.login.challenge_method` field can be used to identify the challenge method that was used for failed and successful logins.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - After finding the user account that updated the password policy, verify whether the action was intentional.
 - Verify whether the user should have Google Workspace administrative privileges that allow them to modify password policies.
 - Review organizational units or groups the role may have been added to and ensure its privileges are properly aligned.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -83,13 +91,15 @@ This rule detects when a 2SV policy is disabled in Google Workspace.
     - Identify any regulatory or legal ramifications related to this activity.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -97,7 +107,11 @@ This rule detects when a 2SV policy is disabled in Google Workspace.
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-assigned-to-a-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-assigned-to-a-user.asciidoc
index 764d70dd8d..f146e3ce6e 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-assigned-to-a-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-assigned-to-a-user.asciidoc
@@ -44,11 +44,13 @@ Assigning the administrative role to a user will grant them access to the Google
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Google Workspace Admin Role Assigned to a User
+*Triage and analysis*
+
+
+
+*Investigating Google Workspace Admin Role Assigned to a User*
+
 
 Google Workspace roles allow administrators to assign specific permissions to users or groups. These assignments should follow the principle of least privilege (PoLP). Admin roles in Google Workspace grant users access to the Google Admin console, where more domain-wide settings are accessible. Google Workspace contains prebuilt administrator roles for performing business functions related to users, groups, and services. Custom administrator roles can be created when prebuilt roles are not sufficient.
 
@@ -56,7 +58,9 @@ Administrator roles assigned to users will grant them additional permissions and
 
 This rule identifies when a Google Workspace administrative role is assigned to a user.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
   - The `user.target.email` field contains the user who received the admin role.
@@ -69,13 +73,17 @@ This rule identifies when a Google Workspace administrative role is assigned to
   - Add `user.email` with the target user account that recently received this new admin role.
 - After identifying the involved user, create a filter with their `user.name` or `user.target.email`. Review the last 48 hours of their activity for anything that may indicate a compromise.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - After identifying user account that added the admin role, verify the action was intentional.
 - Verify that the target user who was assigned the admin role should have administrative privileges in Google Workspace.
 - Review organizational units or groups the target user might have been added to and ensure the admin role permissions align.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -87,13 +95,15 @@ This rule identifies when a Google Workspace administrative role is assigned to
     - Identify any regulatory or legal ramifications related to this activity.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -101,7 +111,11 @@ This rule identifies when a Google Workspace administrative role is assigned to
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-deletion.asciidoc
index 839c74c47b..5c9c951b94 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-deletion.asciidoc
@@ -44,11 +44,13 @@ Detects when a custom admin role is deleted. An adversary may delete a custom ad
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Google Workspace Admin Role Deletion
+*Triage and analysis*
+
+
+
+*Investigating Google Workspace Admin Role Deletion*
+
 
 Google Workspace roles allow administrators to assign specific permissions to users or groups where the principle of least privilege (PoLP) is recommended. Admin roles in Google Workspace grant users access to the Google Admin console, where further domain-wide settings are accessible. Google Workspace contains prebuilt administrator roles for performing business functions related to users, groups, and services. Custom administrator roles can be created where prebuilt roles are not preferred.
 
@@ -56,7 +58,9 @@ Deleted administrator roles may render some user accounts inaccessible or cause
 
 This rule identifies when a Google Workspace administrative role is deleted within the Google Admin console.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
 - Identify the role deleted by reviewing `google_workspace.admin.role.name` in the alert.
@@ -65,11 +69,15 @@ This rule identifies when a Google Workspace administrative role is deleted with
     - Add `google_workspace.admin.role.name` with the role deleted as an additional filter.
     - Adjust the relative time accordingly to identify all users that were assigned this admin role.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - After identifying the user account that disabled the admin role, verify the action was intentional.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Discuss with the user the affected users as a result of this action to mitigate operational discrepencies.
@@ -82,13 +90,15 @@ This rule identifies when a Google Workspace administrative role is deleted with
     - Identify any regulatory or legal ramifications related to this activity.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -96,7 +106,11 @@ This rule identifies when a Google Workspace administrative role is deleted with
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc
index 974dc3bcd8..cdb603f300 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc
@@ -44,11 +44,13 @@ Detects when a domain-wide delegation of authority is granted to a service accou
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating API Access Granted via Domain-Wide Delegation of Authority
+*Triage and analysis*
+
+
+
+*Investigating API Access Granted via Domain-Wide Delegation of Authority*
+
 
 Domain-wide delegation is a feature that allows apps to access users' data across an organization's Google Workspace environment. Only super admins can manage domain-wide delegation, and they must specify each API scope that the application can access. Google Workspace services all have APIs that can be interacted with after domain-wide delegation is established with an OAuth2 client ID of the application. Typically, GCP service accounts and applications are created where the Google Workspace APIs are enabled, thus allowing the application to access resources and services in Google Workspace.
 
@@ -56,7 +58,9 @@ Applications authorized to interact with Google Workspace resources and services
 
 This rule identifies when an application is authorized API client access.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
   - Only users with super admin privileges can authorize API client access.
@@ -66,12 +70,16 @@ This rule identifies when an application is authorized API client access.
   - Search for API client name and aggregated results on `event.action` to determine what the service account is being used for in GWS.
 - After identifying the involved user, verify super administrative privileges to access domain-wide delegation settings.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Changes to domain-wide delegation require super admin privileges. Check with the user to ensure these changes were expected.
 - Review scheduled maintenance notes related to expected API access changes.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Review the scope of the authorized API client access in Google Workspace.
@@ -84,13 +92,15 @@ This rule identifies when an application is authorized API client access.
     - Identify any regulatory or legal ramifications related to this activity.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -98,7 +108,11 @@ This rule identifies when an application is authorized API client access.
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-bitlocker-setting-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-bitlocker-setting-disabled.asciidoc
index 33d128a036..870b235f3a 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-bitlocker-setting-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-bitlocker-setting-disabled.asciidoc
@@ -44,11 +44,13 @@ Google Workspace administrators whom manage Windows devices and have Windows dev
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Google Workspace Bitlocker Setting Disabled
+*Triage and analysis*
+
+
+
+*Investigating Google Workspace Bitlocker Setting Disabled*
+
 
 BitLocker Drive Encryption is a data protection feature that integrates with the Windows operating system to address the data theft or exposure threats from lost, stolen, or inappropriately decommissioned computers. BitLocker helps mitigate unauthorized data access by enhancing file and system protections, such as data encryption and rendering data inaccessible. Google Workspace can sync with Windows endpoints that are registered in inventory, where BitLocker can be enabled and disabled.
 
@@ -56,19 +58,25 @@ Disabling Bitlocker on an endpoint decrypts data at rest and makes it accessible
 
 This rule identifies a user with administrative privileges and access to the admin console, disabling BitLocker for Windows endpoints.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
 - After identifying the user, verify if the user should have administrative privileges to disable BitLocker on Windows endpoints.
 - From the Google Workspace admin console, review `Reporting > Audit` and `Investigation > Device` logs, filtering on the user email identified from the alert.
     - If a Google Workspace user logged into their account using a potentially compromised account, this will create an `Device sync event` event.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - An administrator may have intentionally disabled BitLocker for routine maintenance or endpoint updates.
    - Verify with the user that they intended to disable BitLocker on Windows endpoints.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -80,13 +88,15 @@ This rule identifies a user with administrative privileges and access to the adm
     - Identify any regulatory or legal ramifications related to this activity.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -94,7 +104,11 @@ This rule identifies a user with administrative privileges and access to the adm
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-admin-role-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-admin-role-created.asciidoc
index 6ac045f769..d3d5505c00 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-admin-role-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-admin-role-created.asciidoc
@@ -44,11 +44,13 @@ Detects when a custom admin role is created in Google Workspace. An adversary ma
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Google Workspace Custom Admin Role Created
+*Triage and analysis*
+
+
+
+*Investigating Google Workspace Custom Admin Role Created*
+
 
 Google Workspace roles allow administrators to assign specific permissions to users or groups where the principle of least privilege (PoLP) is recommended. Admin roles in Google Workspace grant users access to the Google Admin console, where more domain-wide settings are accessible. Google Workspace contains prebuilt administrator roles for performing business functions related to users, groups, and services. Custom administrator roles can be created where prebuilt roles are not preferred.
 
@@ -56,7 +58,9 @@ Roles assigned to users will grant them additional permissions and privileges wi
 
 This rule identifies when a Google Workspace administrative role is added within the Google Workspace admin console.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
 - Identify the role added by reviewing the `google_workspace.admin.role.name` field in the alert.
@@ -68,14 +72,18 @@ This rule identifies when a Google Workspace administrative role is added within
   - The `event.provider` field will help filter for specific services in Google Workspace such as Drive or Admin.
   - The `event.action` field will help trace what actions are being taken by users.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - After identifying the user account that created the role, verify whether the action was intentional.
 - Verify that the user who created the role should have administrative privileges in Google Workspace to create custom roles.
 - Review organizational units or groups the role may have been added to and ensure the new privileges align properly.
 - Create a filter with the user's `user.name` and filter for `event.action`. In the results, check if there are multiple `CREATE_ROLE` actions and note whether they are new or historical.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -87,13 +95,15 @@ This rule identifies when a Google Workspace administrative role is added within
     - Identify any regulatory or legal ramifications related to this activity.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -101,7 +111,11 @@ This rule identifies when a Google Workspace administrative role is added within
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-gmail-route-created-or-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-gmail-route-created-or-modified.asciidoc
index c64dec9775..c4ddf6d878 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-gmail-route-created-or-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-custom-gmail-route-created-or-modified.asciidoc
@@ -43,11 +43,13 @@ Detects when a custom Gmail route is added or modified in Google Workspace. Adve
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Google Workspace Custom Gmail Route Created or Modified
+*Triage and analysis*
+
+
+
+*Investigating Google Workspace Custom Gmail Route Created or Modified*
+
 
 Gmail is a popular cloud-based email service developed and managed by Google. Gmail is one of many services available for users with Google Workspace accounts.
 
@@ -55,7 +57,9 @@ Threat actors often send phishing emails containing malicious URL links or attac
 
 This rule identifies the creation of a custom global Gmail route by an administrator from the Google Workspace admin console. Custom email routes could indicate an attempt to secretly forward sensitive emails to unintentional recipients.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that created the custom email route and verify that they should have administrative privileges.
 - Review the added recipients from the custom email route and confidentiality of potential email contents.
@@ -64,11 +68,15 @@ This rule identifies the creation of a custom global Gmail route by an administr
 - If existing emails have been sent and match the custom route criteria, review the sender and contents for malicious URL links and attachments.
 - Identified URLs or attachments can be submitted to VirusTotal for reputational services.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This rule searches for domain-wide custom email routes created in the admin console of Google Workspace. Administrators might create custom email routes to fulfill organizational requirements.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -80,13 +88,15 @@ This rule identifies the creation of a custom global Gmail route by an administr
     - Identify any regulatory or legal ramifications related to this activity.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -94,7 +104,11 @@ This rule identifies the creation of a custom global Gmail route by an administr
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-drive-encryption-key-s-accessed-from-anonymous-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-drive-encryption-key-s-accessed-from-anonymous-user.asciidoc
index be1a96c214..579824d95f 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-drive-encryption-key-s-accessed-from-anonymous-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-drive-encryption-key-s-accessed-from-anonymous-user.asciidoc
@@ -43,9 +43,9 @@ Detects when an external (anonymous) user has viewed, copied or downloaded an en
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -53,7 +53,11 @@ Detects when an external (anonymous) user has viewed, copied or downloaded an en
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-mfa-enforcement-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-mfa-enforcement-disabled.asciidoc
index 69e30484da..5f95525b14 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-mfa-enforcement-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-mfa-enforcement-disabled.asciidoc
@@ -44,21 +44,25 @@ Detects when multi-factor authentication (MFA) enforcement is disabled for Googl
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Google Workspace MFA Enforcement Disabled
+*Triage and analysis*
+
+
+
+*Investigating Google Workspace MFA Enforcement Disabled*
+
 
 Multi-factor authentication is a process in which users are prompted during the sign-in process for an additional form of identification, such as a code on their cellphone or a fingerprint scan.
 
 If you only use a password to authenticate a user, it leaves an insecure vector for attack. If the password is weak or has been exposed elsewhere, an attacker could be using it to gain access. When you require a second form of authentication, security is increased because this additional factor isn't something that's easy for an attacker to obtain or duplicate.
 
-For more information about using MFA in Google Workspace, access the [official documentation](https://support.google.com/a/answer/175197).
+For more information about using MFA in Google Workspace, access the https://support.google.com/a/answer/175197[official documentation].
 
 This rule identifies the disabling of MFA enforcement in Google Workspace. This modification weakens the security of the accounts and can lead to the compromise of accounts and other assets.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -66,11 +70,15 @@ This rule identifies the disabling of MFA enforcement in Google Workspace. This
 - Check if this operation was approved and performed according to the organization's change management policy.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - While this activity can be done by administrators, all users must use MFA. The security team should address any potential benign true positive (B-TP), as this configuration can risk the user and domain.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -83,13 +91,15 @@ This rule identifies the disabling of MFA enforcement in Google Workspace. This
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Reactivate the multi-factor authentication enforcement.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
@@ -98,7 +108,11 @@ This rule identifies the disabling of MFA enforcement in Google Workspace. This
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-object-copied-from-external-drive-and-access-granted-to-custom-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-object-copied-from-external-drive-and-access-granted-to-custom-application.asciidoc
index b7ee2b1990..fc53b6c035 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-object-copied-from-external-drive-and-access-granted-to-custom-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-object-copied-from-external-drive-and-access-granted-to-custom-application.asciidoc
@@ -45,17 +45,21 @@ Detects when a user copies a Google spreadsheet, form, document or script from a
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Google Workspace Resource Copied from External Drive and Access Granted to Custom Application
+*Triage and analysis*
+
+
+
+*Investigating Google Workspace Resource Copied from External Drive and Access Granted to Custom Application*
+
 
 Google Workspace users can share access to Drive objects such as documents, sheets, and forms via email delivery or a shared link. Shared link URIs have parameters like `view` or `edit` to indicate the recipient's permissions. The `copy` parameter allows the recipient to copy the object to their own Drive, which grants the object with the same privileges as the recipient. Specific objects in Google Drive allow container-bound scripts that run on Google's Apps Script platform. Container-bound scripts can contain malicious code that executes with the recipient's privileges if in their Drive.
 
 This rule aims to detect when a user copies an external Drive object to their Drive storage and then grants permissions to a custom application via OAuth prompt.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 - Identify user account(s) associated by reviewing `user.name` or `source.user.email` in the alert.
 - Identify the name of the file copied by reviewing `file.name` as well as the `file.id` for triaging.
 - Identify the file type by reviewing `google_workspace.drive.file.type`.
@@ -68,11 +72,15 @@ This rule aims to detect when a user copies an external Drive object to their Dr
 - If a container-bound script was attached to the copied object, it will also exist in the user's drive.
     - This object should be removed from all users affected and investigated for a better understanding of the malicious code.
 
-### False positive analysis
+
+*False positive analysis*
+
 - Communicate with the affected user to identify if these actions were intentional
 - If a container-bound script exists, review code to identify if it is benign or malicious
 
-### Response and remediation
+
+*Response and remediation*
+
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
 - Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
@@ -85,13 +93,17 @@ This rule aims to detect when a user copies an external Drive object to their Dr
     - Resetting passwords will revoke OAuth tokens which could have been stolen.
 - Reactivate multi-factor authentication for the user.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security defaults [provided by Google](https://cloud.google.com/security-command-center/docs/how-to-investigate-threats).
+- Implement security defaults https://cloud.google.com/security-command-center/docs/how-to-investigate-threats[provided by Google].
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-## Setup
 
-### Important Information Regarding Google Workspace Event Lag Times
+*Setup*
+
+
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -99,7 +111,11 @@ This rule aims to detect when a user copies an external Drive object to their Dr
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-password-policy-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-password-policy-modified.asciidoc
index 263a4bec44..147bea78e4 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-password-policy-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-password-policy-modified.asciidoc
@@ -42,11 +42,13 @@ Detects when a Google Workspace password policy is modified. An adversary may at
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Google Workspace Password Policy Modified
+*Triage and analysis*
+
+
+
+*Investigating Google Workspace Password Policy Modified*
+
 
 Google Workspace administrators manage password policies to enforce password requirements for an organization's compliance needs. Administrators have the capability to set restrictions on password length, reset frequency, reuse capability, expiration, and much more. Google Workspace also allows multi-factor authentication (MFA) and 2-step verification (2SV) for authentication.
 
@@ -54,7 +56,9 @@ Threat actors might rely on weak password policies or restrictions to attempt cr
 
 This rule detects when a Google Workspace password policy is modified to decrease password complexity or to adjust the reuse and reset frequency.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify associated user account(s) by reviewing the `user.name` or `source.user.email` fields in the alert.
 - Identify the password setting that was created or adjusted by reviewing `google_workspace.admin.setting.name` field.
@@ -63,13 +67,17 @@ This rule detects when a Google Workspace password policy is modified to decreas
 - Filter `event.dataset` for `google_workspace.login` and aggregate by `user.name`, `event.action`.
   - The `google_workspace.login.challenge_method` field can be used to identify the challenge method used for failed and successful logins.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - After identifying the user account that updated the password policy, verify whether the action was intentional.
 - Verify whether the user should have administrative privileges in Google Workspace to modify password policies.
 - Review organizational units or groups the role may have been added to and ensure the new privileges align properly.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Consider resetting passwords for potentially affected users.
@@ -83,13 +91,15 @@ This rule detects when a Google Workspace password policy is modified to decreas
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Reactivate multi-factor authentication for the user.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators might observe lag times ranging from several minutes to 3 days between the event occurrence time and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -97,7 +107,11 @@ This rule detects when a Google Workspace password policy is modified to decreas
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, the Filebeat module, or data that's similarly structured is required for this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-restrictions-for-google-marketplace-modified-to-allow-any-app.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-restrictions-for-google-marketplace-modified-to-allow-any-app.asciidoc
index 95de6bcc91..d030e3f40a 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-restrictions-for-google-marketplace-modified-to-allow-any-app.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-restrictions-for-google-marketplace-modified-to-allow-any-app.asciidoc
@@ -44,11 +44,13 @@ Detects when the Google Marketplace restrictions are changed to allow any applic
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Google Workspace Restrictions for Google Marketplace Modified to Allow Any App
+*Triage and analysis*
+
+
+
+*Investigating Google Workspace Restrictions for Google Marketplace Modified to Allow Any App*
+
 
 Google Workspace Marketplace is an online store for free and paid web applications that work with Google Workspace services and third-party software. Listed applications are based on Google APIs or Google Apps Script and created by both Google and third-party developers.
 
@@ -58,7 +60,9 @@ Google clearly states that they are not responsible for any product on the Marke
 
 This rule identifies when the global allow-all setting is enabled for Google Workspace Marketplace applications.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
 - This rule relies on data from `google_workspace.admin`, thus indicating the associated user has administrative privileges to the Marketplace.
@@ -68,14 +72,18 @@ This rule identifies when the global allow-all setting is enabled for Google Wor
 - Re-assess the permissions and reviews of the Marketplace applications to determine if they violate organizational policies or introduce unexpected risks.
 - With access to the Google Workspace admin console, determine if the application was installed domain-wide or individually by visiting `Apps > Google Workspace Marketplace Apps`.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Identify the user account associated with this action and assess their administrative privileges with Google Workspace Marketplace.
 - Google Workspace administrators may intentionally add an application from the marketplace based on organizational needs.
     - Follow up with the user who added the application to ensure this was intended.
 - Verify the application identified has been assessed thoroughly by an administrator.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -87,13 +95,15 @@ This rule identifies when the global allow-all setting is enabled for Google Wor
     - Identify any regulatory or legal ramifications related to this activity.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -101,7 +111,11 @@ This rule identifies when the global allow-all setting is enabled for Google Wor
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-role-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-role-modified.asciidoc
index ad2ba662db..d482742f00 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-role-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-role-modified.asciidoc
@@ -44,11 +44,13 @@ Detects when a custom admin role or its permissions are modified. An adversary m
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Google Workspace Role Modified
+*Triage and analysis*
+
+
+
+*Investigating Google Workspace Role Modified*
+
 
 Google Workspace roles allow administrators to assign specific permissions to users or groups where the principle of least privilege (PoLP) is recommended. Admin roles in Google Workspace grant users access to the Google Admin console, where more domain-wide settings are accessible. Google Workspace contains prebuilt admin roles for performing business functions related to users, groups, and services. Custom administrator roles can be created where prebuilt roles are not preferred. Each Google Workspace service has a set of custodial privileges that can be added to custom roles.
 
@@ -56,7 +58,9 @@ Roles assigned to users will grant them additional permissions and privileges wi
 
 This rule identifies when a Google Workspace role is modified.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
 - Identify the role modified by reviewing the `google_workspace.admin.role.name` field in the alert.
@@ -70,14 +74,18 @@ This rule identifies when a Google Workspace role is modified.
   - The `event.provider` field will help filter for specific services in Google Workspace such as Drive or Admin.
   - The `event.action` field will help trace actions that are being taken by users.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - After identifying the user account that modified the role, verify the action was intentional.
 - Verify that the user is expected to have administrative privileges in Google Workspace to modify roles.
 - Review organizational units or groups the role might have been added to and ensure the new privileges align properly.
 - Use the `user.name` to filter for `event.action` where `ADD_PRIVILEGE` or `UPDATE_ROLE` has been seen before to check if these actions are new or historical.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -89,13 +97,15 @@ This rule identifies when a Google Workspace role is modified.
     - Identify any regulatory or legal ramifications related to this activity.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -103,7 +113,11 @@ This rule identifies when a Google Workspace role is modified.
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-suspended-user-account-renewed.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-suspended-user-account-renewed.asciidoc
index d7778e9bf1..d78de43263 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-suspended-user-account-renewed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-suspended-user-account-renewed.asciidoc
@@ -43,9 +43,9 @@ Detects when a previously suspended user's account is renewed in Google Workspac
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -53,7 +53,11 @@ Detects when a previously suspended user's account is renewed in Google Workspac
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/google-workspace-user-organizational-unit-changed.asciidoc b/docs/detections/prebuilt-rules/rule-details/google-workspace-user-organizational-unit-changed.asciidoc
index 5d99ddb835..87d675c7e2 100644
--- a/docs/detections/prebuilt-rules/rule-details/google-workspace-user-organizational-unit-changed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/google-workspace-user-organizational-unit-changed.asciidoc
@@ -44,11 +44,13 @@ Users in Google Workspace are typically assigned a specific organizational unit
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Google Workspace User Organizational Unit Changed
+*Triage and analysis*
+
+
+
+*Investigating Google Workspace User Organizational Unit Changed*
+
 
 An organizational unit is a group that an administrator can create in the Google Admin console to apply settings to a specific set of users for Google Workspace. By default, all users are placed in the top-level (parent) organizational unit. Child organizational units inherit the settings from the parent but can be changed to fit the needs of the child organizational unit.
 
@@ -56,7 +58,9 @@ Permissions and privileges for users are often inherited from the organizational
 
 This rule identifies when a user has been moved to a different organizational unit.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the associated user accounts by reviewing `user.name` or `user.email` fields in the alert.
   - The `user.target.email` field contains the user that had their assigned organizational unit switched.
@@ -68,13 +72,17 @@ This rule identifies when a user has been moved to a different organizational un
   - Add `user.email` with the target user account that recently had their organizational unit changed.
 - Filter on `user.name` or `user.target.email` of the user who took this action and review the last 48 hours of activity for anything that may indicate a compromise.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - After identifying the user account that changed another user's organizational unit, verify the action was intentional.
 - Verify whether the target user who received this update is expected to inherit privileges from the new organizational unit.
 - Review potential maintenance notes or organizational changes. They might explain why a user's organization was changed.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -86,13 +94,15 @@ This rule identifies when a user has been moved to a different organizational un
     - Identify any regulatory or legal ramifications related to this activity.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -100,7 +110,11 @@ This rule identifies when a user has been moved to a different organizational un
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/group-policy-abuse-for-privilege-addition.asciidoc b/docs/detections/prebuilt-rules/rule-details/group-policy-abuse-for-privilege-addition.asciidoc
index 0602c7c263..e42aebc2a3 100644
--- a/docs/detections/prebuilt-rules/rule-details/group-policy-abuse-for-privilege-addition.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/group-policy-abuse-for-privilege-addition.asciidoc
@@ -48,30 +48,40 @@ Detects the first occurrence of a modification to Group Policy Object Attributes
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Group Policy Abuse for Privilege Addition
+*Triage and analysis*
+
+
+
+*Investigating Group Policy Abuse for Privilege Addition*
+
 
 Group Policy Objects (GPOs) can be used to add rights and/or modify Group Membership on GPOs by changing the contents of an INF file named GptTmpl.inf, which is responsible for storing every setting under the Security Settings container in the GPO. This file is unique for each GPO, and only exists if the GPO contains security settings. Example Path: "\\DC.com\SysVol\DC.com\Policies\{PolicyGUID}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf"
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - This attack abuses a legitimate mechanism of Active Directory, so it is important to determine whether the activity is legitimate and the administrator is authorized to perform this operation.
 - Retrieve the contents of the `GptTmpl.inf` file, and under the `Privilege Rights` section, look for potentially dangerous high privileges, for example: SeTakeOwnershipPrivilege, SeEnableDelegationPrivilege, etc.
 - Inspect the user security identifiers (SIDs) associated with these privileges, and if they should have these privileges.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Inspect whether the user that has done the modifications should be allowed to. The user name can be found in the `winlog.event_data.SubjectUserName` field.
 
-### Related rules
+
+*Related rules*
+
 
 - Scheduled Task Execution at Scale via GPO - 15a8ba77-1c13-4274-88fe-6bd14133861e
 - Startup/Logon Script added to Group Policy Object - 16fac1a1-21ee-4ca6-b720-458e3855d046
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - The investigation and containment must be performed in every computer controlled by the GPO, where necessary.
@@ -79,7 +89,25 @@ Group Policy Objects (GPOs) can be used to add rights and/or modify Group Member
 - Check if other GPOs have suspicious scripts attached.
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'Audit Directory Service Changes' audit policy must be configured (Success Failure).
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success,Failure)
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/group-policy-discovery-via-microsoft-gpresult-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/group-policy-discovery-via-microsoft-gpresult-utility.asciidoc
index e8eb7ee2d1..c30830123b 100644
--- a/docs/detections/prebuilt-rules/rule-details/group-policy-discovery-via-microsoft-gpresult-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/group-policy-discovery-via-microsoft-gpresult-utility.asciidoc
@@ -45,17 +45,21 @@ Detects the usage of gpresult.exe to query group policy objects. Attackers may q
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Group Policy Discovery via Microsoft GPResult Utility
+*Triage and analysis*
+
+
+
+*Investigating Group Policy Discovery via Microsoft GPResult Utility*
+
 
 Group Policy is a Windows feature that allows administrators to manage and configure settings for users and computers in an Active Directory environment. The Microsoft GPResult utility (gpresult.exe) is a command-line tool used to query and display Group Policy Objects (GPOs) applied to a system. Attackers may abuse this utility to gain insights into the active directory environment and identify potential privilege escalation or lateral movement opportunities.
 
 The detection rule 'Group Policy Discovery via Microsoft GPResult Utility' is designed to identify the usage of gpresult.exe with specific arguments ("/z", "/v", "/r", "/x") that are commonly used by adversaries during the reconnaissance phase to perform group policy discovery.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Review the alert details to understand the context of the gpresult.exe usage, such as the user account, system, and time of execution.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -66,11 +70,15 @@ The detection rule 'Group Policy Discovery via Microsoft GPResult Utility' is de
 - Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 - Investigate any abnormal behavior by the parent process, such as network connections, registry or file modifications, and any other spawned child processes.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -80,7 +88,6 @@ The detection rule 'Group Policy Discovery via Microsoft GPResult Utility' is de
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/halfbaked-command-and-control-beacon.asciidoc b/docs/detections/prebuilt-rules/rule-details/halfbaked-command-and-control-beacon.asciidoc
index f641f454b3..c22cd8d2fb 100644
--- a/docs/detections/prebuilt-rules/rule-details/halfbaked-command-and-control-beacon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/halfbaked-command-and-control-beacon.asciidoc
@@ -45,12 +45,11 @@ Halfbaked is a malware family used to establish persistence in a contested netwo
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Threat intel
+
+*Threat intel*
+
 
 This activity has been observed in FIN7 campaigns.
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/high-mean-of-process-arguments-in-an-rdp-session.asciidoc b/docs/detections/prebuilt-rules/rule-details/high-mean-of-process-arguments-in-an-rdp-session.asciidoc
index 06a8675314..4834a105d8 100644
--- a/docs/detections/prebuilt-rules/rule-details/high-mean-of-process-arguments-in-an-rdp-session.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/high-mean-of-process-arguments-in-an-rdp-session.asciidoc
@@ -40,6 +40,42 @@ A machine learning job has detected unusually high number of process arguments i
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration.  
+
+
+*Lateral Movement Detection Setup*
+
+The Lateral Movement Detection integration detects lateral movement activity by identifying abnormalities in file and Windows RDP events. Anomalies are detected using Elastic's Anomaly Detection feature.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Lateral Movement Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows RDP process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+
+
+*The following steps should be executed to install assets associated with the Lateral Movement Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Lateral Movement Detection and select the integration to see more details about it.
+- Under Settings, click Install Lateral Movement Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Lateral Movement Detection, you'll need to enable the corresponding Anomaly Detection jobs.
+- Before enabling the Anomaly Detection jobs, confirm that the Pivot Transform asset is installed and actively gathering data in the destination index `ml-rdp-lmd`.
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your transformed RDP process data i.e.`ml-rdp-lmd`.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/lmd/kibana/ml_module/lmd-ml.json[this] configuration file, you will see a card for Lateral Movement Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/high-mean-of-rdp-session-duration.asciidoc b/docs/detections/prebuilt-rules/rule-details/high-mean-of-rdp-session-duration.asciidoc
index f21dff41c6..757d68e7e7 100644
--- a/docs/detections/prebuilt-rules/rule-details/high-mean-of-rdp-session-duration.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/high-mean-of-rdp-session-duration.asciidoc
@@ -40,6 +40,42 @@ A machine learning job has detected unusually high mean of RDP session duration.
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration.  
+
+
+*Lateral Movement Detection Setup*
+
+The Lateral Movement Detection integration detects lateral movement activity by identifying abnormalities in file and Windows RDP events. Anomalies are detected using Elastic's Anomaly Detection feature.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Lateral Movement Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows RDP process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+
+
+*The following steps should be executed to install assets associated with the Lateral Movement Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Lateral Movement Detection and select the integration to see more details about it.
+- Under Settings, click Install Lateral Movement Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Lateral Movement Detection, you'll need to enable the corresponding Anomaly Detection jobs.
+- Before enabling the Anomaly Detection jobs, confirm that the Pivot Transform asset is installed and actively gathering data in the destination index `ml-rdp-lmd`.
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your transformed RDP process data i.e.`ml-rdp-lmd`.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/lmd/kibana/ml_module/lmd-ml.json[this] configuration file, you will see a card for Lateral Movement Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/high-number-of-okta-user-password-reset-or-unlock-attempts.asciidoc b/docs/detections/prebuilt-rules/rule-details/high-number-of-okta-user-password-reset-or-unlock-attempts.asciidoc
index ffef8b8ff2..8b72e016ff 100644
--- a/docs/detections/prebuilt-rules/rule-details/high-number-of-okta-user-password-reset-or-unlock-attempts.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/high-number-of-okta-user-password-reset-or-unlock-attempts.asciidoc
@@ -46,15 +46,19 @@ Identifies a high number of Okta user password reset or account unlock attempts.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating High Number of Okta User Password Reset or Unlock Attempts
+*Triage and analysis*
+
+
+
+*Investigating High Number of Okta User Password Reset or Unlock Attempts*
+
 
 This rule is designed to detect a suspiciously high number of password reset or account unlock attempts in Okta. Excessive password resets or account unlocks can be indicative of an attacker's attempt to gain unauthorized access to an account.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 - Identify the actor associated with the excessive attempts. The `okta.actor.alternate_id` field can be used for this purpose.
 - Determine the client used by the actor. You can look at `okta.client.device`, `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.ip_chain.ip`, and `okta.client.geographical_context`.
 - Review the `okta.outcome.result` and `okta.outcome.reason` fields to understand the outcome of the password reset or unlock attempts.
@@ -62,17 +66,25 @@ This rule is designed to detect a suspiciously high number of password reset or
 - Check for other similar patterns of behavior from the same actor or IP address. If there is a high number of failed login attempts before the password reset or unlock attempts, this may suggest a brute force attack.
 - Also, look at the times when these attempts were made. If these were made during off-hours, it could further suggest an adversary's activity.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 - This alert might be a false positive if there are legitimate reasons for a high number of password reset or unlock attempts. This could be due to the user forgetting their password or account lockouts due to too many incorrect attempts.
 - Check the actor's past behavior. If this is their usual behavior and they have a valid reason for it, then it might be a false positive.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 - If unauthorized attempts are confirmed, initiate the incident response process.
 - Reset the user's password and enforce MFA re-enrollment, if applicable.
 - Block the IP address or device used in the attempts, if they appear suspicious.
 - If the attack was facilitated by a particular technique, ensure your systems are patched or configured to prevent such techniques.
 - Consider a security review of your Okta policies and rules to ensure they follow security best practices.
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/high-number-of-process-and-or-service-terminations.asciidoc b/docs/detections/prebuilt-rules/rule-details/high-number-of-process-and-or-service-terminations.asciidoc
index 56ee765958..0f69051d68 100644
--- a/docs/detections/prebuilt-rules/rule-details/high-number-of-process-and-or-service-terminations.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/high-number-of-process-and-or-service-terminations.asciidoc
@@ -48,17 +48,21 @@ This rule identifies a high number (10) of process terminations (stop, delete, o
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating High Number of Process and/or Service Terminations
+*Triage and analysis*
+
+
+
+*Investigating High Number of Process and/or Service Terminations*
+
 
 Attackers can stop services and kill processes for a variety of purposes. For example, they can stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted, or stop security and backup solutions, etc.
 
 This rule identifies a high number (10) of service and/or process terminations (stop, delete, or suspend) from the same host within a short time period.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -66,11 +70,15 @@ This rule identifies a high number (10) of service and/or process terminations (
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Check if any files on the host machine have been encrypted.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further destructive behavior, which is commonly associated with this activity.
@@ -81,7 +89,6 @@ This rule identifies a high number (10) of service and/or process terminations (
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/high-number-of-process-terminations.asciidoc b/docs/detections/prebuilt-rules/rule-details/high-number-of-process-terminations.asciidoc
index 408aa506f7..5c62a2d66f 100644
--- a/docs/detections/prebuilt-rules/rule-details/high-number-of-process-terminations.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/high-number-of-process-terminations.asciidoc
@@ -44,17 +44,21 @@ This rule identifies a high number (10) of process terminations via pkill from t
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating High Number of Process Terminations
+*Triage and analysis*
+
+
+
+*Investigating High Number of Process Terminations*
+
 
 Attackers can kill processes for a variety of purposes. For example, they can kill process associated with business applications and databases to release the lock on files used by these applications so they may be encrypted,or stop security and backup solutions, etc.
 
 This rule identifies a high number (10) of process terminations via pkill from the same host within a short time period.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the entry point to the host and user in action via the Analyse View.
   - Identify the session entry leader and session user.
@@ -64,11 +68,15 @@ This rule identifies a high number (10) of process terminations via pkill from t
   - Identify imment threat to the system from the process killed.
   - Take necessary incident response actions to respawn necessary process.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further destructive behavior, which is commonly associated with this activity.
@@ -80,7 +88,41 @@ This rule identifies a high number (10) of process terminations via pkill from t
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/high-variance-in-rdp-session-duration.asciidoc b/docs/detections/prebuilt-rules/rule-details/high-variance-in-rdp-session-duration.asciidoc
index 172d7a249c..b109187b5d 100644
--- a/docs/detections/prebuilt-rules/rule-details/high-variance-in-rdp-session-duration.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/high-variance-in-rdp-session-duration.asciidoc
@@ -40,6 +40,42 @@ A machine learning job has detected unusually high variance of RDP session durat
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration.  
+
+
+*Lateral Movement Detection Setup*
+
+The Lateral Movement Detection integration detects lateral movement activity by identifying abnormalities in file and Windows RDP events. Anomalies are detected using Elastic's Anomaly Detection feature.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Lateral Movement Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows RDP process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+
+
+*The following steps should be executed to install assets associated with the Lateral Movement Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Lateral Movement Detection and select the integration to see more details about it.
+- Under Settings, click Install Lateral Movement Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Lateral Movement Detection, you'll need to enable the corresponding Anomaly Detection jobs.
+- Before enabling the Anomaly Detection jobs, confirm that the Pivot Transform asset is installed and actively gathering data in the destination index `ml-rdp-lmd`.
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your transformed RDP process data i.e.`ml-rdp-lmd`.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/lmd/kibana/ml_module/lmd-ml.json[this] configuration file, you will see a card for Lateral Movement Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/hosts-file-modified.asciidoc b/docs/detections/prebuilt-rules/rule-details/hosts-file-modified.asciidoc
index f62945fa00..45f84a2ee5 100644
--- a/docs/detections/prebuilt-rules/rule-details/hosts-file-modified.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/hosts-file-modified.asciidoc
@@ -49,17 +49,21 @@ The hosts file on endpoints is used to control manual IP address to hostname res
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Hosts File Modified
+*Triage and analysis*
+
+
+
+*Investigating Hosts File Modified*
+
 
-Operating systems use the hosts file to map a connection between an IP address and domain names before going to domain name servers. Attackers can abuse this mechanism to route traffic to malicious infrastructure or disrupt security that depends on server communications. For example, Russian threat actors modified this file on a domain controller to redirect Duo MFA calls to localhost instead of the Duo server, which prevented the MFA service from contacting its server to validate MFA login. This effectively disabled MFA for active domain accounts because the default policy of Duo for Windows is to "Fail open" if the MFA server is unreachable. This can happen in any MFA implementation and is not exclusive to Duo. Find more details in this [CISA Alert](https://www.cisa.gov/uscert/ncas/alerts/aa22-074a).
+Operating systems use the hosts file to map a connection between an IP address and domain names before going to domain name servers. Attackers can abuse this mechanism to route traffic to malicious infrastructure or disrupt security that depends on server communications. For example, Russian threat actors modified this file on a domain controller to redirect Duo MFA calls to localhost instead of the Duo server, which prevented the MFA service from contacting its server to validate MFA login. This effectively disabled MFA for active domain accounts because the default policy of Duo for Windows is to "Fail open" if the MFA server is unreachable. This can happen in any MFA implementation and is not exclusive to Duo. Find more details in this https://www.cisa.gov/uscert/ncas/alerts/aa22-074a[CISA Alert].
 
 This rule identifies modifications in the hosts file across multiple operating systems using process creation events for Linux and file events in Windows and macOS.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the specifics of the involved assets, such as role, criticality, and associated users.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -68,11 +72,15 @@ This rule identifies modifications in the hosts file across multiple operating s
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Examine the changes to the hosts file by comparing it against file backups, volume shadow copies, and other restoration mechanisms.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and the configuration was justified.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Consider isolating the involved host to prevent further post-compromise behavior.
@@ -83,7 +91,20 @@ This rule identifies modifications in the hosts file across multiple operating s
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+For Windows systems using Auditbeat, this rule requires adding `C:/Windows/System32/drivers/etc` as an additional path in the 'file_integrity' module of auditbeat.yml.
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/hping-process-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/hping-process-activity.asciidoc
index 12cae0325d..2c47610f30 100644
--- a/docs/detections/prebuilt-rules/rule-details/hping-process-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/hping-process-activity.asciidoc
@@ -43,6 +43,57 @@ Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc
index cb8fa94895..e3b081ed25 100644
--- a/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc
@@ -47,11 +47,13 @@ Identifies when Internet Information Services (IIS) HTTP Logging is disabled on
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating IIS HTTP Logging Disabled
+*Triage and analysis*
+
+
+
+*Investigating IIS HTTP Logging Disabled*
+
 
 IIS (Internet Information Services) is a Microsoft web server software used to host websites and web applications on Windows. It provides features for serving dynamic and static content, and can be managed through a graphical interface or command-line tools.
 
@@ -59,7 +61,9 @@ IIS logging is a data source that can be used for security monitoring, forensics
 
 This rule monitors commands that disable IIS logging.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -69,11 +73,15 @@ This rule monitors commands that disable IIS logging.
 - Verify whether the logs stored in the `C:\inetpub\logs\logfiles\w3svc1` directory were deleted after this action.
 - Check if this operation is done under change management and approved according to the organization's policy.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -84,7 +92,17 @@ This rule monitors commands that disable IIS logging.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/imageload-via-windows-update-auto-update-client.asciidoc b/docs/detections/prebuilt-rules/rule-details/imageload-via-windows-update-auto-update-client.asciidoc
index c5fc95e46e..3df0a63a67 100644
--- a/docs/detections/prebuilt-rules/rule-details/imageload-via-windows-update-auto-update-client.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/imageload-via-windows-update-auto-update-client.asciidoc
@@ -49,20 +49,24 @@ Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating ImageLoad via Windows Update Auto Update Client
+*Triage and analysis*
+
+
+
+*Investigating ImageLoad via Windows Update Auto Update Client*
+
 
 The Windows Update Auto Update Client (wuauclt.exe) is the component responsible for managing system updates. However, adversaries may abuse this process to load a malicious DLL and execute malicious code while blending into a legitimate system mechanism. 
 
 This rule identifies potential abuse for code execution by monitoring for specific process arguments ("/RunHandlerComServer" and "/UpdateDeploymentProvider") and common writable paths where the target DLL can be placed (e.g., "C:\Users\*.dll", "C:\ProgramData\*.dll", etc.).
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
@@ -83,11 +87,15 @@ This rule identifies potential abuse for code execution by monitoring for specif
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate the behavior of child processes, such as network connections, registry or file modifications, and any spawned processes.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -102,7 +110,17 @@ This rule identifies potential abuse for code execution by monitoring for specif
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc b/docs/detections/prebuilt-rules/rule-details/inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc
index 9cc0bbb3a4..0a506630a5 100644
--- a/docs/detections/prebuilt-rules/rule-details/inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc
@@ -43,10 +43,12 @@ Identifies Elasticsearch nodes that do not have Transport Layer Security (TLS),
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+This rule requires the addition of port `9200` and `send_all_headers` to the `HTTP` protocol configuration in `packetbeat.yml`. See the References section for additional configuration documentation.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/ingress-transfer-via-windows-bits.asciidoc b/docs/detections/prebuilt-rules/rule-details/ingress-transfer-via-windows-bits.asciidoc
index 59efc2d15d..102af14e3b 100644
--- a/docs/detections/prebuilt-rules/rule-details/ingress-transfer-via-windows-bits.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/ingress-transfer-via-windows-bits.asciidoc
@@ -44,20 +44,24 @@ Identifies downloads of executable and archive files via the Windows Background
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Ingress Transfer via Windows BITS
+*Triage and analysis*
+
+
+
+*Investigating Ingress Transfer via Windows BITS*
+
 
 Windows Background Intelligent Transfer Service (BITS) is a technology that allows the transfer of files between a client and a server, which makes it a dual-use mechanism, being used by both legitimate apps and attackers. When malicious applications create BITS jobs, files are downloaded or uploaded in the context of the service host process, which can bypass security protections, and it helps to obscure which application requested the transfer.
 
 This rule identifies such abuse by monitoring for file renaming events involving "svchost.exe" and "BIT*.tmp" on Windows systems.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Gain context into the BITS transfer.
   - Try to determine the process that initiated the BITS transfer.
@@ -66,11 +70,11 @@ This rule identifies such abuse by monitoring for file renaming events involving
   - Try to determine the origin of the file.
     - Inspect network connections initiated by `svchost.exe`.
     - Inspect `Microsoft-Windows-Bits-Client/Operational` Windows logs, specifically the event ID 59, for unusual events.
-      - Velociraptor can be used to extract these entries using the [bitsadmin artifact](https://docs.velociraptor.app/exchange/artifacts/pages/bitsadmin/).
+      - Velociraptor can be used to extract these entries using the https://docs.velociraptor.app/exchange/artifacts/pages/bitsadmin/[bitsadmin artifact].
     - Check the reputation of the remote server involved in the BITS transfer, such as its IP address or domain, using threat intelligence platforms or online reputation services.
     - Check if the domain is newly registered or unexpected.
     - Use the identified domain as an indicator of compromise (IoCs) to scope other compromised hosts in the environment.
-  - [BitsParser](https://github.com/fireeye/BitsParser) can be used to parse BITS database files to extract BITS job information.
+  - https://github.com/fireeye/BitsParser[BitsParser] can be used to parse BITS database files to extract BITS job information.
 - Examine the details of the dropped file, and whether it was executed.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Examine the host for derived artifacts that indicate suspicious activities:
@@ -88,17 +92,23 @@ This rule identifies such abuse by monitoring for file renaming events involving
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Known false positives for the rule include legitimate software and system updates that use BITS for downloading files.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Persistence via BITS Job Notify Cmdline - c3b915e0-22f3-4bf7-991d-b643513c722f
 - Unsigned BITS Service Client Process - 9a3884d0-282d-45ea-86ce-b9c81100f026
 - Bitsadmin Activity - 8eec4df1-4b4b-4502-b6c3-c788714604c9
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
   - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
@@ -115,7 +125,6 @@ This rule identifies such abuse by monitoring for file renaming events involving
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/installation-of-security-support-provider.asciidoc b/docs/detections/prebuilt-rules/rule-details/installation-of-security-support-provider.asciidoc
index 9ee94d7322..0835ed95ae 100644
--- a/docs/detections/prebuilt-rules/rule-details/installation-of-security-support-provider.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/installation-of-security-support-provider.asciidoc
@@ -43,6 +43,17 @@ Identifies registry modifications related to the Windows Security Support Provid
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/interactive-logon-by-an-unusual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/interactive-logon-by-an-unusual-process.asciidoc
index b02259fac5..ea363ebc80 100644
--- a/docs/detections/prebuilt-rules/rule-details/interactive-logon-by-an-unusual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/interactive-logon-by-an-unusual-process.asciidoc
@@ -32,7 +32,7 @@ Identifies interactive logon attempt with alternate credentials and by an unusua
 * Use Case: Threat Detection
 * Tactic: Privilege Escalation
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -41,6 +41,19 @@ Identifies interactive logon attempt with alternate credentials and by an unusua
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+Audit event 4624 is needed to trigger this rule.
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
@@ -49,13 +62,16 @@ Identifies interactive logon attempt with alternate credentials and by an unusua
 authentication where 
  host.os.type : "windows" and winlog.event_data.LogonProcessName : "Advapi*" and 
  winlog.logon.type == "Interactive" and winlog.event_data.SubjectUserSid : ("S-1-5-21*", "S-1-12-*") and 
- winlog.event_data.TargetUserSid : ("S-1-5-21*", "S-1-12-*")  and 
+ winlog.event_data.TargetUserSid : ("S-1-5-21*", "S-1-12-*")  and process.executable : "C:\\*" and 
  not startswith~(winlog.event_data.SubjectUserSid, winlog.event_data.TargetUserSid) and 
  not process.executable : 
             ("?:\\Windows\\System32\\winlogon.exe", 
              "?:\\Windows\\System32\\wininit.exe", 
-             "?:\\Program Files\\Okta\\Okta Verify\\OktaVerify.exe", 
-             "?:\\Program Files (x86)\\Okta\\Okta Verify\\OktaVerify.exe")
+             "?:\\Program Files\\*.exe", 
+             "?:\\Program Files (x86)\\*.exe", 
+             "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe", 
+             "?:\\Windows\\System32\\inetsrv\\w3wp.exe", 
+             "?:\\Windows\\SysWOW64\\msiexec.exe")
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-perl.asciidoc b/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-perl.asciidoc
index 2027977c59..145eb38779 100644
--- a/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-perl.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-perl.asciidoc
@@ -41,6 +41,57 @@ Identifies when a terminal (tty) is spawned via Perl. Attackers may upgrade a si
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-python.asciidoc b/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-python.asciidoc
index 96cef32923..19e3b5b0f0 100644
--- a/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-python.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/interactive-terminal-spawned-via-python.asciidoc
@@ -40,6 +40,41 @@ Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kerberos-cached-credentials-dumping.asciidoc b/docs/detections/prebuilt-rules/rule-details/kerberos-cached-credentials-dumping.asciidoc
index 7b302428f1..381787ccdd 100644
--- a/docs/detections/prebuilt-rules/rule-details/kerberos-cached-credentials-dumping.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kerberos-cached-credentials-dumping.asciidoc
@@ -41,6 +41,41 @@ Identifies the use of the Kerberos credential cache (kcc) utility to dump locall
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kerberos-pre-authentication-disabled-for-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/kerberos-pre-authentication-disabled-for-user.asciidoc
index bf8402918a..d1f4d7bbe0 100644
--- a/docs/detections/prebuilt-rules/rule-details/kerberos-pre-authentication-disabled-for-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kerberos-pre-authentication-disabled-for-user.asciidoc
@@ -51,28 +51,36 @@ Identifies the modification of an account's Kerberos pre-authentication options.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Kerberos Pre-authentication Disabled for User
+*Triage and analysis*
+
+
+
+*Investigating Kerberos Pre-authentication Disabled for User*
+
 
-Kerberos pre-authentication is an account protection against offline password cracking. When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is signed with the user’s password. Microsoft's security monitoring [recommendations](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738) state that `'Don't Require Preauth' – Enabled` should not be enabled for user accounts because it weakens security for the account’s Kerberos authentication.
+Kerberos pre-authentication is an account protection against offline password cracking. When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is signed with the user’s password. Microsoft's security monitoring https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738[recommendations] state that `'Don't Require Preauth' – Enabled` should not be enabled for user accounts because it weakens security for the account’s Kerberos authentication.
 
 AS-REP roasting is an attack against Kerberos for user accounts that do not require pre-authentication, which means that if the target user has pre-authentication disabled, an attacker can request authentication data for it and get a TGT that can be brute-forced offline, similarly to Kerberoasting.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Determine if the target account is sensitive or privileged.
 - Inspect the account activities for suspicious or abnormal behaviors in the alert timeframe.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Disabling pre-authentication is a bad security practice and should not be allowed in the domain. The security team should map and monitor any potential benign true positives (B-TPs), especially if the target account is privileged.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Reset the target account's password if there is any risk of TGTs having been retrieved.
@@ -82,7 +90,25 @@ AS-REP roasting is an attack against Kerberos for user accounts that do not requ
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'Audit User Account Management' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+Account Management >
+Audit User Account Management (Success,Failure)
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
index 9590a1cf5e..54434d2de7 100644
--- a/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
@@ -42,20 +42,24 @@ Identifies network connections to the standard Kerberos port from an unusual pro
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Kerberos Traffic from Unusual Process
+*Triage and analysis*
+
+
+
+*Investigating Kerberos Traffic from Unusual Process*
+
 
 Kerberos is the default authentication protocol in Active Directory, designed to provide strong authentication for client/server applications by using secret-key cryptography.
 
 Domain-joined hosts usually perform Kerberos traffic using the `lsass.exe` process. This rule detects the occurrence of traffic on the Kerberos port (88) by processes other than `lsass.exe` to detect the unusual request and usage of Kerberos tickets.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -76,12 +80,16 @@ Domain-joined hosts usually perform Kerberos traffic using the `lsass.exe` proce
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This rule uses a Kerberos-related port but does not identify the protocol used on that port. HTTP traffic on a non-standard port or destination IP address unrelated to Domain controllers can create false positives.
 - Exceptions can be added for noisy/frequent connections.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -98,7 +106,17 @@ Domain-joined hosts usually perform Kerberos traffic using the `lsass.exe` proce
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kernel-driver-load-by-non-root-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/kernel-driver-load-by-non-root-user.asciidoc
index f9eefdc849..d6e28393f7 100644
--- a/docs/detections/prebuilt-rules/rule-details/kernel-driver-load-by-non-root-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kernel-driver-load-by-non-root-user.asciidoc
@@ -23,13 +23,14 @@ Detects the loading of a Linux kernel module by a non-root user through system c
 
 *Tags*: 
 
+* Data Source: Auditd Manager
 * Domain: Endpoint
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Persistence
 * Tactic: Defense Evasion
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -38,13 +39,48 @@ Detects the loading of a Linux kernel module by a non-root user through system c
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Auditd Manager.
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule the following additional audit rules are required to be added to the integration:
+  -- "-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules"
+  -- "-a always,exit -F arch=b32 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules"
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-driver where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
-event.action == "loaded-kernel-module" and auditd.data.syscall in ("init_module", "finit_module") and user.id != "0"
+driver where host.os.type == "linux" and event.action == "loaded-kernel-module" and
+auditd.data.syscall in ("init_module", "finit_module") and user.id != "0"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kernel-driver-load.asciidoc b/docs/detections/prebuilt-rules/rule-details/kernel-driver-load.asciidoc
index 2a36b59775..c4e7ca12bd 100644
--- a/docs/detections/prebuilt-rules/rule-details/kernel-driver-load.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kernel-driver-load.asciidoc
@@ -24,6 +24,7 @@ Detects the loading of a Linux kernel module through system calls. Threat actors
 
 *Tags*: 
 
+* Data Source: Auditd Manager
 * Domain: Endpoint
 * OS: Linux
 * Use Case: Threat Detection
@@ -31,7 +32,7 @@ Detects the loading of a Linux kernel module through system calls. Threat actors
 * Tactic: Defense Evasion
 * Rule Type: BBR
 
-*Version*: 2
+*Version*: 3
 
 *Rule authors*: 
 
@@ -40,13 +41,40 @@ Detects the loading of a Linux kernel module through system calls. Threat actors
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+*Setup*
+
+This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. 
+
+```
+Kibana -->
+Management -->
+Integrations -->
+Auditd Manager -->
+Add Auditd Manager
+```
+
+`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from. 
+
+For this detection rule to trigger, the following additional audit rules are required to be added to the integration:
+```
+-a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules
+-a always,exit -F arch=b32 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules
+```
+
+Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-driver where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
-event.action == "loaded-kernel-module" and auditd.data.syscall in ("init_module", "finit_module")
+driver where host.os.type == "linux" and event.action == "loaded-kernel-module" and
+auditd.data.syscall in ("init_module", "finit_module")
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kernel-load-or-unload-via-kexec-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/kernel-load-or-unload-via-kexec-detected.asciidoc
index 91f47570ee..db4b9bf0a3 100644
--- a/docs/detections/prebuilt-rules/rule-details/kernel-load-or-unload-via-kexec-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kernel-load-or-unload-via-kexec-detected.asciidoc
@@ -44,6 +44,41 @@ This detection rule identifies the usage of kexec, helping to uncover unauthoriz
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kernel-module-load-via-insmod.asciidoc b/docs/detections/prebuilt-rules/rule-details/kernel-module-load-via-insmod.asciidoc
index d8fee1a3db..26124a336f 100644
--- a/docs/detections/prebuilt-rules/rule-details/kernel-module-load-via-insmod.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kernel-module-load-via-insmod.asciidoc
@@ -46,11 +46,13 @@ Detects the use of the insmod binary to load a Linux kernel object file. Threat
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Kernel module load via insmod
+*Triage and analysis*
+
+
+
+*Investigating Kernel module load via insmod*
+
 
 The insmod binary is a Linux utility that allows users with root privileges to load kernel modules, which are object files that extend the functionality of the kernel. 
 
@@ -59,10 +61,12 @@ Threat actors can abuse this utility to load rootkits, granting them full contro
 The detection rule 'Kernel module load via insmod' is designed to identify instances where the insmod binary is used to load a kernel object file (with a .ko extension) on a Linux system. This activity is uncommon and may indicate suspicious or malicious behavior.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Investigate the kernel object file that was loaded via insmod.
   - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
@@ -89,13 +93,17 @@ The detection rule 'Kernel module load via insmod' is designed to identify insta
 - Investigate whether the user is currently logged in and active.
     - $osquery_6
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator who uses cron jobs for administrative purposes, consider adding exceptions for this specific administrator user account. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Kernel Driver Load - 3e12a439-d002-4944-bc42-171c0dcb9b96
 - Tainted Out-Of-Tree Kernel Module Load - 51a09737-80f7-4551-a3be-dac8ef5d181a
@@ -106,7 +114,9 @@ The detection rule 'Kernel module load via insmod' is designed to identify insta
 - Kernel Module Removal - cd66a5af-e34b-4bb0-8931-57d0a043f2ef
 - Enumeration of Kernel Modules - 2d8043ed-5bda-4caf-801c-c1feb7410504
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -120,7 +130,41 @@ The detection rule 'Kernel module load via insmod' is designed to identify insta
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kernel-module-removal.asciidoc b/docs/detections/prebuilt-rules/rule-details/kernel-module-removal.asciidoc
index 0e37cb2928..cedfa0578b 100644
--- a/docs/detections/prebuilt-rules/rule-details/kernel-module-removal.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kernel-module-removal.asciidoc
@@ -33,7 +33,7 @@ Kernel modules are pieces of code that can be loaded and unloaded into the kerne
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
@@ -42,13 +42,48 @@ Kernel modules are pieces of code that can be loaded and unloaded into the kerne
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-process where host.os.type == "linux" and event.action == "exec" and process.name == "rmmod" or
-(process.name == "modprobe" and process.args in ("--remove", "-r")) and 
+process where host.os.type == "linux" and event.action in ("exec", "exec_event") and event.type == "start" and
+process.name == "rmmod" or (process.name == "modprobe" and process.args in ("--remove", "-r")) and 
 process.parent.name in ("sudo", "bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/keychain-password-retrieval-via-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/keychain-password-retrieval-via-command-line.asciidoc
index 71af9ed37b..d0aeaf2917 100644
--- a/docs/detections/prebuilt-rules/rule-details/keychain-password-retrieval-via-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/keychain-password-retrieval-via-command-line.asciidoc
@@ -43,6 +43,41 @@ Adversaries may collect keychain storage data from a system to in order to acqui
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/krbtgt-delegation-backdoor.asciidoc b/docs/detections/prebuilt-rules/rule-details/krbtgt-delegation-backdoor.asciidoc
index e45919fc07..a561b787e5 100644
--- a/docs/detections/prebuilt-rules/rule-details/krbtgt-delegation-backdoor.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/krbtgt-delegation-backdoor.asciidoc
@@ -44,6 +44,25 @@ Identifies the modification of the msDS-AllowedToDelegateTo attribute to KRBTGT.
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+The 'Audit User Account Management' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+Account Management >
+Audit User Account Management (Success,Failure)
+```
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-anonymous-request-authorized.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-anonymous-request-authorized.asciidoc
index 13f8e18c3f..ca6c58a68c 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-anonymous-request-authorized.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-anonymous-request-authorized.asciidoc
@@ -42,10 +42,12 @@ This rule detects when an unauthenticated user request is authorized within the
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-container-created-with-excessive-linux-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-container-created-with-excessive-linux-capabilities.asciidoc
index 8bd366e589..1948751eb8 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-container-created-with-excessive-linux-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-container-created-with-excessive-linux-capabilities.asciidoc
@@ -44,11 +44,13 @@ This rule detects a container deployed with one or more dangerously permissive L
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Kubernetes Container Created with Excessive Linux Capabilities
+*Triage and analysis*
+
+
+
+*Investigating Kubernetes Container Created with Excessive Linux Capabilities*
+
 
 Linux capabilities were designed to divide root privileges into smaller units. Each capability grants a thread just enough power to perform specific privileged tasks. In Kubernetes, containers are given a set of default capabilities that can be dropped or added to at the time of creation. Added capabilities entitle containers in a pod with additional privileges that can be used to change
 core processes, change network settings of a cluster, or directly access the underlying host. The following have been used in container escape techniques:
@@ -63,10 +65,16 @@ SYS_PTRACE - Trace arbitrary processes using ptrace(2).
 SYS_RAWIO - Perform I/O port operations (iopl(2) and ioperm(2)).
 SYSLOG - Perform privileged syslog(2) operations.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - While these capabilities are not included by default in containers, some legitimate images may need to add them. This rule leaves space for the exception of trusted container images. To add an exception, add the trusted container image name to the query field, kubernetes.audit.requestObject.spec.containers.image.
-----------------------------------
+
+==== Setup
+
+
+The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-denied-service-account-request.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-denied-service-account-request.asciidoc
index 90e1c1675c..3883222a73 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-denied-service-account-request.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-denied-service-account-request.asciidoc
@@ -41,10 +41,12 @@ This rule detects when a service account makes an unauthorized request for resou
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-exposed-service-created-with-type-nodeport.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-exposed-service-created-with-type-nodeport.asciidoc
index 95de5ec3f2..361fa900d8 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-exposed-service-created-with-type-nodeport.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-exposed-service-created-with-type-nodeport.asciidoc
@@ -43,10 +43,12 @@ This rule detects an attempt to create or modify a service as type NodePort. The
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-a-sensitive-hostpath-volume.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-a-sensitive-hostpath-volume.asciidoc
index 1efcc355ec..7a31bde0fa 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-a-sensitive-hostpath-volume.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-a-sensitive-hostpath-volume.asciidoc
@@ -42,10 +42,12 @@ This rule detects when a pod is created with a sensitive volume of type hostPath
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostipc.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostipc.asciidoc
index e4fa9dd324..563eee1bb4 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostipc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostipc.asciidoc
@@ -43,10 +43,12 @@ This rule detects an attempt to create or modify a pod using the host IPC namesp
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostnetwork.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostnetwork.asciidoc
index bdcdeb3847..70177635a4 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostnetwork.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostnetwork.asciidoc
@@ -43,10 +43,12 @@ This rules detects an attempt to create or modify a pod attached to the host net
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostpid.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostpid.asciidoc
index 17ed5188bc..f939032c83 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostpid.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-pod-created-with-hostpid.asciidoc
@@ -43,10 +43,12 @@ This rule detects an attempt to create or modify a pod attached to the host PID
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-privileged-pod-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-privileged-pod-created.asciidoc
index 5d0ccb441c..974feec576 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-privileged-pod-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-privileged-pod-created.asciidoc
@@ -42,10 +42,12 @@ This rule detects when a user creates a pod/container running in privileged mode
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-assignment-of-controller-service-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-assignment-of-controller-service-account.asciidoc
index 831cd8aaa7..24b0993939 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-assignment-of-controller-service-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-assignment-of-controller-service-account.asciidoc
@@ -41,10 +41,12 @@ This rule detects a request to attach a controller service account to an existin
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-self-subject-review.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-self-subject-review.asciidoc
index 45d7781a1d..1f77df6b44 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-self-subject-review.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-suspicious-self-subject-review.asciidoc
@@ -42,10 +42,12 @@ This rule detects when a service account or node attempts to enumerate their own
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kubernetes-user-exec-into-pod.asciidoc b/docs/detections/prebuilt-rules/rule-details/kubernetes-user-exec-into-pod.asciidoc
index 0d019bf1d7..5bbc870f48 100644
--- a/docs/detections/prebuilt-rules/rule-details/kubernetes-user-exec-into-pod.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kubernetes-user-exec-into-pod.asciidoc
@@ -41,10 +41,12 @@ This rule detects a user attempt to establish a shell session into a pod using t
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lateral-movement-via-startup-folder.asciidoc b/docs/detections/prebuilt-rules/rule-details/lateral-movement-via-startup-folder.asciidoc
index de417e0fba..29ff47388d 100644
--- a/docs/detections/prebuilt-rules/rule-details/lateral-movement-via-startup-folder.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lateral-movement-via-startup-folder.asciidoc
@@ -44,6 +44,17 @@ Identifies suspicious file creations in the startup folder of a remote system. A
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/launch-agent-creation-or-modification-and-immediate-loading.asciidoc b/docs/detections/prebuilt-rules/rule-details/launch-agent-creation-or-modification-and-immediate-loading.asciidoc
index f01e5fe8ba..a04a1868c1 100644
--- a/docs/detections/prebuilt-rules/rule-details/launch-agent-creation-or-modification-and-immediate-loading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/launch-agent-creation-or-modification-and-immediate-loading.asciidoc
@@ -40,6 +40,41 @@ An adversary can establish persistence by installing a new launch agent that exe
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/launchdaemon-creation-or-modification-and-immediate-loading.asciidoc b/docs/detections/prebuilt-rules/rule-details/launchdaemon-creation-or-modification-and-immediate-loading.asciidoc
index 931f8c83bd..dd7e58796c 100644
--- a/docs/detections/prebuilt-rules/rule-details/launchdaemon-creation-or-modification-and-immediate-loading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/launchdaemon-creation-or-modification-and-immediate-loading.asciidoc
@@ -40,6 +40,41 @@ Indicates the creation or modification of a launch daemon, which adversaries may
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
index c29e4d1aab..9900920876 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
@@ -41,11 +41,13 @@ Identifies attempts to create a new group. Attackers may create new groups to es
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Linux Group Creation
+*Triage and analysis*
+
+
+
+*Investigating Linux Group Creation*
+
 
 The `groupadd` and `addgroup` commands are used to create new user groups in Linux-based operating systems.
 
@@ -54,10 +56,12 @@ Attackers may create new groups to maintain access to victim systems or escalate
 This rule identifies the usages of `groupadd` and `addgroup` to create new groups.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate whether the group was created succesfully.
   - !{osquery{"label":"Osquery - Retrieve Information for a Specific Group","query":"SELECT * FROM groups WHERE groupname = {{group.name}}"}}
@@ -70,11 +74,15 @@ This rule identifies the usages of `groupadd` and `addgroup` to create new group
   - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Group creation is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -91,7 +99,36 @@ This rule identifies the usages of `groupadd` and `addgroup` to create new group
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Filebeat.
+
+
+*Filebeat Setup*
+
+Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing.
+
+
+*The following steps should be executed in order to add the Filebeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html[helper guide].
+- To run Filebeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html[helper guide].
+- To run Filebeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html[helper guide].
+- For quick start information for Filebeat refer to the https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html[helper guide].
+- For complete “Setup and Run Filebeat” information refer to the https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html[helper guide].
+
+
+*Rule Specific Setup Note*
+
+- This rule requires the “Filebeat System Module” to be enabled.
+- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions.
+- To run the system module of Filebeat on Linux follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-init-pid-1-secret-dump-via-gdb.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-init-pid-1-secret-dump-via-gdb.asciidoc
index 0f08b7f018..d48719dbdf 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-init-pid-1-secret-dump-via-gdb.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-init-pid-1-secret-dump-via-gdb.asciidoc
@@ -8,6 +8,7 @@ This rule monitors for the potential memory dump of the init process (PID 1) thr
 *Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
@@ -31,8 +32,9 @@ This rule monitors for the potential memory dump of the init process (PID 1) thr
 * Use Case: Threat Detection
 * Tactic: Credential Access
 * Data Source: Elastic Defend
+* Data Source: Elastic Endgame
 
-*Version*: 3
+*Version*: 5
 
 *Rule authors*: 
 
@@ -41,12 +43,47 @@ This rule monitors for the potential memory dump of the init process (PID 1) thr
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and 
+process where host.os.type == "linux" and event.action in ("exec", "exec_event") and event.type == "start" and 
 process.name == "gdb" and process.args in ("--pid", "-p") and process.args == "1"
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
index 21bb4c5e5f..3160f1a5a2 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
@@ -68,11 +68,13 @@ Identifies the abuse of a Linux binary to break out of a restricted shell or env
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Shell Evasion via Linux Utilities
+*Triage and analysis*
+
+
+
+*Investigating Shell Evasion via Linux Utilities*
+
 Detection alerts from this rule indicate that a Linux utility has been abused to breakout of restricted shells or
 environments by spawning an interactive system shell.
 Here are some possible avenues of investigation:
@@ -84,12 +86,16 @@ Here are some possible avenues of investigation:
   - Identify imment threat to the system from the executed commands
   - Take necessary incident response actions to contain any malicious behviour caused via this execution.
 
-### Related rules
+
+*Related rules*
+
 
 - A malicious spawned shell can execute any of the possible MITTRE ATT&CK vectors mainly to impair defences.
 - Hence its adviced to enable defence evasion and privilige escalation rules accordingly in your environment
 
-### Response and remediation
+
+*Response and remediation*
+
 
 Initiate the incident response process based on the outcome of the triage.
 
@@ -116,7 +122,52 @@ Initiate the incident response process based on the outcome of the triage.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+Session View uses process data collected by the Elastic Defend integration, but this data is not always collected by default. Session View is available on enterprise subscription for versions 8.3 and above.
+
+*To confirm that Session View data is enabled:*
+
+- Go to “Manage → Policies”, and edit one or more of your Elastic Defend integration policies.
+- Select the” Policy settings” tab, then scroll down to the “Linux event collection” section near the bottom.
+- Check the box for “Process events”, and turn on the “Include session data” toggle.
+- If you want to include file and network alerts in Session View, check the boxes for “Network and File events”.
+- If you want to enable terminal output capture, turn on the “Capture terminal output” toggle.
+For more information about the additional fields collected when this setting is enabled and the usage of Session View for Analysis refer to the https://www.elastic.co/guide/en/security/current/session-view.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
index e3faf3076b..a67495ec89 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
@@ -41,11 +41,13 @@ Identifies attempts to create new users. Attackers may add new users to establis
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Linux User Account Creation
+*Triage and analysis*
+
+
+
+*Investigating Linux User Account Creation*
+
 
 The `useradd` and `adduser` commands are used to create new user accounts in Linux-based operating systems.
 
@@ -54,10 +56,12 @@ Attackers may create new accounts (both local and domain) to maintain access to
 This rule identifies the usage of `useradd` and `adduser` to create new accounts.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate whether the user was created succesfully.
   - !{osquery{"label":"Osquery - Retrieve Information for a Specific User","query":"SELECT * FROM users WHERE username = {{user.name}}"}}
@@ -70,11 +74,15 @@ This rule identifies the usage of `useradd` and `adduser` to create new accounts
   - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Account creation is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -90,7 +98,36 @@ This rule identifies the usage of `useradd` and `adduser` to create new accounts
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Filebeat.
+
+
+*Filebeat Setup*
+
+Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing.
+
+
+*The following steps should be executed in order to add the Filebeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html[helper guide].
+- To run Filebeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html[helper guide].
+- To run Filebeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html[helper guide].
+- For quick start information for Filebeat refer to the https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html[helper guide].
+- For complete “Setup and Run Filebeat” information refer to the https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html[helper guide].
+
+
+*Rule Specific Setup Note*
+
+- This rule requires the “Filebeat System Module” to be enabled.
+- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions.
+- To run the system module of Filebeat on Linux follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
index 8bd1b4d32c..5142048a3d 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
@@ -44,11 +44,13 @@ Identifies attempts to add a user to a privileged group. Attackers may add users
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Linux User User Added to Privileged Group
+*Triage and analysis*
+
+
+
+*Investigating Linux User User Added to Privileged Group*
+
 
 The `usermod`, `adduser`, and `gpasswd` commands can be used to assign user accounts to new groups in Linux-based operating systems.
 
@@ -57,10 +59,12 @@ Attackers may add users to a privileged group in order to escalate privileges or
 This rule identifies the usages of `usermod`, `adduser` and `gpasswd` to assign user accounts to a privileged group.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate whether the user was succesfully added to the privileged group.
   - !{osquery{"label":"Osquery - Retrieve Information for a Specific User","query":"SELECT * FROM users WHERE username = {{user.name}}"}}
@@ -73,11 +77,15 @@ This rule identifies the usages of `usermod`, `adduser` and `gpasswd` to assign
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Adding accounts to a group is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -93,7 +101,41 @@ This rule identifies the usages of `usermod`, `adduser` and `gpasswd` to assign
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
index 6e0692172d..a87a3cdebf 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
@@ -49,20 +49,24 @@ Identifies the creation of a Local Security Authority Subsystem Service (lsass.e
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating LSASS Memory Dump Creation
+*Triage and analysis*
+
+
+
+*Investigating LSASS Memory Dump Creation*
+
 
 Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.
 
 This rule looks for the creation of memory dump files with file names compatible with credential dumping tools or that start with `lsass`.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify the process responsible for creating the dump file.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -83,11 +87,15 @@ This rule looks for the creation of memory dump files with file names compatible
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -103,7 +111,17 @@ This rule looks for the creation of memory dump files with file names compatible
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
index efd15d1093..51956d359c 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
@@ -50,20 +50,24 @@ Identifies handle requests for the Local Security Authority Subsystem Service (L
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating LSASS Memory Dump Handle Access
+*Triage and analysis*
+
+
+
+*Investigating LSASS Memory Dump Handle Access*
+
 
 Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.
 
-Adversaries may attempt to access credential material stored in LSASS process memory. After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. This is meant to facilitate single sign-on (SSO) ensuring a user isn’t prompted each time resource access is requested. These credential materials can be harvested by an adversary using administrative user or SYSTEM privileges to conduct lateral movement using [alternate authentication material](https://attack.mitre.org/techniques/T1550/).
+Adversaries may attempt to access credential material stored in LSASS process memory. After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. This is meant to facilitate single sign-on (SSO) ensuring a user isn’t prompted each time resource access is requested. These credential materials can be harvested by an adversary using administrative user or SYSTEM privileges to conduct lateral movement using https://attack.mitre.org/techniques/T1550/[alternate authentication material].
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -83,12 +87,16 @@ Adversaries may attempt to access credential material stored in LSASS process me
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - There should be very few or no false positives for this rule. If this activity is expected or noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If the process is related to antivirus or endpoint detection and response solutions, validate that it is installed on the correct path and signed with the company's valid digital signature.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -105,7 +113,34 @@ Adversaries may attempt to access credential material stored in LSASS process me
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+Ensure advanced audit policies for Windows are enabled, specifically:
+Object Access policies https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656[Event ID 4656] (Handle to an Object was Requested)
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+System Audit Policies >
+Object Access >
+Audit File System (Success,Failure)
+Audit Handle Manipulation (Success,Failure)
+```
+
+Also, this event generates only if the object’s https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists[SACL] has the required access control entry (ACE) to handle the use of specific access rights.
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-process-access-via-windows-api.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-process-access-via-windows-api.asciidoc
index 2eb809ef08..6f79883e2f 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-process-access-via-windows-api.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-process-access-via-windows-api.asciidoc
@@ -44,20 +44,24 @@ Identifies access attempts to the LSASS handle, which may indicate an attempt to
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating LSASS Process Access via Windows API
+*Triage and analysis*
+
+
+
+*Investigating LSASS Process Access via Windows API*
+
 
 The Local Security Authority Subsystem Service (LSASS) is a critical Windows component responsible for managing user authentication and security policies. Adversaries may attempt to access the LSASS handle to dump credentials from its memory, which can be used for lateral movement and privilege escalation.
 
 This rule identifies attempts to access LSASS by monitoring for specific API calls (OpenProcess, OpenThread) targeting the "lsass.exe" process.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate the process execution chain (parent process tree) of the process that accessed the LSASS handle.
@@ -65,7 +69,7 @@ This rule identifies attempts to access LSASS by monitoring for specific API cal
   - Determine the first time the process executable was seen in the environment and if this behavior happened in the past.
   - Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
   - Investigate any abnormal behavior by the subject process, such as network connections, DLLs loaded, registry or file modifications, and any spawned child processes.
-- Assess the access rights (`process.Ext.api.parameters.desired_access`field) requested by the process. This [Microsoft documentation](https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights) may be useful to help the interpretation.
+- Assess the access rights (`process.Ext.api.parameters.desired_access`field) requested by the process. This https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights[Microsoft documentation] may be useful to help the interpretation.
 - If there are traces of LSASS memory being successfully dumped, investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host.
 - Examine the host for derived artifacts that indicate suspicious activities:
   - Analyze the executables of the processes using a private sandboxed analysis system.
@@ -82,17 +86,23 @@ This rule identifies attempts to access LSASS by monitoring for specific API cal
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of `process.executable`, `process.code_signature.subject_name` and `process.Ext.api.parameters.desired_access_numeric` conditions.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Suspicious Lsass Process Access - 128468bf-cab1-4637-99ea-fdf3780a4609
 - Potential Credential Access via DuplicateHandle in LSASS - 02a4576a-7480-4284-9327-548a806b5e48
 - LSASS Memory Dump Handle Access - 208dbe77-01ed-4954-8d44-1e5751cb20de
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
   - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
@@ -109,7 +119,6 @@ This rule identifies attempts to access LSASS by monitoring for specific API cal
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-dns-request-predicted-to-be-a-dga-domain.asciidoc b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-dns-request-predicted-to-be-a-dga-domain.asciidoc
index e048c7687f..e9c3542f44 100644
--- a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-dns-request-predicted-to-be-a-dga-domain.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-dns-request-predicted-to-be-a-dga-domain.asciidoc
@@ -45,6 +45,64 @@ A supervised machine learning model has identified a DNS question name that is p
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Domain Generation Algorithm (DGA) Detection integration assets to be installed, as well as DNS events collected by integrations such as Elastic Defend, Network Packet Capture, or Packetbeat.  
+
+
+*DGA Detection Setup*
+
+The DGA Detection integration consists of an ML-based framework to detect DGA activity in DNS events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for DGA Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- DNS events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend], https://docs.elastic.co/integrations/network_traffic[Network Packet Capture] integration, or https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-overview.html[Packetbeat].
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To add the Network Packet Capture integration to an Elastic Agent policy, refer to https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html[this] guide.
+- To set up and run Packetbeat, follow https://www.elastic.co/guide/en/beats/packetbeat/current/setting-up-and-running.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the DGA Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Domain Generation Algorithm Detection and select the integration to see more details about it.
+- Under Settings, click Install Domain Generation Algorithm Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+Before you can enable this rule, you'll need to enrich DNS events with predictions from the Supervised DGA Detection model. This is done via the ingest pipeline named `<package_version>-ml_dga_ingest_pipeline` installed with the DGA Detection package.
+- If using an Elastic Beat such as Packetbeat, add the DGA ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `packetbeat.yml`.
+- If adding the DGA ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the DGA ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "ml_is_dga": {
+      "properties": {
+        "malicious_prediction": {
+          "type": "long"
+        },
+        "malicious_probability": {
+          "type": "float"
+        }
+      }
+    }
+  }
+}
+```
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-dns-request-with-a-high-dga-probability-score.asciidoc b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-dns-request-with-a-high-dga-probability-score.asciidoc
index f5381b9946..c2456658e3 100644
--- a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-dns-request-with-a-high-dga-probability-score.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-dns-request-with-a-high-dga-probability-score.asciidoc
@@ -45,6 +45,64 @@ A supervised machine learning model has identified a DNS question name with a hi
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Domain Generation Algorithm (DGA) Detection integration assets to be installed, as well as DNS events collected by integrations such as Elastic Defend, Network Packet Capture, or Packetbeat.  
+
+
+*DGA Detection Setup*
+
+The DGA Detection integration consists of an ML-based framework to detect DGA activity in DNS events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for DGA Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- DNS events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend], https://docs.elastic.co/integrations/network_traffic[Network Packet Capture] integration, or https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-overview.html[Packetbeat].
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To add the Network Packet Capture integration to an Elastic Agent policy, refer to https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html[this] guide.
+- To set up and run Packetbeat, follow https://www.elastic.co/guide/en/beats/packetbeat/current/setting-up-and-running.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the DGA Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Domain Generation Algorithm Detection and select the integration to see more details about it.
+- Under Settings, click Install Domain Generation Algorithm Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+Before you can enable this rule, you'll need to enrich DNS events with predictions from the Supervised DGA Detection model. This is done via the ingest pipeline named `<package_version>-ml_dga_ingest_pipeline` installed with the DGA Detection package.
+- If using an Elastic Beat such as Packetbeat, add the DGA ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `packetbeat.yml`.
+- If adding the DGA ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the DGA ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "ml_is_dga": {
+      "properties": {
+        "malicious_prediction": {
+          "type": "long"
+        },
+        "malicious_probability": {
+          "type": "float"
+        }
+      }
+    }
+  }
+}
+```
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity.asciidoc
index 047ef8b942..6dd172138f 100644
--- a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity.asciidoc
@@ -45,6 +45,66 @@ A supervised machine learning model (ProblemChild) has identified a suspicious W
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
index 69c199a411..14ca265767 100644
--- a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
@@ -45,6 +45,66 @@ A supervised machine learning model (ProblemChild) has identified a suspicious W
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain.asciidoc b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain.asciidoc
index e71ea280a2..b68ba26184 100644
--- a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain.asciidoc
@@ -45,6 +45,64 @@ A supervised machine learning model has identified a DNS question name that used
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Domain Generation Algorithm (DGA) Detection integration assets to be installed, as well as DNS events collected by integrations such as Elastic Defend, Network Packet Capture, or Packetbeat.  
+
+
+*DGA Detection Setup*
+
+The DGA Detection integration consists of an ML-based framework to detect DGA activity in DNS events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for DGA Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- DNS events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend], https://docs.elastic.co/integrations/network_traffic[Network Packet Capture] integration, or https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-overview.html[Packetbeat].
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To add the Network Packet Capture integration to an Elastic Agent policy, refer to https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html[this] guide.
+- To set up and run Packetbeat, follow https://www.elastic.co/guide/en/beats/packetbeat/current/setting-up-and-running.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the DGA Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Domain Generation Algorithm Detection and select the integration to see more details about it.
+- Under Settings, click Install Domain Generation Algorithm Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+Before you can enable this rule, you'll need to enrich DNS events with predictions from the Supervised DGA Detection model. This is done via the ingest pipeline named `<package_version>-ml_dga_ingest_pipeline` installed with the DGA Detection package.
+- If using an Elastic Beat such as Packetbeat, add the DGA ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `packetbeat.yml`.
+- If adding the DGA ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the DGA ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "ml_is_dga": {
+      "properties": {
+        "malicious_prediction": {
+          "type": "long"
+        },
+        "malicious_probability": {
+          "type": "float"
+        }
+      }
+    }
+  }
+}
+``` 
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/macos-installer-package-spawns-network-event.asciidoc b/docs/detections/prebuilt-rules/rule-details/macos-installer-package-spawns-network-event.asciidoc
index 772c59d1b1..b662545cb5 100644
--- a/docs/detections/prebuilt-rules/rule-details/macos-installer-package-spawns-network-event.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/macos-installer-package-spawns-network-event.asciidoc
@@ -43,6 +43,41 @@ Detects the execution of a MacOS installer package with an abnormal child proces
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/masquerading-space-after-filename.asciidoc b/docs/detections/prebuilt-rules/rule-details/masquerading-space-after-filename.asciidoc
index 443cfa9644..4ce91b1d2b 100644
--- a/docs/detections/prebuilt-rules/rule-details/masquerading-space-after-filename.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/masquerading-space-after-filename.asciidoc
@@ -42,6 +42,17 @@ This rules identifies a process created from an executable with a space appended
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/mfa-deactivation-with-no-re-activation-for-okta-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/mfa-deactivation-with-no-re-activation-for-okta-user-account.asciidoc
index 592a70afdb..edcc87323c 100644
--- a/docs/detections/prebuilt-rules/rule-details/mfa-deactivation-with-no-re-activation-for-okta-user-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/mfa-deactivation-with-no-re-activation-for-okta-user-account.asciidoc
@@ -45,17 +45,21 @@ Detects multi-factor authentication (MFA) deactivation with no subsequent re-act
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating MFA Deactivation with no Re-Activation for Okta User Account
+*Triage and analysis*
+
+
+
+*Investigating MFA Deactivation with no Re-Activation for Okta User Account*
+
 
 MFA is used to provide an additional layer of security for user accounts. An adversary may achieve MFA deactivation for an Okta user account to achieve persistence.
 
 This rule fires when an Okta user account has MFA deactivated and no subsequent MFA reactivation is observed within 12 hours.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 
 - Identify the actor related to the alert by reviewing `okta.actor.alternate_id` field in the alert. This should give the username of the account being targeted.
 - Review `okta.target` or `user.target.full_name` fields to determine if deactivation was performed by a se parate user.
@@ -63,12 +67,16 @@ This rule fires when an Okta user account has MFA deactivated and no subsequent
 - Review events where `okta.event_type` is `user.authenticate*` to determine if the user account had suspicious login activity.
     - Geolocation details found in `client.geo*` related fields may be useful in determining if the login activity was suspicious for this user.
 
-#### False positive steps:
+
+*False positive steps:*
+
 
 - Determine with the target user if MFA deactivation was expected.
 - Determine if MFA is required for the target user account.
 
-#### Response and remediation:
+
+*Response and remediation:*
+
 
 - If the MFA deactivation was not expected, consider deactivating the user
     - This should be followed by resetting the user's password and re-enabling MFA.
@@ -77,7 +85,12 @@ This rule fires when an Okta user account has MFA deactivated and no subsequent
 - Encourage users to use complex, unique passwords and consider implementing multi-factor authentication.
 - Check if the compromised account was used to access or alter any sensitive data, applications or systems.
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/mfa-disabled-for-google-workspace-organization.asciidoc b/docs/detections/prebuilt-rules/rule-details/mfa-disabled-for-google-workspace-organization.asciidoc
index 484eced8d0..6f31ded95c 100644
--- a/docs/detections/prebuilt-rules/rule-details/mfa-disabled-for-google-workspace-organization.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/mfa-disabled-for-google-workspace-organization.asciidoc
@@ -42,21 +42,25 @@ Detects when multi-factor authentication (MFA) is disabled for a Google Workspac
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating MFA Disabled for Google Workspace Organization
+*Triage and analysis*
+
+
+
+*Investigating MFA Disabled for Google Workspace Organization*
+
 
 Multi-factor authentication (MFA) is a process in which users are prompted for an additional form of identification, such as a code on their cell phone or a fingerprint scan, during the sign-in process.
 
 If you only use a password to authenticate a user, it leaves an insecure vector for attack. If the users's password is weak or has been exposed elsewhere, an attacker could use it to gain access. Requiring a second form of authentication increases security because attackers cannot easily obtain or duplicate the additional authentication factor.
 
-For more information about using MFA in Google Workspace, access the [official documentation](https://support.google.com/a/answer/175197).
+For more information about using MFA in Google Workspace, access the https://support.google.com/a/answer/175197[official documentation].
 
 This rule identifies when MFA enforcement is turned off in Google Workspace. This modification weakens account security and can lead to accounts and other assets being compromised.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -64,11 +68,15 @@ This rule identifies when MFA enforcement is turned off in Google Workspace. Thi
 - Check if this operation was approved and performed according to the organization's change management policy.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - While this activity can be done by administrators, all users must use MFA. The security team should address any potential benign true positive (B-TP), as this configuration can risk the user and domain.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -81,13 +89,15 @@ This rule identifies when MFA enforcement is turned off in Google Workspace. Thi
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Reactivate the multi-factor authentication enforcement.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://support.google.com/a/answer/7587183) by Google.
+- Implement security best practices https://support.google.com/a/answer/7587183[outlined] by Google.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
 
-### Important Information Regarding Google Workspace Event Lag Times
+
+*Important Information Regarding Google Workspace Event Lag Times*
+
 - As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
 - This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
 - To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
@@ -95,7 +105,11 @@ This rule identifies when MFA enforcement is turned off in Google Workspace. Thi
 - See the following references for further information:
   - https://support.google.com/a/answer/7061566
   - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html
-----------------------------------
+
+==== Setup
+
+
+The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-policy-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-policy-deletion.asciidoc
index c098901fb1..7000a87fde 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-policy-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-policy-deletion.asciidoc
@@ -44,10 +44,12 @@ Identifies the deletion of an anti-phishing policy in Microsoft 365. By default,
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-rule-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-rule-modification.asciidoc
index d51d280a0f..ebf5498bf7 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-rule-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-rule-modification.asciidoc
@@ -44,10 +44,12 @@ Identifies the modification of an anti-phishing rule in Microsoft 365. By defaul
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dkim-signing-configuration-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dkim-signing-configuration-disabled.asciidoc
index ea42c677f4..07c457cfc3 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dkim-signing-configuration-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dkim-signing-configuration-disabled.asciidoc
@@ -42,10 +42,12 @@ Identifies when a DomainKeys Identified Mail (DKIM) signing configuration is dis
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dlp-policy-removed.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dlp-policy-removed.asciidoc
index 949038eb11..61125b2d8e 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dlp-policy-removed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dlp-policy-removed.asciidoc
@@ -44,10 +44,12 @@ Identifies when a Data Loss Prevention (DLP) policy is removed in Microsoft 365.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-policy-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-policy-deletion.asciidoc
index 69d56d7382..404199547c 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-policy-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-policy-deletion.asciidoc
@@ -43,10 +43,12 @@ Identifies when a malware filter policy has been deleted in Microsoft 365. A mal
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-rule-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-rule-modification.asciidoc
index b1f37a4811..39b36259fb 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-rule-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-rule-modification.asciidoc
@@ -44,10 +44,12 @@ Identifies when a malware filter rule has been deleted or disabled in Microsoft
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-management-group-role-assignment.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-management-group-role-assignment.asciidoc
index 9630309c83..3ce4771c73 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-management-group-role-assignment.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-management-group-role-assignment.asciidoc
@@ -44,10 +44,12 @@ Identifies when a new role is assigned to a management group in Microsoft 365. A
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-attachment-rule-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-attachment-rule-disabled.asciidoc
index 95d5b855b8..3d3345a257 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-attachment-rule-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-attachment-rule-disabled.asciidoc
@@ -43,10 +43,12 @@ Identifies when a safe attachment rule is disabled in Microsoft 365. Safe attach
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-link-policy-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-link-policy-disabled.asciidoc
index e6f1cbbc17..6c060ca444 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-link-policy-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-link-policy-disabled.asciidoc
@@ -44,10 +44,12 @@ Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link polic
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-creation.asciidoc
index f4259ae208..71c1b6aec0 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-creation.asciidoc
@@ -44,10 +44,12 @@ Identifies a transport rule creation in Microsoft 365. As a best practice, Excha
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-modification.asciidoc
index b1f7aa2c42..958dc937d8 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-modification.asciidoc
@@ -45,10 +45,12 @@ Identifies when a transport rule has been disabled or deleted in Microsoft 365.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc
index e8fd851fb0..d859b2f375 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc
@@ -43,10 +43,12 @@ In Azure Active Directory (Azure AD), permissions to manage resources are assign
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-impossible-travel-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-impossible-travel-activity.asciidoc
index 390bc634a2..72ac7bbc9c 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-impossible-travel-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-impossible-travel-activity.asciidoc
@@ -44,10 +44,12 @@ Identifies when a Microsoft Cloud App Security reported a risky sign-in attempt
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-inbox-forwarding-rule-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-inbox-forwarding-rule-created.asciidoc
index 5f7d1fdf59..6896ede46f 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-inbox-forwarding-rule-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-inbox-forwarding-rule-created.asciidoc
@@ -48,10 +48,12 @@ Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox r
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-mass-download-by-a-single-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-mass-download-by-a-single-user.asciidoc
index 129e35eb1b..8d013480b2 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-mass-download-by-a-single-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-mass-download-by-a-single-user.asciidoc
@@ -44,10 +44,12 @@ Identifies when Microsoft Cloud App Security reports that a single user performs
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-potential-ransomware-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-potential-ransomware-activity.asciidoc
index 6e6a08e29d..1d9a2c36bc 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-potential-ransomware-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-potential-ransomware-activity.asciidoc
@@ -44,10 +44,12 @@ Identifies when Microsoft Cloud App Security reports that a user has uploaded fi
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-custom-application-interaction-allowed.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-custom-application-interaction-allowed.asciidoc
index ac0492d742..e0a849efe4 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-custom-application-interaction-allowed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-custom-application-interaction-allowed.asciidoc
@@ -43,10 +43,12 @@ Identifies when custom applications are allowed in Microsoft Teams. If an organi
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-external-access-enabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-external-access-enabled.asciidoc
index 8eb262a597..2ce3c83a08 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-external-access-enabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-external-access-enabled.asciidoc
@@ -43,10 +43,12 @@ Identifies when external access is enabled in Microsoft Teams. External access l
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-guest-access-enabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-guest-access-enabled.asciidoc
index 4b30b8b6f1..2e251e1341 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-guest-access-enabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-guest-access-enabled.asciidoc
@@ -43,10 +43,12 @@ Identifies when guest access is enabled in Microsoft Teams. Guest access in Team
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-unusual-volume-of-file-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-unusual-volume-of-file-deletion.asciidoc
index 9a0d3d39ee..a43d72054b 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-unusual-volume-of-file-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-unusual-volume-of-file-deletion.asciidoc
@@ -44,10 +44,12 @@ Identifies that a user has deleted an unusually large volume of files as reporte
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-user-restricted-from-sending-email.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-user-restricted-from-sending-email.asciidoc
index bd62a33794..78e8574883 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-user-restricted-from-sending-email.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-user-restricted-from-sending-email.asciidoc
@@ -44,10 +44,12 @@ Identifies when a user has been restricted from sending email due to exceeding s
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-an-unusual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-an-unusual-process.asciidoc
index c9f9b6a55e..93d639491f 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-an-unusual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-an-unusual-process.asciidoc
@@ -44,6 +44,17 @@ An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-script-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-script-process.asciidoc
index 20e4320df9..7151cad94b 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-script-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-script-process.asciidoc
@@ -41,6 +41,17 @@ An instance of MSBuild, the Microsoft Build Engine, was started by a script or t
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-system-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-system-process.asciidoc
index f819f9930e..caab5caed2 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-system-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-system-process.asciidoc
@@ -43,6 +43,17 @@ An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or t
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-an-office-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-an-office-application.asciidoc
index 71fb6372a7..b1e0f4066e 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-an-office-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-an-office-application.asciidoc
@@ -49,11 +49,13 @@ An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Microsoft Build Engine Started by an Office Application
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Build Engine Started by an Office Application*
+
 
 Microsoft Office (MS Office) is a suite of applications designed to help with productivity and completing common tasks on a computer. You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create presentations and posters. As it is some of the most-used software across companies, MS Office is frequently targeted for initial access. It also has a wide variety of capabilities that attackers can take advantage of.
 
@@ -61,7 +63,9 @@ The Microsoft Build Engine is a platform for building applications. This engine,
 
 This rule looks for the `Msbuild.exe` utility spawned by MS Office programs. This is generally the result of the execution of malicious documents.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
@@ -77,11 +81,15 @@ This rule looks for the `Msbuild.exe` utility spawned by MS Office programs. Thi
   - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -102,7 +110,17 @@ This rule looks for the `Msbuild.exe` utility spawned by MS Office programs. Thi
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
index 5ecbbe23a5..4448aebd28 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
@@ -47,11 +47,13 @@ An instance of MSBuild, the Microsoft Build Engine, was started after being rena
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Microsoft Build Engine Using an Alternate Name
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Build Engine Using an Alternate Name*
+
 
 The OriginalFileName attribute of a PE (Portable Executable) file is a metadata field that contains the original name of the executable file when compiled or linked. By using this attribute, analysts can identify renamed instances that attackers can use with the intent of evading detections, application allowlists, and other security protections.
 
@@ -60,9 +62,11 @@ The Microsoft Build Engine is a platform for building applications. This engine,
 This rule checks for renamed instances of MSBuild, which can indicate an attempt of evading detections, application allowlists, and other security protections.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -81,11 +85,15 @@ This rule checks for renamed instances of MSBuild, which can indicate an attempt
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -100,7 +108,17 @@ This rule checks for renamed instances of MSBuild, which can indicate an attempt
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc
index 5914cd699d..83fcc5fbe6 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc
@@ -49,6 +49,17 @@ Identifies suspicious processes being spawned by the Microsoft Exchange Server U
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-writing-suspicious-files.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-writing-suspicious-files.asciidoc
index a73c56635f..c4e2f8abd3 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-writing-suspicious-files.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-writing-suspicious-files.asciidoc
@@ -51,19 +51,29 @@ Identifies suspicious files being written by the Microsoft Exchange Server Unifi
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-Positive hits can be checked against the established Microsoft [baselines](https://github.com/microsoft/CSS-Exchange/tree/main/Security/Baselines).
+*Triage and analysis*
+
+
+Positive hits can be checked against the established Microsoft https://github.com/microsoft/CSS-Exchange/tree/main/Security/Baselines[baselines].
 
 Microsoft highly recommends that the best course of action is patching, but this may not protect already compromised systems
 from existing intrusions. Other tools for detecting and mitigating can be found within their Exchange support
-[repository](https://github.com/microsoft/CSS-Exchange/tree/main/Security)
+https://github.com/microsoft/CSS-Exchange/tree/main/Security[repository]
 
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-transport-agent-install-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-transport-agent-install-script.asciidoc
index edbd831281..2bc1db9853 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-transport-agent-install-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-transport-agent-install-script.asciidoc
@@ -31,7 +31,7 @@ Identifies the use of Cmdlets and methods related to Microsoft Exchange Transpor
 * Data Source: PowerShell Logs
 * Rule Type: BBR
 
-*Version*: 2
+*Version*: 3
 
 *Rule authors*: 
 
@@ -40,6 +40,24 @@ Identifies the use of Cmdlets and methods related to Microsoft Exchange Transpor
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+Steps to implement the logging policy via registry:
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
 ==== Rule query
 
 
@@ -51,7 +69,13 @@ event.category: "process" and host.os.type:windows and
     "Install-TransportAgent" or
     "Enable-TransportAgent"
     )
-  ) and not user.id : "S-1-5-18"
+  ) and
+  not user.id : "S-1-5-18" and
+  not powershell.file.script_block_text : (
+    "'Install-TransportAgent', 'Invoke-MonitoringProbe', 'Mount-Database', 'Move-ActiveMailboxDatabase'," or
+    "'Enable-TransportAgent', 'Enable-TransportRule', 'Export-ActiveSyncLog', 'Export-AutoDiscoverConfig'," or
+    ("scriptCmd.GetSteppablePipeline" and "ForwardHelpTargetName Install-TransportAgent")
+  )
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
index 0cce934fe6..aa3f8604a1 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
@@ -47,6 +47,17 @@ Identifies suspicious processes being spawned by the Microsoft Exchange Server w
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-iis-connection-strings-decryption.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-iis-connection-strings-decryption.asciidoc
index d151e31a1d..1f65a89d7f 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-iis-connection-strings-decryption.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-iis-connection-strings-decryption.asciidoc
@@ -46,6 +46,17 @@ Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-iis-service-account-password-dumped.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-iis-service-account-password-dumped.asciidoc
index 06ad200258..209e630f72 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-iis-service-account-password-dumped.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-iis-service-account-password-dumped.asciidoc
@@ -45,6 +45,17 @@ Identifies the Internet Information Services (IIS) command-line tool, AppCmd, be
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-windows-defender-tampering.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-windows-defender-tampering.asciidoc
index 8409cd0c4b..dfdf5fbf02 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-windows-defender-tampering.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-windows-defender-tampering.asciidoc
@@ -53,17 +53,21 @@ Identifies when one or more features on Microsoft Defender are disabled. Adversa
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Microsoft Windows Defender Tampering
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Windows Defender Tampering*
+
 
 Microsoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple environments. Disabling it is a common step in threat actor playbooks.
 
 This rule monitors the registry for modifications that disable Windows Defender features.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
@@ -72,16 +76,22 @@ This rule monitors the registry for modifications that disable Windows Defender
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Examine which features have been disabled, and check if this operation is done under change management and approved according to the organization's policy.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity, the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting), and no other suspicious activity has been observed.
 
-### Related rules
+
+*Related rules*
+
 
 - Windows Defender Disabled via Registry Modification - 2ffa1f1e-b6db-47fa-994b-1512743847eb
 - Disabling Windows Defender Security Settings via PowerShell - c8cccb06-faf2-4cd5-886e-2c9636cfcb87
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -93,7 +103,17 @@ This rule monitors the registry for modifications that disable Windows Defender
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/mimikatz-memssp-log-file-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/mimikatz-memssp-log-file-detected.asciidoc
index 2baad222c2..9a7451053c 100644
--- a/docs/detections/prebuilt-rules/rule-details/mimikatz-memssp-log-file-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/mimikatz-memssp-log-file-detected.asciidoc
@@ -48,17 +48,21 @@ Identifies the password log file from the default Mimikatz memssp module.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Mimikatz Memssp Log File Detected
+*Triage and analysis*
+
+
+
+*Investigating Mimikatz Memssp Log File Detected*
+
 
-[Mimikatz](https://github.com/gentilkiwi/mimikatz) is an open-source tool used to collect, decrypt, and/or use cached credentials. This tool is commonly abused by adversaries during the post-compromise stage where adversaries have gained an initial foothold on an endpoint and are looking to elevate privileges and seek out additional authentication objects such as tokens/hashes/credentials that can then be used to laterally move and pivot across a network.
+https://github.com/gentilkiwi/mimikatz[Mimikatz] is an open-source tool used to collect, decrypt, and/or use cached credentials. This tool is commonly abused by adversaries during the post-compromise stage where adversaries have gained an initial foothold on an endpoint and are looking to elevate privileges and seek out additional authentication objects such as tokens/hashes/credentials that can then be used to laterally move and pivot across a network.
 
 This rule looks for the creation of a file named `mimilsa.log`, which is generated when using the Mimikatz misc::memssp module, which injects a malicious Windows SSP to collect locally authenticated credentials, which includes the computer account password, running service credentials, and any accounts that logon.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -69,15 +73,21 @@ This rule looks for the creation of a file named `mimilsa.log`, which is generat
     - Search for the existence of these files in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
   - Identify the process that created the DLL using file creation events.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This file name `mimilsa.log` should not legitimately be created.
 
-### Related rules
+
+*Related rules*
+
 
 - Mimikatz Powershell Module Activity - ac96ceb8-4399-4191-af1d-4feeac1f1f46
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -92,7 +102,17 @@ This rule looks for the creation of a file named `mimilsa.log`, which is generat
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-amsienable-registry-key.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-amsienable-registry-key.asciidoc
index 0acffbda10..5bfb2c68af 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-amsienable-registry-key.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-amsienable-registry-key.asciidoc
@@ -49,11 +49,13 @@ Identifies modifications of the AmsiEnable registry key to 0, which disables the
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Modification of AmsiEnable Registry Key
+*Triage and analysis*
+
+
+
+*Investigating Modification of AmsiEnable Registry Key*
+
 
 The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product on a machine. AMSI integrates with multiple Windows components, ranging from User Account Control (UAC) to VBA macros and PowerShell.
 
@@ -61,7 +63,9 @@ Since AMSI is widely used across security products for increased visibility, att
 
 This rule monitors the modifications to the Software\Microsoft\Windows Script\Settings\AmsiEnable registry key.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -78,15 +82,21 @@ This rule monitors the modifications to the Software\Microsoft\Windows Script\Se
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Use process name, command line, and file hash to search for occurrences on other hosts.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team as these modifications expose the host to malware infections.
 
-### Related rules
+
+*Related rules*
+
 
 - Microsoft Windows Defender Tampering - fe794edd-487f-4a90-b285-3ee54f2af2d3
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -102,7 +112,17 @@ This rule monitors the modifications to the Software\Microsoft\Windows Script\Se
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-boot-configuration.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-boot-configuration.asciidoc
index 4d751abecc..d8990a272f 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-boot-configuration.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-boot-configuration.asciidoc
@@ -46,11 +46,13 @@ Identifies use of bcdedit.exe to delete boot configuration data. This tactic is
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Modification of Boot Configuration
+*Triage and analysis*
+
+
+
+*Investigating Modification of Boot Configuration*
+
 
 Boot entry parameters, or boot parameters, are optional, system-specific settings that represent configuration options. These are stored in a boot configuration data (BCD) store, and administrators can use utilities like `bcdedit.exe` to configure these.
 
@@ -61,7 +63,9 @@ This rule identifies the usage of `bcdedit.exe` to:
 
 These are common steps in destructive attacks by adversaries leveraging ransomware.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -70,15 +74,21 @@ These are common steps in destructive attacks by adversaries leveraging ransomwa
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 - Check if any files on the host machine have been encrypted.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - The usage of these options is not inherently malicious. Administrators can modify these configurations to force a machine to boot for troubleshooting or data recovery purposes.
 
-### Related rules
+
+*Related rules*
+
 
 - Deleting Backup Catalogs with Wbadmin - 581add16-df76-42bb-af8e-c979bfb39a59
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.
@@ -88,7 +98,17 @@ These are common steps in destructive attacks by adversaries leveraging ransomwa
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-dynamic-linker-preload-shared-object.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-dynamic-linker-preload-shared-object.asciidoc
index 19a6d8c5c3..b05ee5ef9f 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-dynamic-linker-preload-shared-object.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-dynamic-linker-preload-shared-object.asciidoc
@@ -43,6 +43,57 @@ Identifies modification of the dynamic linker preload shared object (ld.so.prelo
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-environment-variable-via-launchctl.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-environment-variable-via-launchctl.asciidoc
index b61e2ba0c9..c52e6e16b7 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-environment-variable-via-launchctl.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-environment-variable-via-launchctl.asciidoc
@@ -40,6 +40,41 @@ Identifies modifications to an environment variable using the built-in launchctl
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-openssh-binaries.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-openssh-binaries.asciidoc
index 937700080c..3c7f9556c1 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-openssh-binaries.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-openssh-binaries.asciidoc
@@ -48,11 +48,13 @@ Adversaries may modify SSH related binaries for persistence or credential access
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Modification of OpenSSH Binaries
+*Triage and analysis*
+
+
+
+*Investigating Modification of OpenSSH Binaries*
+
 
 OpenSSH is a widely used suite of secure networking utilities based on the Secure Shell (SSH) protocol, which provides encrypted communication sessions over a computer network.
 
@@ -61,10 +63,12 @@ Adversaries may exploit OpenSSH by modifying its binaries, such as `/usr/bin/scp
 The detection rule 'Modification of OpenSSH Binaries' is designed to identify such abuse by monitoring file changes in the Linux environment. It triggers an alert when a process, modifies any of the specified OpenSSH binaries or libraries. This helps security analysts detect potential malicious activities and take appropriate action.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
   - !{osquery{"label":"Osquery - Retrieve Running Processes by User","query":"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username"}}
@@ -89,14 +93,18 @@ The detection rule 'Modification of OpenSSH Binaries' is designed to identify su
 - Investigate whether the user is currently logged in and active.
     - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Regular users should not need to modify OpenSSH binaries, which makes false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator that performed these actions for administrative purposes, consider adding exceptions for this specific administrator user account. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -110,7 +118,57 @@ The detection rule 'Modification of OpenSSH Binaries' is designed to identify su
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-safari-settings-via-defaults-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-safari-settings-via-defaults-command.asciidoc
index 6f3385371c..0235db7f1f 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-safari-settings-via-defaults-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-safari-settings-via-defaults-command.asciidoc
@@ -40,6 +40,41 @@ Identifies changes to the Safari configuration using the built-in defaults comma
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-the-mspkiaccountcredentials.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-the-mspkiaccountcredentials.asciidoc
index 18a7ec1b76..1f18bbd157 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-the-mspkiaccountcredentials.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-the-mspkiaccountcredentials.asciidoc
@@ -45,6 +45,25 @@ Identify the modification of the msPKIAccountCredentials attribute in an Active
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success,Failure)
+```
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc
index e4bfe831d6..f4340a75b5 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc
@@ -51,17 +51,21 @@ Identifies attempts to modify the WDigest security provider in the registry to f
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Modification of WDigest Security Provider
+*Triage and analysis*
+
+
+
+*Investigating Modification of WDigest Security Provider*
+
 
 In Windows XP, Microsoft added support for a protocol known as WDigest. The WDigest protocol allows clients to send cleartext credentials to Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) applications based on RFC 2617 and 2831. Windows versions up to 8 and 2012 store logon credentials in memory in plaintext by default, which is no longer the case with newer Windows versions.
 
 Still, attackers can force WDigest to store the passwords insecurely on the memory by modifying the `HKLM\SYSTEM\*ControlSet*\Control\SecurityProviders\WDigest\UseLogonCredential` registry key. This activity is commonly related to the execution of credential dumping tools.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - It is unlikely that the monitored registry key was modified legitimately in newer versions of Windows. Analysts should treat any activity triggered from this rule with high priority as it typically represents an active adversary.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -78,15 +82,21 @@ Still, attackers can force WDigest to store the passwords insecurely on the memo
 - Use process name, command line, and file hash to search for occurrences on other hosts.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team, as these modifications expose the entire domain to credential compromises and consequently unauthorized access.
 
-### Related rules
+
+*Related rules*
+
 
 - Mimikatz Powershell Module Activity - ac96ceb8-4399-4191-af1d-4feeac1f1f46
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -97,7 +107,17 @@ Still, attackers can force WDigest to store the passwords insecurely on the memo
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-or-removal-of-an-okta-application-sign-on-policy.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-or-removal-of-an-okta-application-sign-on-policy.asciidoc
index dede3f41ae..5f244dde4f 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-or-removal-of-an-okta-application-sign-on-policy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-or-removal-of-an-okta-application-sign-on-policy.asciidoc
@@ -45,10 +45,12 @@ Detects attempts to modify or delete a sign on policy for an Okta application. A
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/mounting-hidden-or-webdav-remote-shares.asciidoc b/docs/detections/prebuilt-rules/rule-details/mounting-hidden-or-webdav-remote-shares.asciidoc
index f323a1491b..a9bdb3d32e 100644
--- a/docs/detections/prebuilt-rules/rule-details/mounting-hidden-or-webdav-remote-shares.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/mounting-hidden-or-webdav-remote-shares.asciidoc
@@ -43,6 +43,17 @@ Identifies the use of net.exe to mount a WebDav or hidden remote share. This may
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/ms-office-macro-security-registry-modifications.asciidoc b/docs/detections/prebuilt-rules/rule-details/ms-office-macro-security-registry-modifications.asciidoc
index 9dc6f99d6f..407554a61a 100644
--- a/docs/detections/prebuilt-rules/rule-details/ms-office-macro-security-registry-modifications.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/ms-office-macro-security-registry-modifications.asciidoc
@@ -44,11 +44,13 @@ Microsoft Office Products offer options for users and developers to control the
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating MS Office Macro Security Registry Modifications
+*Triage and analysis*
+
+
+
+*Investigating MS Office Macro Security Registry Modifications*
+
 
 Macros are small programs that are used to automate repetitive tasks in Microsoft Office applications. Historically, macros have been used for a variety of reasons -- from automating part of a job, to building entire processes and data flows. Macros are written in Visual Basic for Applications (VBA) and are saved as part of Microsoft Office files.
 
@@ -61,7 +63,9 @@ Attackers can convince victims to modify Microsoft Office security settings, so
 
 This rule looks for registry changes affecting the conditions above.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -78,11 +82,15 @@ This rule looks for registry changes affecting the conditions above.
   - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Reset the registry key value.
@@ -95,7 +103,17 @@ This rule looks for registry changes affecting the conditions above.
 
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc b/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
index e1c2cb0128..d316dbd5ee 100644
--- a/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
@@ -44,11 +44,13 @@ Identifies MsBuild.exe making outbound network connections. This may indicate ad
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating MsBuild Making Network Connections
+*Triage and analysis*
+
+
+
+*Investigating MsBuild Making Network Connections*
+
 
 By examining the specific traits of Windows binaries (such as process trees, command lines, network connections, registry modifications, and so on) it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading and deserve further investigation.
 
@@ -57,9 +59,11 @@ The Microsoft Build Engine, also known as MSBuild, is a platform for building ap
 This rule looks for the `Msbuild.exe` utility execution, followed by a network connection to an external address. Attackers can abuse MsBuild to execute malicious files or masquerade as those utilities in order to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -83,11 +87,15 @@ This rule looks for the `Msbuild.exe` utility execution, followed by a network c
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of destination IP address and command line conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -101,7 +109,6 @@ This rule looks for the `Msbuild.exe` utility execution, followed by a network c
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multi-factor-authentication-disabled-for-an-azure-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/multi-factor-authentication-disabled-for-an-azure-user.asciidoc
index 9e8010496e..e3cd74964c 100644
--- a/docs/detections/prebuilt-rules/rule-details/multi-factor-authentication-disabled-for-an-azure-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multi-factor-authentication-disabled-for-an-azure-user.asciidoc
@@ -42,21 +42,25 @@ Identifies when multi-factor authentication (MFA) is disabled for an Azure user
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Multi-Factor Authentication Disabled for an Azure User
+*Triage and analysis*
+
+
+
+*Investigating Multi-Factor Authentication Disabled for an Azure User*
+
 
 Multi-factor authentication is a process in which users are prompted during the sign-in process for an additional form of identification, such as a code on their cellphone or a fingerprint scan.
 
 If you only use a password to authenticate a user, it leaves an insecure vector for attack. If the password is weak or has been exposed elsewhere, an attacker could be using it to gain access. When you require a second form of authentication, security is increased because this additional factor isn't something that's easy for an attacker to obtain or duplicate.
 
-For more information about using MFA in Azure AD, access the [official documentation](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks#how-to-enable-and-use-azure-ad-multi-factor-authentication).
+For more information about using MFA in Azure AD, access the https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks#how-to-enable-and-use-azure-ad-multi-factor-authentication[official documentation].
 
 This rule identifies the deactivation of MFA for an Azure user account. This modification weakens account security and can lead to the compromise of accounts and other assets.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -64,11 +68,15 @@ This rule identifies the deactivation of MFA for an Azure user account. This mod
 - Check if this operation was approved and performed according to the organization's change management policy.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - While this activity can be done by administrators, all users must use MFA. The security team should address any potential benign true positive (B-TP), as this configuration can risk the user and domain.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -81,10 +89,14 @@ This rule identifies the deactivation of MFA for an Azure user account. This mod
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Reactivate multi-factor authentication for the user.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security defaults [provided by Microsoft](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults).
+- Implement security defaults https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults[provided by Microsoft].
 - Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
index 933d0e994f..0c0c2bccd3 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
@@ -45,20 +45,24 @@ Identifies multiple logon failures followed by a successful one from the same so
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Multiple Logon Failure Followed by Logon Success
+*Triage and analysis*
+
+
+
+*Investigating Multiple Logon Failure Followed by Logon Success*
+
 
-Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to guess the password using a repetitive or iterative mechanism systematically. More details can be found [here](https://attack.mitre.org/techniques/T1110/001/).
+Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to guess the password using a repetitive or iterative mechanism systematically. More details can be found https://attack.mitre.org/techniques/T1110/001/[here].
 
 This rule identifies potential password guessing/brute force activity from a single address, followed by a successful logon, indicating that an attacker potentially successfully compromised the account.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the logon failure reason code and the targeted user name.
   - Prioritize the investigation if the account is critical or has administrative privileges over the domain.
@@ -79,18 +83,24 @@ This rule identifies potential password guessing/brute force activity from a sin
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the host which is the source of this activity.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Authentication misconfiguration or obsolete credentials.
 - Service account password expired.
 - Domain trust relationship issues.
 - Infrastructure or availability issues.
 
-### Related rules
+
+*Related rules*
+
 
 - Multiple Logon Failure from the same Source Address - 48b6edfc-079d-4907-b43c-baffa243270d
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the source host to prevent further post-compromise behavior.
@@ -101,7 +111,17 @@ This rule identifies potential password guessing/brute force activity from a sin
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
index e70da27de6..40f53100d0 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
@@ -48,20 +48,24 @@ Identifies multiple consecutive logon failures from the same source address and
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Multiple Logon Failure from the same Source Address
+*Triage and analysis*
+
+
+
+*Investigating Multiple Logon Failure from the same Source Address*
+
 
-Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to guess the password using a repetitive or iterative mechanism systematically. More details can be found [here](https://attack.mitre.org/techniques/T1110/001/).
+Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to guess the password using a repetitive or iterative mechanism systematically. More details can be found https://attack.mitre.org/techniques/T1110/001/[here].
 
 This rule identifies potential password guessing/brute force activity from a single address.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the logon failure reason code and the targeted user names.
   - Prioritize the investigation if the account is critical or has administrative privileges over the domain.
@@ -82,7 +86,9 @@ This rule identifies potential password guessing/brute force activity from a sin
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the host which is the source of this activity
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Understand the context of the authentications by contacting the asset owners. This activity can be related to a new or existing automation or business process that is in a failing state.
 - Authentication misconfiguration or obsolete credentials.
@@ -90,11 +96,15 @@ This rule identifies potential password guessing/brute force activity from a sin
 - Domain trust relationship issues.
 - Infrastructure or availability issues.
 
-### Related rules
+
+*Related rules*
+
 
 - Multiple Logon Failure Followed by Logon Success - 4e85dc8a-3e41-40d8-bc28-91af7ac6cf60
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the source host to prevent further post-compromise behavior.
@@ -105,7 +115,13 @@ This rule identifies potential password guessing/brute force activity from a sin
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+- In some cases the source network address in Windows events 4625/4624 is not populated due to Microsoft logging limitations (examples in the references links). This edge case will break the rule condition and it won't trigger an alert.
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-okta-client-addresses-for-a-single-user-session.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-okta-client-addresses-for-a-single-user-session.asciidoc
index 2edccb5f57..e3c03454a6 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-okta-client-addresses-for-a-single-user-session.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-okta-client-addresses-for-a-single-user-session.asciidoc
@@ -45,10 +45,12 @@ Detects when a user has started multiple Okta sessions with the same user accoun
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-okta-sessions-detected-for-a-single-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-okta-sessions-detected-for-a-single-user.asciidoc
index 734b164369..765de89213 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-okta-sessions-detected-for-a-single-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-okta-sessions-detected-for-a-single-user.asciidoc
@@ -45,10 +45,12 @@ Detects when a user has started multiple Okta sessions with the same user accoun
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.asciidoc
index a6637d3049..b957965537 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.asciidoc
@@ -45,15 +45,19 @@ Detects when Okta user authentication events are reported for multiple users wit
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy
+*Triage and analysis*
+
+
+
+*Investigating Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy*
+
 
 This rule detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy. This may indicate that a shared device between users, or that a user is using a proxy to access multiple accounts for password spraying.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 - Identify the users involved in this action by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
 - Determine the device client used for these actions by analyzing `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
     - Since the device is behind a proxy, the `okta.client.ip` field will not be useful for determining the actual device IP address.
@@ -68,14 +72,18 @@ This rule detects when Okta user authentication events are reported for multiple
 - Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
     - This may help determine the authentication and authorization actions that occurred between the user, Okta and application.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 - A user may have legitimately started a session via a proxy for security or privacy reasons.
 - Users may share an endpoint related to work or personal use in which separate Okta accounts are used.
     - Architecturally, this shared endpoint may leverage a proxy for security or privacy reasons.
     - Shared systems such as Kiosks and conference room computers may be used by multiple users.
     - Shared working spaces may have a single endpoint that is used by multiple users.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 - Review the profile of the users involved in this action to determine if proxy usage may be expected.
 - If the user is legitimate and the authentication behavior is not suspicious based on device analysis, no action is required.
 - If the user is legitimate but the authentication behavior is suspicious, consider resetting passwords for the users involves and enabling multi-factor authentication (MFA).
@@ -89,7 +97,11 @@ This rule detects when Okta user authentication events are reported for multiple
 - If this is a false positive, consider adding the `okta.debug_context.debug_data.dt_hash` field to the `exceptions` list in the rule.
     - This will prevent future occurrences of this event for this device from triggering the rule.
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-vault-web-credentials-read.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-vault-web-credentials-read.asciidoc
index 67222ec616..46ae02561a 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-vault-web-credentials-read.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-vault-web-credentials-read.asciidoc
@@ -42,6 +42,17 @@ Windows Credential Manager allows you to create, view, or delete saved credentia
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/my-first-rule.asciidoc b/docs/detections/prebuilt-rules/rule-details/my-first-rule.asciidoc
index 076fad1cd6..0caffd9bf7 100644
--- a/docs/detections/prebuilt-rules/rule-details/my-first-rule.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/my-first-rule.asciidoc
@@ -50,8 +50,6 @@ This rule helps you test and practice using alerts with Elastic Security as you
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 This is a test alert.
 
 This alert does not show threat activity. Elastic created this alert to help you understand how alerts work.
@@ -60,7 +58,6 @@ For normal rules, the Investigation Guide will help analysts investigate alerts.
 
 This alert will show once every 24 hours for each host. It is safe to disable this rule.
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/namespace-manipulation-using-unshare.asciidoc b/docs/detections/prebuilt-rules/rule-details/namespace-manipulation-using-unshare.asciidoc
index 0bdd6d615b..c26a4c5439 100644
--- a/docs/detections/prebuilt-rules/rule-details/namespace-manipulation-using-unshare.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/namespace-manipulation-using-unshare.asciidoc
@@ -44,6 +44,57 @@ Identifies suspicious usage of unshare to manipulate system namespaces. Unshare
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/netcat-listener-established-via-rlwrap.asciidoc b/docs/detections/prebuilt-rules/rule-details/netcat-listener-established-via-rlwrap.asciidoc
index 14720f3970..a29c215eee 100644
--- a/docs/detections/prebuilt-rules/rule-details/netcat-listener-established-via-rlwrap.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/netcat-listener-established-via-rlwrap.asciidoc
@@ -38,6 +38,42 @@ Monitors for the execution of a netcat listener via rlwrap. rlwrap is a 'readlin
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-activity-detected-via-cat.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-activity-detected-via-cat.asciidoc
index 59b8193224..cd3399ec33 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-activity-detected-via-cat.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-activity-detected-via-cat.asciidoc
@@ -29,7 +29,7 @@ This rule monitors for the execution of the cat command, followed by a connectio
 * Tactic: Command and Control
 * Data Source: Elastic Defend
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -41,21 +41,25 @@ This rule monitors for the execution of the cat command, followed by a connectio
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Network Activity Detected via cat
+*Triage and analysis*
+
+
+
+*Investigating Network Activity Detected via cat*
+
 
 Attackers may leverage the `cat` utility in conjunction with a listener to read all bytes of a file, and output the content to a `/dev/tcp` or `/dev/udp` channel to transfer/exfiltrate file contents to a remote system. 
 
 This rule looks for a sequence of a `cat` execution event followed by a network connection attempt by the same `cat` process. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify any signs of suspicious network activity or anomalies that may indicate command and control activity or data exfiltration. This could include unexpected traffic patterns or unusual network behavior.
   - Investigate listening ports and open sockets to look for potential protocol tunneling, reverse shells, or data exfiltration.
@@ -77,16 +81,22 @@ This rule looks for a sequence of a `cat` execution event followed by a network
           - Check the reputation of the domain or IP address.
         - File access, modification, and creation activities.
 
-### Related rules
+
+*Related rules*
+
 
 - Suspicious Network Activity to the Internet by Previously Unknown Executable - 53617418-17b4-4e9c-8a2c-8deb8086ca4b
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -101,7 +111,39 @@ This rule looks for a sequence of a `cat` execution event followed by a network
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
 
 ==== Rule query
 
@@ -109,10 +151,17 @@ This rule looks for a sequence of a `cat` execution event followed by a network
 [source, js]
 ----------------------------------
 sequence by host.id, process.entity_id with maxspan=1s
-  [process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and process.name == "cat" and 
-   process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")]
-  [network where host.os.type == "linux" and event.action in ("connection_attempted", "disconnect_received") and process.name == "cat" and 
-   destination.ip != null and not cidrmatch(destination.ip, "127.0.0.0/8", "169.254.0.0/16", "224.0.0.0/4", "::1")]
+  [process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and
+   process.name == "cat" and process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")]
+  [network where host.os.type == "linux" and event.action in ("connection_attempted", "disconnect_received") and
+   process.name == "cat" and not (destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
+     destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
+     "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
+     "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
+     "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
+     "FF00::/8"
+     )
+   )]
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-activity-detected-via-kworker.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-activity-detected-via-kworker.asciidoc
index b99e0bee5c..76766ff22d 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-activity-detected-via-kworker.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-activity-detected-via-kworker.asciidoc
@@ -38,6 +38,42 @@ This rule monitors for network connections from a kworker process. kworker, or k
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
index 3aa567dafc..1b980fbd9b 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
@@ -47,21 +47,25 @@ Identifies certutil.exe making a network connection. Adversaries could abuse cer
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Network Connection via Certutil
+*Triage and analysis*
+
+
+
+*Investigating Network Connection via Certutil*
+
 
 Attackers can abuse `certutil.exe` to download malware, offensive security tools, and certificates from external sources in order to take the next steps in a compromised environment.
 
-This rule looks for network events where `certutil.exe` contacts IP ranges other than the ones specified in [IANA IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml)
+This rule looks for network events where `certutil.exe` contacts IP ranges other than the ones specified in https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml[IANA IPv4 Special-Purpose Address Registry]
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses the {security-guide}/security/master/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -84,12 +88,16 @@ This rule looks for network events where `certutil.exe` contacts IP ranges other
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. If trusted software uses this command and the triage has not identified anything suspicious, this alert can be closed as a false positive.
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -103,7 +111,6 @@ This rule looks for network events where `certutil.exe` contacts IP ranges other
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
index aedcdecd8d..7bb9148669 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
@@ -46,11 +46,13 @@ Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTM
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Network Connection via Compiled HTML File
+*Triage and analysis*
+
+
+
+*Investigating Network Connection via Compiled HTML File*
+
 
 CHM (Compiled HTML) files are a format for delivering online help files on Windows. CHM files are compressed compilations of various content, such as HTML documents, images, and scripting/web-related programming languages such as VBA, JScript, Java, and ActiveX.
 
@@ -59,9 +61,11 @@ When users double-click CHM files, the HTML Help executable program (`hh.exe`) w
 This rule identifies network connections done by `hh.exe`, which can potentially indicate abuse to download malicious files or tooling, or masquerading.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -86,11 +90,15 @@ This rule identifies network connections done by `hh.exe`, which can potentially
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -109,7 +117,6 @@ This rule identifies network connections done by `hh.exe`, which can potentially
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-recently-compiled-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-recently-compiled-executable.asciidoc
index 76531ee65e..220a0dd4aa 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-recently-compiled-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-recently-compiled-executable.asciidoc
@@ -38,6 +38,41 @@ This rule monitors a sequence involving a program compilation event followed by
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
index aa8caba6a7..8e97f62362 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
@@ -47,20 +47,24 @@ Identifies the native Windows tools regsvr32.exe, regsvr64.exe, RegSvcs.exe, or
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Network Connection via Registration Utility
+*Triage and analysis*
+
+
+
+*Investigating Network Connection via Registration Utility*
+
 
 By examining the specific traits of Windows binaries -- such as process trees, command lines, network connections, registry modifications, and so on -- it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity such as masquerading, and deserve further investigation.
 
 This rule looks for the execution of `regsvr32.exe`, `RegAsm.exe`, or `RegSvcs.exe` utilities followed by a network connection to an external address. Attackers can abuse utilities to execute malicious files or masquerade as those utilities in order to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -84,11 +88,15 @@ This rule looks for the execution of `regsvr32.exe`, `RegAsm.exe`, or `RegSvcs.e
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of destination IP address and command line conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -102,7 +110,6 @@ This rule looks for the execution of `regsvr32.exe`, `RegAsm.exe`, or `RegSvcs.e
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
index a6c46ab537..214a2ef048 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
@@ -46,20 +46,24 @@ Binaries signed with trusted digital certificates can execute on Windows systems
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Network Connection via Signed Binary
+*Triage and analysis*
+
+
+
+*Investigating Network Connection via Signed Binary*
+
 
 By examining the specific traits of Windows binaries (such as process trees, command lines, network connections, registry modifications, and so on) it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading and deserve further investigation.
 
 This rule looks for the execution of `expand.exe`, `extrac32.exe`, `ieexec.exe`, or `makecab.exe` utilities, followed by a network connection to an external address. Attackers can abuse utilities to execute malicious files or masquerade as those utilities to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -83,11 +87,15 @@ This rule looks for the execution of `expand.exe`, `extrac32.exe`, `ieexec.exe`,
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of destination IP address and command line conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -101,7 +109,6 @@ This rule looks for the execution of `expand.exe`, `extrac32.exe`, `ieexec.exe`,
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-logon-provider-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-logon-provider-registry-modification.asciidoc
index e589f77d9a..04e2158f78 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-logon-provider-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-logon-provider-registry-modification.asciidoc
@@ -47,20 +47,24 @@ Identifies the modification of the network logon provider registry. Adversaries
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Network Logon Provider Registry Modification
+*Triage and analysis*
+
+
+
+*Investigating Network Logon Provider Registry Modification*
+
 
 Network logon providers are components in Windows responsible for handling the authentication process during a network logon.
 
 This rule identifies the modification of the network logon provider registry. Adversaries may register a rogue network logon provider module for persistence and/or credential access via intercepting the authentication credentials in plain text during user logon.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Examine the `registry.data.strings` field to identify the DLL registered.
 - Identify the process responsible for the registry operation and the file creation and investigate their process execution chains (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -83,11 +87,15 @@ This rule identifies the modification of the network logon provider registry. Ad
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - False Positives can include legitimate software installations or updates that modify the network logon provider registry. These modifications may be necessary for the proper functioning of the software and are not indicative of malicious activity.
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
   - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
@@ -104,7 +112,6 @@ This rule identifies the modification of the network logon provider registry. Ad
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-traffic-capture-via-cap-net-raw.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-traffic-capture-via-cap-net-raw.asciidoc
index ef0695b63a..aafb751ac7 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-traffic-capture-via-cap-net-raw.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-traffic-capture-via-cap-net-raw.asciidoc
@@ -38,6 +38,41 @@ Identifies the ability of a process to be able to create RAW and PACKET socket t
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/new-activesyncalloweddeviceid-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-activesyncalloweddeviceid-added-via-powershell.asciidoc
index 775d4fcb3d..4e0a1f4096 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-activesyncalloweddeviceid-added-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-activesyncalloweddeviceid-added-via-powershell.asciidoc
@@ -46,6 +46,17 @@ Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a n
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/new-okta-authentication-behavior-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-okta-authentication-behavior-detected.asciidoc
index 81c6c6dd96..bb08cd8dfb 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-okta-authentication-behavior-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-okta-authentication-behavior-detected.asciidoc
@@ -45,15 +45,19 @@ Detects events where Okta behavior detection has identified a new authentication
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating New Okta Authentication Behavior Detected
+*Triage and analysis*
+
+
+
+*Investigating New Okta Authentication Behavior Detected*
+
 
 This rule detects events where Okta behavior detection has identified a new authentication behavior such as a new device or location.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 - Identify the user involved in this action by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
 - Determine the authentication anomaly by examining the `okta.debug_context.debug_data.risk_behaviors` and `okta.debug_context.debug_data.flattened` fields.
 - Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
@@ -62,11 +66,15 @@ This rule detects events where Okta behavior detection has identified a new auth
 - Examine the `okta.request.ip_chain` field to potentially determine if the actor used a proxy or VPN to perform this action.
 - Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 - A user may be using a new device or location to sign in.
 - The Okta behavior detection may be incorrectly identifying a new authentication behavior and need adjusted.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 - If the user is legitimate and the authentication behavior is not suspicious, no action is required.
 - If the user is legitimate but the authentication behavior is suspicious, consider resetting the user's password and enabling multi-factor authentication (MFA).
     - If MFA is already enabled, consider resetting MFA for the user.
@@ -74,7 +82,11 @@ This rule detects events where Okta behavior detection has identified a new auth
 - If this is a false positive, consider adjusting the Okta behavior detection settings.
 - Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
 - Conduct a review of Okta policies and ensure they are in accordance with security best practices.
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/new-okta-identity-provider-idp-added-by-admin.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-okta-identity-provider-idp-added-by-admin.asciidoc
index 7dd2daeb8c..c668422ea2 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-okta-identity-provider-idp-added-by-admin.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-okta-identity-provider-idp-added-by-admin.asciidoc
@@ -45,15 +45,19 @@ Detects the creation of a new Identity Provider (IdP) by a Super Administrator o
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating New Okta Identity Provider (IdP) Added by Admin
+*Triage and analysis*
+
+
+
+*Investigating New Okta Identity Provider (IdP) Added by Admin*
+
 
 This rule detects the creation of a new Identity Provider (IdP) by a Super Administrator or Organization Administrator within Okta.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 - Identify the actor associated with the IdP creation by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
 - Identify the IdP added by reviewing the `okta.target` field and determing if this IdP is authorized.
 - Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
@@ -62,11 +66,15 @@ This rule detects the creation of a new Identity Provider (IdP) by a Super Admin
 - Examine the `okta.request.ip_chain` field to potentially determine if the actor used a proxy or VPN to perform this action.
 - Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 - It might be a false positive if the action was part of a planned activity or performed by an authorized person.
 - Several unsuccessful attempts prior to this success, may indicate an adversary attempting to add an unauthorized IdP multiple times.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 - If the IdP is unauthorized, deactivate it immediately via the Okta console.
 - If the IdP is authorized, ensure that the actor who created it is authorized to do so.
 - If the actor is unauthorized, deactivate their account via the Okta console.
@@ -75,7 +83,11 @@ This rule detects the creation of a new Identity Provider (IdP) by a Super Admin
 - Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
 - Conduct a review of Okta policies and ensure they are in accordance with security best practices.
 - If the deactivated IdP was crucial to the organization, consider adding a new IdP and removing the unauthorized IdP.
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/new-or-modified-federation-domain.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-or-modified-federation-domain.asciidoc
index f208aa691a..d255732734 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-or-modified-federation-domain.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-or-modified-federation-domain.asciidoc
@@ -48,10 +48,12 @@ Identifies a new or modified federation domain, which can be used to create a tr
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/new-systemd-service-created-by-previously-unknown-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-systemd-service-created-by-previously-unknown-process.asciidoc
index a3ae97e674..b9e210d24a 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-systemd-service-created-by-previously-unknown-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-systemd-service-created-by-previously-unknown-process.asciidoc
@@ -47,11 +47,13 @@ Systemd service files are configuration files in Linux systems used to define an
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating New Systemd Service Created by Previously Unknown Process
+*Triage and analysis*
+
+
+
+*Investigating New Systemd Service Created by Previously Unknown Process*
+
 
 Systemd service files are configuration files in Linux systems used to define and manage system services.
 
@@ -60,10 +62,12 @@ Malicious actors can leverage systemd service files to achieve persistence by cr
 This rule monitors the creation of new systemd service files, potentially indicating the creation of a persistence mechanism.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible Investigation Steps*
 
-#### Possible Investigation Steps
 
 - Investigate the systemd service file that was created or modified.
   - !{osquery{"label":"Osquery - Retrieve File Information","query":"SELECT * FROM file WHERE path = {{file.path}}"}}
@@ -94,19 +98,25 @@ This rule monitors the creation of new systemd service files, potentially indica
 - Investigate whether the user is currently logged in and active.
     - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator who uses systemd services for administrative purposes, consider adding exceptions for this specific administrator user account. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Potential Persistence Through Run Control Detected - 0f4d35e4-925e-4959-ab24-911be207ee6f
 - Potential Persistence Through init.d Detected - 474fd20e-14cc-49c5-8160-d9ab4ba16c8b
 - New Systemd Timer Created - 7fb500fa-8e24-4bd1-9480-2a819352602c
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -121,7 +131,41 @@ This rule monitors the creation of new systemd service files, potentially indica
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
index 247dbae086..92f73e4008 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
@@ -47,11 +47,13 @@ Detects the creation of a systemd timer within any of the default systemd timer
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating New Systemd Timer Created
+*Triage and analysis*
+
+
+
+*Investigating New Systemd Timer Created*
+
 
 Systemd timers are used for scheduling and automating recurring tasks or services on Linux systems. 
 
@@ -60,10 +62,12 @@ Attackers can leverage systemd timers to run scripts, commands, or malicious sof
 This rule monitors the creation of new systemd timer files, potentially indicating the creation of a persistence mechanism.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible Investigation Steps*
 
-#### Possible Investigation Steps
 
 - Investigate the timer file that was created or modified.
   - !{osquery{"label":"Osquery - Retrieve File Information","query":"SELECT * FROM file WHERE path = {{file.path}}"}}
@@ -87,13 +91,17 @@ This rule monitors the creation of new systemd timer files, potentially indicati
         - Cron jobs, services and other persistence mechanisms.
             - !{osquery{"label":"Osquery - Retrieve Crontab Information","query":"SELECT * FROM crontab"}}
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator who uses systemd timers for administrative purposes, consider adding exceptions for this specific administrator user account. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -109,7 +117,41 @@ This rule monitors the creation of new systemd timer files, potentially indicati
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/nping-process-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/nping-process-activity.asciidoc
index 63c8ef8ff4..9b4708bd06 100644
--- a/docs/detections/prebuilt-rules/rule-details/nping-process-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/nping-process-activity.asciidoc
@@ -43,6 +43,57 @@ Nping ran on a Linux host. Nping is part of the Nmap tool suite and has the abil
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/ntds-or-sam-database-file-copied.asciidoc b/docs/detections/prebuilt-rules/rule-details/ntds-or-sam-database-file-copied.asciidoc
index bbe7ba0028..5003bd0979 100644
--- a/docs/detections/prebuilt-rules/rule-details/ntds-or-sam-database-file-copied.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/ntds-or-sam-database-file-copied.asciidoc
@@ -51,20 +51,24 @@ Identifies a copy operation of the Active Directory Domain Database (ntds.dit) o
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating NTDS or SAM Database File Copied
+*Triage and analysis*
+
+
+
+*Investigating NTDS or SAM Database File Copied*
+
 
 The Active Directory Domain Database (ntds.dit) and Security Account Manager (SAM) files are critical components in Windows environments, containing sensitive information such as hashed domain and local credentials.
 
 This rule identifies copy operations of these files using specific command-line tools, such as Cmd.Exe, PowerShell.EXE, XCOPY.EXE, and esentutl.exe. By monitoring for the presence of these tools and their associated arguments, the rule aims to detect potential credential access activities.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, command lines, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -88,11 +92,15 @@ This rule identifies copy operations of these files using specific command-line
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Look for the presence of relevant artifacts on other systems. Identify commonalities and differences between potentially compromised systems.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
   - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
@@ -109,7 +117,17 @@ This rule identifies copy operations of these files using specific command-line
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/o365-email-reported-by-user-as-malware-or-phish.asciidoc b/docs/detections/prebuilt-rules/rule-details/o365-email-reported-by-user-as-malware-or-phish.asciidoc
index 76b61db1c8..00fb7895a3 100644
--- a/docs/detections/prebuilt-rules/rule-details/o365-email-reported-by-user-as-malware-or-phish.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/o365-email-reported-by-user-as-malware-or-phish.asciidoc
@@ -42,10 +42,12 @@ Detects the occurrence of emails reported as Phishing or Malware by Users. Secur
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/o365-excessive-single-sign-on-logon-errors.asciidoc b/docs/detections/prebuilt-rules/rule-details/o365-excessive-single-sign-on-logon-errors.asciidoc
index f4d9dcdb04..3334742d34 100644
--- a/docs/detections/prebuilt-rules/rule-details/o365-excessive-single-sign-on-logon-errors.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/o365-excessive-single-sign-on-logon-errors.asciidoc
@@ -42,10 +42,12 @@ Identifies accounts with a high number of single sign-on (SSO) logon errors. Exc
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc b/docs/detections/prebuilt-rules/rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc
index 6a213ab097..714ea13a1c 100644
--- a/docs/detections/prebuilt-rules/rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc
@@ -42,10 +42,12 @@ Identifies the assignment of rights to access content from another mailbox. An a
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/o365-mailbox-audit-logging-bypass.asciidoc b/docs/detections/prebuilt-rules/rule-details/o365-mailbox-audit-logging-bypass.asciidoc
index f7971d947f..cc704ab53b 100644
--- a/docs/detections/prebuilt-rules/rule-details/o365-mailbox-audit-logging-bypass.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/o365-mailbox-audit-logging-bypass.asciidoc
@@ -43,10 +43,12 @@ Detects the occurrence of mailbox audit bypass associations. The mailbox audit i
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/okta-brute-force-or-password-spraying-attack.asciidoc b/docs/detections/prebuilt-rules/rule-details/okta-brute-force-or-password-spraying-attack.asciidoc
index db01960064..eb1ec3e6e3 100644
--- a/docs/detections/prebuilt-rules/rule-details/okta-brute-force-or-password-spraying-attack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/okta-brute-force-or-password-spraying-attack.asciidoc
@@ -44,15 +44,19 @@ Identifies a high number of failed Okta user authentication attempts from a sing
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Okta Brute Force or Password Spraying Attack
+*Triage and analysis*
+
+
+
+*Investigating Okta Brute Force or Password Spraying Attack*
+
 
 This rule alerts when a high number of failed Okta user authentication attempts occur from a single IP address. This could be indicative of a brute force or password spraying attack, where an adversary may attempt to gain unauthorized access to user accounts by guessing the passwords.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 
 - Review the `source.ip` field to identify the IP address from which the high volume of failed login attempts originated.
 - Look into the `event.outcome` field to verify that these are indeed failed authentication attempts.
@@ -61,12 +65,16 @@ This rule alerts when a high number of failed Okta user authentication attempts
 - Determine the geographical location of the source IP. Is this location consistent with the user's typical login location?
 - Analyze any previous successful logins from this IP. Was this IP previously associated with successful logins?
 
-### False positive analysis:
+
+*False positive analysis:*
+
 
 - A single user or automated process that attempts to authenticate using expired or wrong credentials multiple times may trigger a false positive.
 - Analyze the behavior of the source IP. If the IP is associated with legitimate users or services, it may be a false positive.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 
 - If you identify unauthorized access attempts, consider blocking the source IP at the firewall level.
 - Notify the users who are targeted by the attack. Ask them to change their passwords and ensure they use unique, complex passwords.
@@ -74,7 +82,11 @@ This rule alerts when a high number of failed Okta user authentication attempts
 - If the attack is persistent, consider implementing CAPTCHA or account lockouts after a certain number of failed login attempts.
 - If the attack is persistent, consider implementing multi-factor authentication (MFA) for the affected user accounts.
 - Review and update your security policies based on the findings from the incident.
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/okta-fastpass-phishing-detection.asciidoc b/docs/detections/prebuilt-rules/rule-details/okta-fastpass-phishing-detection.asciidoc
index 3099630b2a..cf86f556b8 100644
--- a/docs/detections/prebuilt-rules/rule-details/okta-fastpass-phishing-detection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/okta-fastpass-phishing-detection.asciidoc
@@ -45,10 +45,16 @@ Detects when Okta FastPass prevents a user from authenticating to a phishing web
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
+This rule requires Okta to have the following turned on:
+
+Okta Identity Engine - select 'Phishing Resistance for FastPass' under Settings > Features in the Admin Console.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/okta-sign-in-events-via-third-party-idp.asciidoc b/docs/detections/prebuilt-rules/rule-details/okta-sign-in-events-via-third-party-idp.asciidoc
index 85c0224cea..1737813a85 100644
--- a/docs/detections/prebuilt-rules/rule-details/okta-sign-in-events-via-third-party-idp.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/okta-sign-in-events-via-third-party-idp.asciidoc
@@ -45,17 +45,21 @@ Detects sign-in events where authentication is carried out via a third-party Ide
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Okta Sign-In Events via Third-Party IdP
+*Triage and analysis*
+
+
+
+*Investigating Okta Sign-In Events via Third-Party IdP*
+
 
 This rule detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP).
 
 Adversaries may attempt to add an unauthorized IdP to an Okta tenant to gain access to the tenant. Following this action, adversaries may attempt to sign in to the tenant using the unauthorized IdP. This rule detects both the addition of an unauthorized IdP and the subsequent sign-in attempt.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 - Identify the third-party IdP by examining the `okta.authentication_context.issuer.id` field.
 - Once the third-party IdP is identified, determine if this IdP is authorized to be used by the tenant.
 - If the IdP is unauthorized, deactivate it immediately via the Okta console.
@@ -67,11 +71,15 @@ Adversaries may attempt to add an unauthorized IdP to an Okta tenant to gain acc
 - Examine the `okta.request.ip_chain` field to potentially determine if the actor used a proxy or VPN to perform this action.
 - Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 - It might be a false positive if this IdP is authorized to be used by the tenant.
 - This may be a false positive if an authorized third-party IdP is used to sign in to the tenant but failures occurred due to an incorrect configuration.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 - If the IdP is unauthorized, deactivate it immediately via the Okta console.
 - Reset the effected user's password and enforce MFA re-enrollment, if applicable.
 - Mobile device forensics may be required to determine if the user's device is compromised.
@@ -82,7 +90,11 @@ Adversaries may attempt to add an unauthorized IdP to an Okta tenant to gain acc
 - Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
 - Conduct a review of Okta policies and ensure they are in accordance with security best practices.
 - If the deactivated IdP was crucial to the organization, consider adding a new IdP and removing the unauthorized IdP.
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/okta-threatinsight-threat-suspected-promotion.asciidoc b/docs/detections/prebuilt-rules/rule-details/okta-threatinsight-threat-suspected-promotion.asciidoc
index 9d6c4a4cc9..2016e26100 100644
--- a/docs/detections/prebuilt-rules/rule-details/okta-threatinsight-threat-suspected-promotion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/okta-threatinsight-threat-suspected-promotion.asciidoc
@@ -44,13 +44,17 @@ Okta ThreatInsight is a feature that provides valuable debug data regarding auth
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
+
+*Triage and analysis*
+
 
 This is a promotion rule for Okta ThreatInsight suspected threat events, which are alertable events per the vendor.
 Consult vendor documentation on interpreting specific events.
-----------------------------------
+
+==== Setup
+
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/okta-user-session-impersonation.asciidoc b/docs/detections/prebuilt-rules/rule-details/okta-user-session-impersonation.asciidoc
index 160bb0288e..7b59a51a78 100644
--- a/docs/detections/prebuilt-rules/rule-details/okta-user-session-impersonation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/okta-user-session-impersonation.asciidoc
@@ -43,15 +43,19 @@ A user has initiated a session impersonation granting them access to the environ
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Okta User Session Impersonation
+*Triage and analysis*
+
+
+
+*Investigating Okta User Session Impersonation*
+
 
 The detection of an Okta User Session Impersonation indicates that a user has initiated a session impersonation which grants them access with the permissions of the user they are impersonating. This type of activity typically indicates Okta administrative access and should only ever occur if requested and expected.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the actor associated with the impersonation event by checking the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields.
 - Review the `event.action` field to confirm the initiation of the impersonation event.
@@ -59,12 +63,16 @@ The detection of an Okta User Session Impersonation indicates that a user has in
 - Check the `okta.target.id`, `okta.target.type`, `okta.target.alternate_id`, or `okta.target.display_name` to identify the user who was impersonated.
 - Review any activities that occurred during the impersonation session. Look for any activities related to the impersonated user's account during and after the impersonation event.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Verify if the session impersonation was part of an approved activity. Check if it was associated with any documented administrative tasks or troubleshooting efforts.
 - Ensure that the impersonation session was initiated by an authorized individual. You can check this by verifying the `okta.actor.id` or `okta.actor.display_name` against the list of approved administrators.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - If the impersonation was not authorized, consider it as a breach. Suspend the user account of the impersonator immediately.
 - Reset the user session and invalidate any active sessions related to the impersonated user.
@@ -72,7 +80,11 @@ The detection of an Okta User Session Impersonation indicates that a user has in
 - Conduct a thorough investigation to understand the extent of the breach and the potential impact on the systems and data.
 - Review and update your security policies to prevent such incidents in the future.
 - Implement additional monitoring and logging of Okta events to improve visibility of user actions.
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/okta-user-sessions-started-from-different-geolocations.asciidoc b/docs/detections/prebuilt-rules/rule-details/okta-user-sessions-started-from-different-geolocations.asciidoc
index b3066cb682..17bfcd5beb 100644
--- a/docs/detections/prebuilt-rules/rule-details/okta-user-sessions-started-from-different-geolocations.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/okta-user-sessions-started-from-different-geolocations.asciidoc
@@ -46,10 +46,12 @@ Detects when a specific Okta actor has multiple sessions started from different
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/onedrive-malware-file-upload.asciidoc b/docs/detections/prebuilt-rules/rule-details/onedrive-malware-file-upload.asciidoc
index 32c8337f39..857347352f 100644
--- a/docs/detections/prebuilt-rules/rule-details/onedrive-malware-file-upload.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/onedrive-malware-file-upload.asciidoc
@@ -42,10 +42,12 @@ Identifies the occurence of files uploaded to OneDrive being detected as Malware
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/peripheral-device-discovery.asciidoc b/docs/detections/prebuilt-rules/rule-details/peripheral-device-discovery.asciidoc
index 3b8e6aaec2..c91fa1d157 100644
--- a/docs/detections/prebuilt-rules/rule-details/peripheral-device-discovery.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/peripheral-device-discovery.asciidoc
@@ -46,17 +46,21 @@ Identifies use of the Windows file system utility (fsutil.exe) to gather informa
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Peripheral Device Discovery
+*Triage and analysis*
+
+
+
+*Investigating Peripheral Device Discovery*
+
 
 After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
 This rule looks for the execution of the `fsutil` utility with the `fsinfo` subcommand to enumerate drives attached to the computer, which can be used to identify secondary drives used for backups, mapped network drives, and removable media. These devices can contain valuable information for attackers.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -64,11 +68,15 @@ This rule looks for the execution of the `fsutil` utility with the `fsinfo` subc
 - Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 - Determine whether this activity was followed by suspicious file access/copy operations or uploads to file storage services.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -78,7 +86,17 @@ This rule looks for the execution of the `fsutil` utility with the `fsinfo` subc
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-bits-job-notify-cmdline.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-bits-job-notify-cmdline.asciidoc
index 376c216b23..d2017f8f5c 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-bits-job-notify-cmdline.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-bits-job-notify-cmdline.asciidoc
@@ -47,6 +47,17 @@ An adversary can use the Background Intelligent Transfer Service (BITS) SetNotif
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-directoryservice-plugin-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-directoryservice-plugin-modification.asciidoc
index 4264265666..e5c76fbe00 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-directoryservice-plugin-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-directoryservice-plugin-modification.asciidoc
@@ -40,6 +40,41 @@ Identifies the creation or modification of a DirectoryService PlugIns (dsplug) f
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-docker-shortcut-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-docker-shortcut-modification.asciidoc
index 55b8f2a72c..c4cc2a9cb8 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-docker-shortcut-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-docker-shortcut-modification.asciidoc
@@ -40,6 +40,41 @@ An adversary can establish persistence by modifying an existing macOS dock prope
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-folder-action-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-folder-action-script.asciidoc
index fae5f8d3c5..eb13f80bbc 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-folder-action-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-folder-action-script.asciidoc
@@ -41,6 +41,41 @@ Detects modification of a Folder Action script. A Folder Action script is execut
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-hidden-run-key-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-hidden-run-key-detected.asciidoc
index f38ef6b84a..302156f3ec 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-hidden-run-key-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-hidden-run-key-detected.asciidoc
@@ -47,6 +47,17 @@ Identifies a persistence mechanism that utilizes the NtSetValueKey native API to
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
index ddac0c54e9..e7c72033b6 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
@@ -48,11 +48,13 @@ Identifies the creation or modification of a K Desktop Environment (KDE) AutoSta
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Persistence via KDE AutoStart Script or Desktop File Modification
+*Triage and analysis*
+
+
+
+*Investigating Persistence via KDE AutoStart Script or Desktop File Modification*
+
 
 K Desktop Environment (KDE) is a popular graphical desktop environment for Linux systems. It supports AutoStart scripts and desktop files that execute automatically upon user logon.
 
@@ -61,10 +63,12 @@ Adversaries may exploit this feature to maintain persistence on a compromised sy
 The detection rule 'Persistence via KDE AutoStart Script or Desktop File Modification' is designed to identify such activities by monitoring file events on Linux systems. It specifically targets the creation or modification of files with extensions ".sh" or ".desktop" in various AutoStart directories. By detecting these events, the rule helps security analysts identify potential abuse of KDE AutoStart functionality by malicious actors.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Investigate the file that was created or modified.
   - !{osquery{"label":"Osquery - Retrieve File Listing Information","query":"SELECT * FROM file WHERE (\n  path LIKE '/home/%/.config/autostart/%.sh' OR path LIKE '/home/%/.config/autostart/%.desktop' OR\n  path LIKE '/root/.config/autostart/%.sh' OR path LIKE '/root/.config/autostart/%.desktop' OR\n  path LIKE '/home/%/.kde/Autostart/%.sh' OR path LIKE '/home/%/.kde/Autostart/%.desktop' OR\n  path LIKE '/root/.kde/Autostart/%.sh' OR path LIKE '/root/.kde/Autostart/%.desktop' OR\n  path LIKE '/home/%/.kde4/Autostart/%.sh' OR path LIKE '/home/%/.kde4/Autostart/%.desktop' OR\n  path LIKE '/root/.kde4/Autostart/%.sh' OR path LIKE '/root/.kde4/Autostart/%.desktop' OR\n  path LIKE '/home/%/.kde/share/autostart/%.sh' OR path LIKE '/home/%/.kde/share/autostart/%.desktop' OR\n  path LIKE '/root/.kde/share/autostart/%.sh' OR path LIKE '/root/.kde/share/autostart/%.desktop' OR\n  path LIKE '/home/%/.kde4/share/autostart/%.sh' OR path LIKE '/home/%/.kde4/share/autostart/%.desktop' OR\n  path LIKE '/root/.kde4/share/autostart/%.sh' OR path LIKE '/root/.kde4/share/autostart/%.desktop' OR\n  path LIKE '/home/%/.local/share/autostart/%.sh' OR path LIKE '/home/%/.local/share/autostart/%.desktop' OR\n  path LIKE '/root/.local/share/autostart/%.sh' OR path LIKE '/root/.local/share/autostart/%.desktop' OR\n  path LIKE '/home/%/.config/autostart-scripts/%.sh' OR path LIKE '/home/%/.config/autostart-scripts/%.desktop' OR\n  path LIKE '/root/.config/autostart-scripts/%.sh' OR path LIKE '/root/.config/autostart-scripts/%.desktop' OR\n  path LIKE '/etc/xdg/autostart/%.sh' OR path LIKE '/etc/xdg/autostart/%.desktop' OR\n  path LIKE '/usr/share/autostart/%.sh' OR path LIKE '/usr/share/autostart/%.desktop'\n)\n"}}
@@ -92,13 +96,17 @@ The detection rule 'Persistence via KDE AutoStart Script or Desktop File Modific
 - Investigate whether the user is currently logged in and active.
     - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator who uses cron jobs for administrative purposes, consider adding exceptions for this specific administrator user account. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -112,7 +120,62 @@ The detection rule 'Persistence via KDE AutoStart Script or Desktop File Modific
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Custom Ingest Pipeline*
+
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html[guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-login-or-logout-hook.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-login-or-logout-hook.asciidoc
index d3a51f8871..0844689494 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-login-or-logout-hook.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-login-or-logout-hook.asciidoc
@@ -41,6 +41,41 @@ Identifies use of the Defaults command to install a login or logoff hook in MacO
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-office-addins.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-office-addins.asciidoc
index ff55e87e67..3cb427fcf8 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-office-addins.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-office-addins.asciidoc
@@ -44,6 +44,17 @@ Detects attempts to establish persistence on an endpoint by abusing Microsoft Of
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-outlook-vba.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-outlook-vba.asciidoc
index 12cf0291a7..51556e7829 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-outlook-vba.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-outlook-vba.asciidoc
@@ -45,6 +45,17 @@ Detects attempts to establish persistence on an endpoint by installing a rogue M
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-powershell-profile.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-powershell-profile.asciidoc
index 27199ad249..8946c677d1 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-powershell-profile.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-powershell-profile.asciidoc
@@ -49,20 +49,24 @@ Identifies the creation or modification of a PowerShell profile. PowerShell prof
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Persistence via PowerShell profile
+*Triage and analysis*
+
+
+
+*Investigating Persistence via PowerShell profile*
+
 
 PowerShell profiles are scripts executed when PowerShell starts, customizing the user environment. They are commonly used in Windows environments for legitimate purposes, such as setting variables or loading modules. However, adversaries can abuse PowerShell profiles to establish persistence by inserting malicious code that executes each time PowerShell is launched.
 
 This rule identifies the creation or modification of a PowerShell profile. It does this by monitoring file events on Windows systems, specifically targeting profile-related file paths and names, such as `profile.ps1` and `Microsoft.Powershell_profile.ps1`. By detecting these activities, security analysts can investigate potential abuse of PowerShell profiles for malicious persistence.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Retrive and inspect the PowerShell profile content; look for suspicious DLL imports, collection or persistence capabilities, suspicious functions, encoded or compressed data, suspicious commands, and other potentially malicious characteristics.
 - Identify the process responsible for the PowerShell profile creation/modification. Use the Elastic Defend events to examine all the activity of the subject process by filtering by the process's `process.entity_id`.
@@ -81,11 +85,15 @@ This rule identifies the creation or modification of a PowerShell profile. It do
       - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This is a dual-use mechanism, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the script doesn't contain malicious functions or potential for abuse, no other suspicious activity was identified, and the user has business justifications to use PowerShell.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
   - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
@@ -104,7 +112,6 @@ This rule identifies the creation or modification of a PowerShell profile. It do
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
   - Consider enabling and collecting PowerShell logs such as transcription, module, and script block logging, to improve visibility into PowerShell activities.
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-scheduled-job-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-scheduled-job-creation.asciidoc
index 761238983c..373d71abc2 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-scheduled-job-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-scheduled-job-creation.asciidoc
@@ -42,6 +42,17 @@ A job can be used to schedule programs or scripts to be executed at a specified
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc
index 7a313b8087..438f0a533d 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc
@@ -46,6 +46,17 @@ Detects the successful hijack of Microsoft Compatibility Appraiser scheduled tas
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
index a130319e7d..03523997b1 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
@@ -50,20 +50,24 @@ Identifies potential hijacking of the Microsoft Update Orchestrator Service to e
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Persistence via Update Orchestrator Service Hijack
+*Triage and analysis*
+
+
+
+*Investigating Persistence via Update Orchestrator Service Hijack*
+
 
 Windows Update Orchestrator Service is a DCOM service used by other components to install Windows updates that are already downloaded. Windows Update Orchestrator Service was vulnerable to elevation of privileges (any user to local system) due to an improper authorization of the callers. The vulnerability affected the Windows 10 and Windows Server Core products. Fixed by Microsoft on Patch Tuesday June 2020.
 
 This rule will detect uncommon processes spawned by `svchost.exe` with `UsoSvc` as the command line parameters. Attackers can leverage this technique to elevate privileges or maintain persistence.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
@@ -85,11 +89,15 @@ This rule will detect uncommon processes spawned by `svchost.exe` with `UsoSvc`
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -105,7 +113,17 @@ This rule will detect uncommon processes spawned by `svchost.exe` with `UsoSvc`
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-event-subscription.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-event-subscription.asciidoc
index 3cd7dc69fe..0f0cb581a1 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-event-subscription.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-event-subscription.asciidoc
@@ -46,6 +46,17 @@ An adversary can use Windows Management Instrumentation (WMI) to install event f
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-standard-registry-provider.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-standard-registry-provider.asciidoc
index 87c1272eee..ed3e9e1385 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-standard-registry-provider.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-standard-registry-provider.asciidoc
@@ -46,20 +46,24 @@ Identifies use of the Windows Management Instrumentation StdRegProv (registry pr
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Persistence via WMI Standard Registry Provider
+*Triage and analysis*
+
+
+
+*Investigating Persistence via WMI Standard Registry Provider*
+
 
 The Windows Management Instrumentation (WMI) StdRegProv is a registry provider that allows users to manage registry keys and values on Windows systems. Adversaries may abuse this functionality to modify registry locations commonly used for persistence, enabling them to maintain unauthorized access to a system.
 
 This rule identifies instances where the WMI StdRegProv is used to modify specific registry paths associated with persistence mechanisms.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -81,11 +85,15 @@ This rule identifies instances where the WMI StdRegProv is used to modify specif
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -100,7 +108,6 @@ This rule identifies instances where the WMI StdRegProv is used to modify specif
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
index 1e9287dd59..758a880abc 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
@@ -46,20 +46,24 @@ Identifies script engines creating files in the Startup folder, or the creation
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Persistent Scripts in the Startup Directory
+*Triage and analysis*
+
+
+
+*Investigating Persistent Scripts in the Startup Directory*
+
 
 The Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account logon, without user interaction, providing an excellent way for attackers to maintain persistence.
 
 This rule looks for shortcuts created by wscript.exe or cscript.exe, or js/vbs scripts created by any process.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -80,16 +84,22 @@ This rule looks for shortcuts created by wscript.exe or cscript.exe, or js/vbs s
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Related rules
+
+*Related rules*
+
 
 - Suspicious Startup Shell Folder Modification - c8b150f0-0164-475b-a75e-74b47800a9ff
 - Startup Folder Persistence via Unsigned Process - 2fba96c0-ade5-4bce-b92f-a5df2509da3f
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -105,7 +115,17 @@ This rule looks for shortcuts created by wscript.exe or cscript.exe, or js/vbs s
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/port-forwarding-rule-addition.asciidoc b/docs/detections/prebuilt-rules/rule-details/port-forwarding-rule-addition.asciidoc
index b75c1c75ae..7d8570e1ba 100644
--- a/docs/detections/prebuilt-rules/rule-details/port-forwarding-rule-addition.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/port-forwarding-rule-addition.asciidoc
@@ -49,11 +49,13 @@ Identifies the creation of a new port forwarding rule. An adversary may abuse th
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Port Forwarding Rule Addition
+*Triage and analysis*
+
+
+
+*Investigating Port Forwarding Rule Addition*
+
 
 Network port forwarding is a mechanism to redirect incoming TCP connections (IPv4 or IPv6) from the local TCP port to any other port number, or even to a port on a remote computer.
 
@@ -61,7 +63,9 @@ Attackers may configure port forwarding rules to bypass network segmentation res
 
 This rule monitors the modifications to the `HKLM\SYSTEM\*ControlSet*\Services\PortProxy\v4tov4\` subkeys.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -71,12 +75,16 @@ This rule monitors the modifications to the `HKLM\SYSTEM\*ControlSet*\Services\P
 - Identify the target host IP address, check the connections originating from the host where the modification occurred, and inspect the credentials used.
   - Investigate suspicious login activity, such as unauthorized access and logins from outside working hours and unusual locations.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Analysts can dismiss the alert if the Administrator is aware of the activity and there are justifications for this configuration.
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Delete the port forwarding rule.
@@ -94,7 +102,17 @@ This rule monitors the modifications to the `HKLM\SYSTEM\*ControlSet*\Services\P
 
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/possible-consent-grant-attack-via-azure-registered-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/possible-consent-grant-attack-via-azure-registered-application.asciidoc
index 1ec4714a0d..e891a9154c 100644
--- a/docs/detections/prebuilt-rules/rule-details/possible-consent-grant-attack-via-azure-registered-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/possible-consent-grant-attack-via-azure-registered-application.asciidoc
@@ -48,17 +48,21 @@ Detects when a user grants permissions to an Azure-registered application or whe
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Possible Consent Grant Attack via Azure-Registered Application
+*Triage and analysis*
+
+
+
+*Investigating Possible Consent Grant Attack via Azure-Registered Application*
+
 
 In an illicit consent grant attack, the attacker creates an Azure-registered application that requests access to data such as contact information, email, or documents. The attacker then tricks an end user into granting that application consent to access their data either through a phishing attack, or by injecting illicit code into a trusted website. After the illicit application has been granted consent, it has account-level access to data without the need for an organizational account. Normal remediation steps like resetting passwords for breached accounts or requiring multi-factor authentication (MFA) on accounts are not effective against this type of attack, since these are third-party applications and are external to the organization.
 
-Official Microsoft guidance for detecting and remediating this attack can be found [here](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants).
+Official Microsoft guidance for detecting and remediating this attack can be found https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants[here].
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - From the Azure AD portal, Review the application that was granted permissions:
   - Click on the `Review permissions` button on the `Permissions` blade of the application.
@@ -69,13 +73,17 @@ Official Microsoft guidance for detecting and remediating this attack can be fou
   -  Low rating or score or bad comments.
   -  Apps with a suspicious publisher or website.
   -  Apps whose last update is not recent. This might indicate an app that is no longer supported.
-- Export and examine the [Oauth app auditing](https://docs.microsoft.com/en-us/defender-cloud-apps/manage-app-permissions#oauth-app-auditing) to identify users affected.
+- Export and examine the https://docs.microsoft.com/en-us/defender-cloud-apps/manage-app-permissions#oauth-app-auditing[Oauth app auditing] to identify users affected.
+
+
+*False positive analysis*
 
-### False positive analysis
 
 - This mechanism can be used legitimately. Malicious applications abuse the same workflow used by legitimate apps. Thus, analysts must review each app consent to ensure that only desired apps are granted access.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
@@ -87,14 +95,18 @@ Official Microsoft guidance for detecting and remediating this attack can be fou
 - Disable the malicious application to stop user access and the application access to your data.
 - Revoke the application Oauth consent grant. The `Remove-AzureADOAuth2PermissionGrant` cmdlet can be used to complete this task.
 - Remove the service principal application role assignment. The `Remove-AzureADServiceAppRoleAssignment` cmdlet can be used to complete this task.
-- Revoke the refresh token for all users assigned to the application. Azure provides a [playbook](https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Revoke-AADSignInSessions) for this task.
-- [Report](https://docs.microsoft.com/en-us/defender-cloud-apps/manage-app-permissions#send-feedback) the application as malicious to Microsoft.
+- Revoke the refresh token for all users assigned to the application. Azure provides a https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Revoke-AADSignInSessions[playbook] for this task.
+- https://docs.microsoft.com/en-us/defender-cloud-apps/manage-app-permissions#send-feedback[Report] the application as malicious to Microsoft.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
 - Investigate the potential for data compromise from the user's email and file sharing services. Activate your Data Loss incident response playbook.
 - Disable the permission for a user to set consent permission on their behalf.
-  - Enable the [Admin consent request](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-admin-consent-workflow) feature.
+  - Enable the https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-admin-consent-workflow[Admin consent request] feature.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/possible-fin7-dga-command-and-control-behavior.asciidoc b/docs/detections/prebuilt-rules/rule-details/possible-fin7-dga-command-and-control-behavior.asciidoc
index 616bc167e5..e38c6b50c9 100644
--- a/docs/detections/prebuilt-rules/rule-details/possible-fin7-dga-command-and-control-behavior.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/possible-fin7-dga-command-and-control-behavior.asciidoc
@@ -44,12 +44,11 @@ This rule detects a known command and control pattern in network events. The FIN
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
+
+*Triage and analysis*
+
 
 In the event this rule identifies benign domains in your environment, the `destination.domain` field in the rule can be modified to include those domains. Example: `...AND NOT destination.domain:(zoom.us OR benign.domain1 OR benign.domain2)`.
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/possible-okta-dos-attack.asciidoc b/docs/detections/prebuilt-rules/rule-details/possible-okta-dos-attack.asciidoc
index 79def4629f..4cb0493b75 100644
--- a/docs/detections/prebuilt-rules/rule-details/possible-okta-dos-attack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/possible-okta-dos-attack.asciidoc
@@ -44,10 +44,12 @@ Detects possible Denial of Service (DoS) attacks against an Okta organization. A
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-admin-group-account-addition.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-admin-group-account-addition.asciidoc
index c58963f440..0c60c3185c 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-admin-group-account-addition.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-admin-group-account-addition.asciidoc
@@ -40,6 +40,41 @@ Identifies attempts to add an account to the admin group via the command line. T
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
index 30f27dbbdd..ee31bb75f1 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
@@ -45,11 +45,13 @@ Identifies the execution of PowerShell script with keywords related to different
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Antimalware Scan Interface Bypass via PowerShell
+*Triage and analysis*
+
+
+
+*Investigating Potential Antimalware Scan Interface Bypass via PowerShell*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
@@ -58,9 +60,11 @@ The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard
 This rule identifies scripts that contain methods and classes that can be abused to bypass AMSI.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -79,11 +83,15 @@ This rule identifies scripts that contain methods and classes that can be abused
       - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -98,7 +106,6 @@ This rule identifies scripts that contain methods and classes that can be abused
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-application-shimming-via-sdbinst.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-application-shimming-via-sdbinst.asciidoc
index 9f67596e95..78df41dfc1 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-application-shimming-via-sdbinst.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-application-shimming-via-sdbinst.asciidoc
@@ -43,6 +43,17 @@ The Application Shim was created to allow for backward compatibility of software
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-buffer-overflow-attack-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-buffer-overflow-attack-detected.asciidoc
index ec8f18e92a..5feba3df08 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-buffer-overflow-attack-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-buffer-overflow-attack-detected.asciidoc
@@ -40,6 +40,20 @@ Detects potential buffer overflow attacks by querying the "Segfault Detected" pr
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule leverages alert data from other prebuilt detection rules to function correctly. 
+
+
+*Dependent Elastic Detection Rule Enablement*
+
+As a higher-order rule (based on other detections), this rule also requires the following prerequisite Elastic detection rule to be installed and enabled:
+- Segfault Detected (5c81fc9d-1eae-437f-ba07-268472967013)
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-chroot-container-escape-via-mount.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-chroot-container-escape-via-mount.asciidoc
index 6d99b91241..e31d4aabc8 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-chroot-container-escape-via-mount.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-chroot-container-escape-via-mount.asciidoc
@@ -41,6 +41,52 @@ Monitors for the execution of a file system mount followed by a chroot execution
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+Session View uses process data collected by the Elastic Defend integration, but this data is not always collected by default. Session View is available on enterprise subscription for versions 8.3 and above.
+
+*To confirm that Session View data is enabled:*
+
+- Go to “Manage → Policies”, and edit one or more of your Elastic Defend integration policies.
+- Select the” Policy settings” tab, then scroll down to the “Linux event collection” section near the bottom.
+- Check the box for “Process events”, and turn on the “Include session data” toggle.
+- If you want to include file and network alerts in Session View, check the boxes for “Network and File events”.
+- If you want to enable terminal output capture, turn on the “Capture terminal output” toggle.
+For more information about the additional fields collected when this setting is enabled and the usage of Session View for Analysis refer to the https://www.elastic.co/guide/en/security/current/session-view.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-code-execution-via-postgresql.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-code-execution-via-postgresql.asciidoc
index 92a94c542f..61b1f5374a 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-code-execution-via-postgresql.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-code-execution-via-postgresql.asciidoc
@@ -40,6 +40,41 @@ This rule monitors for suspicious activities that may indicate an attacker attem
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-cookies-theft-via-browser-debugging.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-cookies-theft-via-browser-debugging.asciidoc
index 4881d58e95..8654decd20 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-cookies-theft-via-browser-debugging.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-cookies-theft-via-browser-debugging.asciidoc
@@ -48,6 +48,17 @@ Identifies the execution of a Chromium based browser with the debugging process
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-dcsync.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-dcsync.asciidoc
index d8de725d0b..ab4ccb9412 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-dcsync.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-dcsync.asciidoc
@@ -53,11 +53,13 @@ This rule identifies when a User Account starts the Active Directory Replication
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Credential Access via DCSync
+*Triage and analysis*
+
+
+
+*Investigating Potential Credential Access via DCSync*
+
 
 Active Directory replication is the process by which the changes that originate on one domain controller are automatically transferred to other domain controllers that store the same data.
 
@@ -65,11 +67,13 @@ Active Directory data consists of objects that have properties, or attributes. E
 
 Adversaries can use the DCSync technique that uses Windows Domain Controller's API to simulate the replication process from a remote domain controller, compromising major credential material such as the Kerberos krbtgt keys used legitimately for tickets creation, but also tickets forging by attackers. This attack requires some extended privileges to succeed (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), which are granted by default to members of the Administrators, Domain Admins, Enterprise Admins, and Domain Controllers groups. Privileged accounts can be abused to grant controlled objects the right to DCsync/Replicate.
 
-More details can be found on [Threat Hunter Playbook](https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing) and [The Hacker Recipes](https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync).
+More details can be found on https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing[Threat Hunter Playbook] and https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync[The Hacker Recipes].
 
-This rule monitors for Event ID 4662 (Operation was performed on an Active Directory object) and identifies events that use the access mask 0x100 (Control Access) and properties that contain at least one of the following or their equivalent Schema-Id-GUID (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set). It also filters out events that use computer accounts and also Azure AD Connect MSOL accounts (more details [here](https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/ad-connect-msol-user-suspected-dcsync-attack/m-p/788028)).
+This rule monitors for Event ID 4662 (Operation was performed on an Active Directory object) and identifies events that use the access mask 0x100 (Control Access) and properties that contain at least one of the following or their equivalent Schema-Id-GUID (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set). It also filters out events that use computer accounts and also Azure AD Connect MSOL accounts (more details https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/ad-connect-msol-user-suspected-dcsync-attack/m-p/788028[here]).
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account and system owners and confirm whether they are aware of this activity.
@@ -77,12 +81,16 @@ This rule monitors for Event ID 4662 (Operation was performed on an Active Direc
 - Correlate security events 4662 and 4624 (Logon Type 3) by their Logon ID (`winlog.logon.id`) on the Domain Controller (DC) that received the replication request. This will tell you where the AD replication request came from, and if it came from another DC or not.
 - Scope which credentials were compromised (for example, whether all accounts were replicated or specific ones).
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Administrators may use custom accounts on Azure AD Connect, investigate if it is the case, and if it is properly secured. If noisy in your environment due to expected activity, consider adding the corresponding account as a exception.
 - Although replicating Active Directory (AD) data to non-Domain Controllers is not a common practice and is generally not recommended from a security perspective, some software vendors may require it for their products to function correctly. If this rule is noisy in your environment due to expected activity, consider adding the corresponding account as a exception.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
@@ -93,7 +101,25 @@ This rule monitors for Event ID 4662 (Operation was performed on an Active Direc
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'Audit Directory Service Access' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Access (Success,Failure)
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-duplicatehandle-in-lsass.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-duplicatehandle-in-lsass.asciidoc
index 6a9886eb31..40be6aa2c4 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-duplicatehandle-in-lsass.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-duplicatehandle-in-lsass.asciidoc
@@ -41,6 +41,17 @@ Identifies suspicious access to an LSASS handle via DuplicateHandle from an unkn
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-lsass-memory-dump.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-lsass-memory-dump.asciidoc
index 7ccb3e4cd3..4812de6f24 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-lsass-memory-dump.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-lsass-memory-dump.asciidoc
@@ -43,6 +43,17 @@ Identifies suspicious access to LSASS handle from a call trace pointing to DBGHe
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-renamed-com-services-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-renamed-com-services-dll.asciidoc
index ba3022621e..c919fb5b37 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-renamed-com-services-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-renamed-com-services-dll.asciidoc
@@ -45,20 +45,24 @@ Identifies suspicious renamed COMSVCS.DLL Image Load, which exports the MiniDump
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Credential Access via Renamed COM+ Services DLL
+*Triage and analysis*
+
+
+
+*Investigating Potential Credential Access via Renamed COM+ Services DLL*
+
 
 COMSVCS.DLL is a Windows library that exports the MiniDump function, which can be used to dump a process memory. Adversaries may attempt to dump LSASS memory using a renamed COMSVCS.DLL to bypass command-line based detection and gain unauthorized access to credentials.
 
 This rule identifies suspicious instances of rundll32.exe loading a renamed COMSVCS.DLL image, which can indicate potential abuse of the MiniDump function for credential theft.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
@@ -80,18 +84,24 @@ This rule identifies suspicious instances of rundll32.exe loading a renamed COMS
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 - Look for the presence of relevant artifacts on other systems. Identify commonalities and differences between potentially compromised systems.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - False positives may include legitimate instances of rundll32.exe loading a renamed COMSVCS.DLL image for non-malicious purposes, such as during software development, testing, or troubleshooting.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Potential Credential Access via LSASS Memory Dump - 9960432d-9b26-409f-972b-839a959e79e2
 - Suspicious Module Loaded by LSASS - 3a6001a0-0939-4bbe-86f4-47d8faeb7b97
 - Suspicious Lsass Process Access - 128468bf-cab1-4637-99ea-fdf3780a4609
 - LSASS Process Access via Windows API - ff4599cb-409f-4910-a239-52e4e6f532ff
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
   - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
@@ -109,7 +119,14 @@ This rule identifies suspicious instances of rundll32.exe loading a renamed COMS
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+You will need to enable logging of ImageLoads in your Sysmon configuration to include COMSVCS.DLL by Imphash or Original
+File Name.
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
index 8b53911a47..aad77b5849 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
@@ -45,11 +45,13 @@ An instance of MSBuild, the Microsoft Build Engine, loaded DLLs (dynamically lin
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Credential Access via Trusted Developer Utility
+*Triage and analysis*
+
+
+
+*Investigating Potential Credential Access via Trusted Developer Utility*
+
 
 The Microsoft Build Engine is a platform for building applications. This engine, also known as MSBuild, provides an XML schema for a project file that controls how the build platform processes and builds software.
 
@@ -58,9 +60,11 @@ Adversaries can abuse MSBuild to proxy the execution of malicious code. The inli
 This rule looks for the MSBuild process loading `vaultcli.dll` or `SAMLib.DLL`, which indicates the execution of credential access activities.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
@@ -81,11 +85,15 @@ This rule looks for the MSBuild process loading `vaultcli.dll` or `SAMLib.DLL`,
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -100,7 +108,6 @@ This rule looks for the MSBuild process loading `vaultcli.dll` or `SAMLib.DLL`,
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc
index fd8c681398..beffbc3320 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc
@@ -50,11 +50,13 @@ Identifies the execution of known Windows utilities often abused to dump LSASS m
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Credential Access via Windows Utilities
+*Triage and analysis*
+
+
+
+*Investigating Potential Credential Access via Windows Utilities*
+
 
 Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.
 
@@ -62,7 +64,9 @@ The `Ntds.dit` file is a database that stores Active Directory data, including i
 
 This rule looks for the execution of utilities that can extract credential data from the LSASS memory and Active Directory `Ntds.dit` file.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
@@ -70,11 +74,15 @@ This rule looks for the execution of utilities that can extract credential data
 - Examine the command line to identify what information was targeted.
 - Identify the target computer and its role in the IT environment.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - If the host is a domain controller (DC):
@@ -87,7 +95,17 @@ This rule looks for the execution of utilities that can extract credential data
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-curl-cve-2023-38545-exploitation.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-curl-cve-2023-38545-exploitation.asciidoc
index 2f6706b156..1c74003b71 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-curl-cve-2023-38545-exploitation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-curl-cve-2023-38545-exploitation.asciidoc
@@ -43,6 +43,54 @@ Detects potential exploitation of curl CVE-2023-38545 by monitoring for vulnerab
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+Elastic Defend integration does not collect environment variable logging by default.
+In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
+ #### To set up environment variable capture for an Elastic Agent policy:
+- Go to “Security → Manage → Policies”.
+- Select an “Elastic Agent policy”.
+- Click “Show advanced settings”.
+- Scroll down or search for “linux.advanced.capture_env_vars”.
+- Enter the names of environment variables you want to capture, separated by commas.
+- For this rule the linux.advanced.capture_env_vars variable should be set to "http_proxy,HTTPS_PROXY,ALL_PROXY".
+- Click “Save”.
+After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.
+For more information on capturing environment variables refer to the https://www.elastic.co/guide/en/security/current/environment-variable-capture.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-destination-port.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-destination-port.asciidoc
index f816520a70..c669b849f2 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-destination-port.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-destination-port.asciidoc
@@ -39,6 +39,42 @@ A machine learning job has detected data exfiltration to a particular destinatio
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Data Exfiltration Detection integration assets to be installed, as well as network and file events collected by integrations such as Elastic Defend and Network Packet Capture (for network events only).  
+
+
+*Data Exfiltration Detection Setup*
+
+The Data Exfiltration Detection integration detects data exfiltration activity by identifying abnormalities in network and file events. Anomalies are detected using Elastic's Anomaly Detection feature. 
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Data Exfiltration Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Network events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] or https://docs.elastic.co/integrations/network_traffic[Network Packet Capture] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To add the Network Packet Capture integration to an Elastic Agent policy, refer to https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the Data Exfiltration Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Data Exfiltration Detection and select the integration to see more details about it.
+- Under Settings, click Install Data Exfiltration Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Data Exfiltration Detection, you'll need to enable the corresponding Anomaly Detection jobs. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your network data. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `logs-network_traffic.*` if you used Network Packet Capture.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/ded/kibana/ml_module/ded-ml.json[this] configuration file, you will see a card for Data Exfiltration Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-ip-address.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-ip-address.asciidoc
index 3400bd189f..e1a584897d 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-ip-address.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-ip-address.asciidoc
@@ -39,6 +39,42 @@ A machine learning job has detected data exfiltration to a particular geo-locati
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Data Exfiltration Detection integration assets to be installed, as well as network and file events collected by integrations such as Elastic Defend and Network Packet Capture (for network events only).  
+
+
+*Data Exfiltration Detection Setup*
+
+The Data Exfiltration Detection integration detects data exfiltration activity by identifying abnormalities in network and file events. Anomalies are detected using Elastic's Anomaly Detection feature. 
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Data Exfiltration Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Network events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] or https://docs.elastic.co/integrations/network_traffic[Network Packet Capture] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To add the Network Packet Capture integration to an Elastic Agent policy, refer to https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the Data Exfiltration Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Data Exfiltration Detection and select the integration to see more details about it.
+- Under Settings, click Install Data Exfiltration Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Data Exfiltration Detection, you'll need to enable the corresponding Anomaly Detection jobs. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your network data. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `logs-network_traffic.*` if you used Network Packet Capture.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/ded/kibana/ml_module/ded-ml.json[this] configuration file, you will see a card for Data Exfiltration Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-iso-code.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-iso-code.asciidoc
index ac9f50c20c..8df728c22d 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-iso-code.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-iso-code.asciidoc
@@ -39,6 +39,42 @@ A machine learning job has detected data exfiltration to a particular geo-locati
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Data Exfiltration Detection integration assets to be installed, as well as network and file events collected by integrations such as Elastic Defend and Network Packet Capture (for network events only).  
+
+
+*Data Exfiltration Detection Setup*
+
+The Data Exfiltration Detection integration detects data exfiltration activity by identifying abnormalities in network and file events. Anomalies are detected using Elastic's Anomaly Detection feature. 
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Data Exfiltration Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Network events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] or https://docs.elastic.co/integrations/network_traffic[Network Packet Capture] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To add the Network Packet Capture integration to an Elastic Agent policy, refer to https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the Data Exfiltration Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Data Exfiltration Detection and select the integration to see more details about it.
+- Under Settings, click Install Data Exfiltration Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Data Exfiltration Detection, you'll need to enable the corresponding Anomaly Detection jobs. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your network data. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `logs-network_traffic.*` if you used Network Packet Capture.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/ded/kibana/ml_module/ded-ml.json[this] configuration file, you will see a card for Data Exfiltration Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-region.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-region.asciidoc
index 782cebb837..f0afd036f6 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-region.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-region.asciidoc
@@ -39,6 +39,42 @@ A machine learning job has detected data exfiltration to a particular geo-locati
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Data Exfiltration Detection integration assets to be installed, as well as network and file events collected by integrations such as Elastic Defend and Network Packet Capture (for network events only).  
+
+
+*Data Exfiltration Detection Setup*
+
+The Data Exfiltration Detection integration detects data exfiltration activity by identifying abnormalities in network and file events. Anomalies are detected using Elastic's Anomaly Detection feature. 
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Data Exfiltration Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Network events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] or https://docs.elastic.co/integrations/network_traffic[Network Packet Capture] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To add the Network Packet Capture integration to an Elastic Agent policy, refer to https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the Data Exfiltration Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Data Exfiltration Detection and select the integration to see more details about it.
+- Under Settings, click Install Data Exfiltration Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Data Exfiltration Detection, you'll need to enable the corresponding Anomaly Detection jobs. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your network data. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `logs-network_traffic.*` if you used Network Packet Capture.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/ded/kibana/ml_module/ded-ml.json[this] configuration file, you will see a card for Data Exfiltration Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-defense-evasion-via-proot.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-defense-evasion-via-proot.asciidoc
index 49bd7b73ac..dfba733c9b 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-defense-evasion-via-proot.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-defense-evasion-via-proot.asciidoc
@@ -8,6 +8,7 @@ Identifies the execution of the PRoot utility, an open-source tool for user-spac
 *Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
@@ -30,8 +31,9 @@ Identifies the execution of the PRoot utility, an open-source tool for user-spac
 * Use Case: Threat Detection
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
+* Data Source: Elastic Endgame
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -40,12 +42,47 @@ Identifies the execution of the PRoot utility, an open-source tool for user-spac
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-process where  event.action == "exec" and process.parent.name =="proot" and host.os.type == "linux"
+process where host.os.type == "linux" and event.action in ("exec", "exec_event") and process.parent.name == "proot"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-dga-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-dga-activity.asciidoc
index e726c5c6d8..924e7f163a 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-dga-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-dga-activity.asciidoc
@@ -39,6 +39,73 @@ A population analysis machine learning job detected potential DGA (domain genera
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Domain Generation Algorithm (DGA) Detection integration assets to be installed, as well as DNS events collected by integrations such as Elastic Defend, Network Packet Capture, or Packetbeat.  
+
+
+*DGA Detection Setup*
+
+The DGA Detection integration consists of an ML-based framework to detect DGA activity in DNS events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for DGA Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- DNS events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend], https://docs.elastic.co/integrations/network_traffic[Network Packet Capture] integration, or https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-overview.html[Packetbeat].
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To add the Network Packet Capture integration to an Elastic Agent policy, refer to https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html[this] guide.
+- To set up and run Packetbeat, follow https://www.elastic.co/guide/en/beats/packetbeat/current/setting-up-and-running.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the DGA Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Domain Generation Algorithm Detection and select the integration to see more details about it.
+- Under Settings, click Install Domain Generation Algorithm Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+Before you can enable this rule, you'll need to enrich DNS events with predictions from the Supervised DGA Detection model. This is done via the ingest pipeline named `<package_version>-ml_dga_ingest_pipeline` installed with the DGA Detection package.
+- If using an Elastic Beat such as Packetbeat, add the DGA ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `packetbeat.yml`.
+- If adding the DGA ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the DGA ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "ml_is_dga": {
+      "properties": {
+        "malicious_prediction": {
+          "type": "long"
+        },
+        "malicious_probability": {
+          "type": "float"
+        }
+      }
+    }
+  }
+}
+```
+
+
+*Anomaly Detection Setup*
+
+Before you can enable this rule, you'll need to enable the corresponding Anomaly Detection job. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched DNS events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `logs-network_traffic.*` if you used Network Packet Capture.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/dga/kibana/ml_module/dga-ml.json[this] configuration file, you will see a card for DGA under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-disabling-of-apparmor.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-disabling-of-apparmor.asciidoc
index 83b4abdc77..b44e313292 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-disabling-of-apparmor.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-disabling-of-apparmor.asciidoc
@@ -8,6 +8,9 @@ This rule monitors for potential attempts to disable AppArmor. AppArmor is a Lin
 *Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
 
 *Severity*: low
 
@@ -28,8 +31,10 @@ This rule monitors for potential attempts to disable AppArmor. AppArmor is a Lin
 * Use Case: Threat Detection
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Auditd Manager
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -38,14 +43,50 @@ This rule monitors for potential attempts to disable AppArmor. AppArmor is a Lin
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and (
+process where host.os.type == "linux" and event.action in ("exec", "exec_event", "executed") and event.type == "start"
+and (
   (process.name == "systemctl" and process.args == "disable" and process.args == "apparmor") or
-  (process.name == "ln" and process.args : "/etc/apparmor.d/*" and process.args : "/etc/apparmor.d/disable/")
+  (process.name == "ln" and process.args : "/etc/apparmor.d/*" and process.args == "/etc/apparmor.d/disable/")
 )
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-disabling-of-selinux.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-disabling-of-selinux.asciidoc
index 2e14442197..c5c8372109 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-disabling-of-selinux.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-disabling-of-selinux.asciidoc
@@ -3,13 +3,14 @@
 
 Identifies potential attempts to disable Security-Enhanced Linux (SELinux), which is a Linux kernel security feature to support access control policies. Adversaries may disable security tools to avoid possible detection of their tools and activities.
 
-*Rule type*: query
+*Rule type*: eql
 
 *Rule indices*: 
 
-* auditbeat-*
 * logs-endpoint.events.*
 * endgame-*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
 
 *Severity*: medium
 
@@ -31,8 +32,9 @@ Identifies potential attempts to disable Security-Enhanced Linux (SELinux), whic
 * Tactic: Defense Evasion
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
+* Data Source: Auditd Manager
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
@@ -41,12 +43,64 @@ Identifies potential attempts to disable Security-Enhanced Linux (SELinux), whic
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:setenforce and process.args:0
+process where host.os.type == "linux" and event.type in ("start", "process_started") and
+process.name == "setenforce" and process.args == "0"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
index 9cc9115b84..53a7fe2dbd 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
@@ -46,6 +46,17 @@ Identifies a Windows trusted program that is known to be vulnerable to DLL Searc
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
index 2f27cb30f2..65bfcdd52b 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
@@ -43,6 +43,17 @@ Identifies an instance of a Windows trusted program that is known to be vulnerab
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-nslookup.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-nslookup.asciidoc
index 48cc438bd7..07f1f77d7e 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-nslookup.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-nslookup.asciidoc
@@ -49,30 +49,38 @@ This rule identifies a large number (15) of nslookup.exe executions with an expl
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential DNS Tunneling via NsLookup
+*Triage and analysis*
+
+
+
+*Investigating Potential DNS Tunneling via NsLookup*
+
 
 Attackers can abuse existing network rules that allow DNS communication with external resources to use the protocol as their command and control and/or exfiltration channel.
 
 DNS queries can be used to infiltrate data such as commands to be run, malicious files, etc., and also for exfiltration, since queries can be used to send data to the attacker-controlled DNS server. This process is commonly known as DNS tunneling.
 
-More information on how tunneling works and how it can be abused can be found on [Palo Alto Unit42 Research](https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors).
+More information on how tunneling works and how it can be abused can be found on https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors[Palo Alto Unit42 Research].
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Inspect the DNS query and identify the information sent.
 - Extract this communication's indicators of compromise (IoCs) and use traffic logs to search for other potentially compromised hosts.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. If the parent process is trusted and the data sent is not sensitive nor command and control related, this alert can be closed.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -85,7 +93,6 @@ More information on how tunneling works and how it can be abused can be found on
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
index 52263edc49..386ab36f22 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
@@ -46,11 +46,13 @@ The Filter Manager Control Program (fltMC.exe) binary may be abused by adversari
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Evasion via Filter Manager
+*Triage and analysis*
+
+
+
+*Investigating Potential Evasion via Filter Manager*
+
 
 A file system filter driver, or minifilter, is a specialized type of filter driver designed to intercept and modify I/O requests sent to a file system or another filter driver. Minifilters are used by a wide range of security software, including EDR, antivirus, backup agents, encryption products, etc.
 
@@ -59,13 +61,15 @@ Attackers may try to unload minifilters to avoid protections such as malware det
 This rule identifies the attempt to unload a minifilter using the `fltmc.exe` command-line utility, a tool used to manage and query the filter drivers loaded on Windows systems.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Examine the command line event to identify the target driver.
-  - Identify the minifilter's role in the environment and if it is security-related. Microsoft provides a [list](https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/allocated-altitudes) of allocated altitudes that may provide more context, such as the manufacturer.
+  - Identify the minifilter's role in the environment and if it is security-related. Microsoft provides a https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/allocated-altitudes[list] of allocated altitudes that may provide more context, such as the manufacturer.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -81,11 +85,15 @@ This rule identifies the attempt to unload a minifilter using the `fltmc.exe` co
       - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and there are justifications for the action.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -100,7 +108,6 @@ This rule identifies the attempt to unload a minifilter using the `fltmc.exe` co
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-windows-filtering-platform.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-windows-filtering-platform.asciidoc
index 0d5233737a..8cf0b4372e 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-windows-filtering-platform.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-windows-filtering-platform.asciidoc
@@ -46,6 +46,25 @@ Identifies multiple Windows Filtering Platform block events and where the proces
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+The 'Filtering Platform Connection' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+Object Access >
+Filtering Platform Connection (Success,Failure)
+```
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-external-linux-ssh-brute-force-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-external-linux-ssh-brute-force-detected.asciidoc
index 64ac35f4a5..5c34e4f1fe 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-external-linux-ssh-brute-force-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-external-linux-ssh-brute-force-detected.asciidoc
@@ -40,11 +40,13 @@ Identifies multiple external consecutive login failures targeting a user account
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential External Linux SSH Brute Force Detected
+*Triage and analysis*
+
+
+
+*Investigating Potential External Linux SSH Brute Force Detected*
+
 
 The rule identifies consecutive SSH login failures targeting a user account from the same source IP address to the same target host indicating brute force login attempts.
 
@@ -52,25 +54,33 @@ This rule will generate a lot of noise for systems with a front-facing SSH servi
 
 In case this rule generates too much noise and external brute forcing is of not much interest, consider turning this rule off and enabling "Potential Internal Linux SSH Brute Force Detected" to detect internal brute force attempts.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the login failure user name(s).
 - Investigate the source IP address of the failed ssh login attempt(s).
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Identify the source and the target computer and their roles in the IT environment.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Authentication misconfiguration or obsolete credentials.
 - Service account password expired.
 - Infrastructure or availability issue.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Potential Internal Linux SSH Brute Force Detected - 1c27fa22-7727-4dd3-81c0-de6da5555feb
 - Potential SSH Password Guessing - 8cb84371-d053-4f4f-bce0-c74990e28f28
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -80,7 +90,36 @@ In case this rule generates too much noise and external brute forcing is of not
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Filebeat.
+
+
+*Filebeat Setup*
+
+Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing.
+
+
+*The following steps should be executed in order to add the Filebeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html[helper guide].
+- To run Filebeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html[helper guide].
+- To run Filebeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html[helper guide].
+- For quick start information for Filebeat refer to the https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html[helper guide].
+- For complete “Setup and Run Filebeat” information refer to the https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html[helper guide].
+
+
+*Rule Specific Setup Note*
+
+- This rule requires the “Filebeat System Module” to be enabled.
+- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions.
+- To run the system module of Filebeat on Linux follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-file-transfer-via-certreq.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-file-transfer-via-certreq.asciidoc
index fb157de9e9..40620104e5 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-file-transfer-via-certreq.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-file-transfer-via-certreq.asciidoc
@@ -50,20 +50,24 @@ Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential File Transfer via Certreq
+*Triage and analysis*
+
+
+
+*Investigating Potential File Transfer via Certreq*
+
 
 Certreq is a command-line utility in Windows operating systems that allows users to request and manage certificates from certificate authorities. It is primarily used for generating certificate signing requests (CSRs) and installing certificates. However, adversaries may abuse Certreq's functionality to download files or upload data to a remote URL by making an HTTP POST request.
 
 This rule identifies the potential abuse of Certreq to download files or upload data to a remote URL.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -86,11 +90,15 @@ This rule identifies the potential abuse of Certreq to download files or upload
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unusual but can be done by administrators. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -105,7 +113,6 @@ This rule identifies the potential abuse of Certreq to download files or upload
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-hidden-local-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-hidden-local-user-account-creation.asciidoc
index 438579ef8a..297533d112 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-hidden-local-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-hidden-local-user-account-creation.asciidoc
@@ -40,6 +40,41 @@ Identifies attempts to create a local account that will be hidden from the macOS
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-hidden-process-via-mount-hidepid.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-hidden-process-via-mount-hidepid.asciidoc
index f30a0efcaf..58cc78ea6f 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-hidden-process-via-mount-hidepid.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-hidden-process-via-mount-hidepid.asciidoc
@@ -8,6 +8,9 @@ Identifies the execution of mount process with hidepid parameter, which can make
 *Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
 
 *Severity*: medium
 
@@ -29,9 +32,11 @@ Identifies the execution of mount process with hidepid parameter, which can make
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Defense Evasion
+* Data Source: Elastic Endgame
 * Data Source: Elastic Defend
+* Data Source: Auditd Manager
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -40,13 +45,48 @@ Identifies the execution of mount process with hidepid parameter, which can make
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-process where host.os.type == "linux" and process.name == "mount" and event.action == "exec" and
-process.args == "/proc" and process.args == "-o" and process.args : "*hidepid=2*"
+process where host.os.type == "linux" and event.action in ("exec", "exec_event", "executed") and event.type == "start" 
+and process.name == "mount" and process.args == "/proc" and process.args == "-o" and process.args : "*hidepid=2*"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-internal-linux-ssh-brute-force-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-internal-linux-ssh-brute-force-detected.asciidoc
index 45b4aa4390..c90230fab4 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-internal-linux-ssh-brute-force-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-internal-linux-ssh-brute-force-detected.asciidoc
@@ -40,33 +40,43 @@ Identifies multiple internal consecutive login failures targeting a user account
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Internal Linux SSH Brute Force Detected
+*Triage and analysis*
+
+
+
+*Investigating Potential Internal Linux SSH Brute Force Detected*
+
 
 The rule identifies consecutive internal SSH login failures targeting a user account from the same source IP address to the same target host indicating brute force login attempts.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the login failure user name(s).
 - Investigate the source IP address of the failed ssh login attempt(s).
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Identify the source and the target computer and their roles in the IT environment.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Authentication misconfiguration or obsolete credentials.
 - Service account password expired.
 - Infrastructure or availability issue.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Potential External Linux SSH Brute Force Detected - fa210b61-b627-4e5e-86f4-17e8270656ab
 - Potential SSH Password Guessing - 8cb84371-d053-4f4f-bce0-c74990e28f28
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -76,7 +86,36 @@ The rule identifies consecutive internal SSH login failures targeting a user acc
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Filebeat.
+
+
+*Filebeat Setup*
+
+Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing.
+
+
+*The following steps should be executed in order to add the Filebeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html[helper guide].
+- To run Filebeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html[helper guide].
+- To run Filebeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html[helper guide].
+- For quick start information for Filebeat refer to the https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html[helper guide].
+- For complete “Setup and Run Filebeat” information refer to the https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html[helper guide].
+
+
+*Rule Specific Setup Note*
+
+- This rule requires the “Filebeat System Module” to be enabled.
+- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions.
+- To run the system module of Filebeat on Linux follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-invoke-mimikatz-powershell-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-invoke-mimikatz-powershell-script.asciidoc
index be9812e4a6..9ff52f6e15 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-invoke-mimikatz-powershell-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-invoke-mimikatz-powershell-script.asciidoc
@@ -47,19 +47,23 @@ Mimikatz is a credential dumper capable of obtaining plaintext Windows account l
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Mimikatz PowerShell Activity
+*Triage and analysis*
+
+
 
-[Mimikatz](https://github.com/gentilkiwi/mimikatz) is an open-source tool used to collect, decrypt, and/or use cached credentials. This tool is commonly abused by adversaries during the post-compromise stage where adversaries have gained an initial foothold on an endpoint and are looking to elevate privileges and seek out additional authentication objects such as tokens/hashes/credentials that can then be used to move laterally and pivot across a network.
+*Investigating Mimikatz PowerShell Activity*
+
+
+https://github.com/gentilkiwi/mimikatz[Mimikatz] is an open-source tool used to collect, decrypt, and/or use cached credentials. This tool is commonly abused by adversaries during the post-compromise stage where adversaries have gained an initial foothold on an endpoint and are looking to elevate privileges and seek out additional authentication objects such as tokens/hashes/credentials that can then be used to move laterally and pivot across a network.
 
 This rule looks for PowerShell scripts that load mimikatz in memory, like Invoke-Mimikataz, which are used to dump credentials from the Local Security Authority Subsystem Service (LSASS). Any activity triggered from this rule should be treated with high priority as it typically represents an active adversary.
 
-More information about Mimikatz components and how to detect/prevent them can be found on [ADSecurity](https://adsecurity.org/?page_id=1821).
+More information about Mimikatz components and how to detect/prevent them can be found on https://adsecurity.org/?page_id=1821[ADSecurity].
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -70,11 +74,15 @@ More information about Mimikatz components and how to detect/prevent them can be
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host.
   - Examine network and security events in the environment to identify potential lateral movement using compromised credentials.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Related rules
+
+*Related rules*
+
 
 - PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
 - Suspicious .NET Reflection via PowerShell - e26f042e-c590-4e82-8e05-41e81bd822ad
@@ -83,7 +91,9 @@ More information about Mimikatz components and how to detect/prevent them can be
 - Mimikatz Memssp Log File Detected - ebb200e8-adf0-43f8-a0bb-4ee5b5d852c6
 - Modification of WDigest Security Provider - d703a5af-d5b0-43bd-8ddb-7a5d500b7da5
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -96,7 +106,28 @@ More information about Mimikatz components and how to detect/prevent them can be
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be configured (Enable).
+
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-kerberos-attack-via-bifrost.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-kerberos-attack-via-bifrost.asciidoc
index fcc7871277..507a6d81c8 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-kerberos-attack-via-bifrost.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-kerberos-attack-via-bifrost.asciidoc
@@ -41,6 +41,41 @@ Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-lateral-tool-transfer-via-smb-share.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-lateral-tool-transfer-via-smb-share.asciidoc
index b3f213986f..22f251759c 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-lateral-tool-transfer-via-smb-share.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-lateral-tool-transfer-via-smb-share.asciidoc
@@ -42,15 +42,19 @@ Identifies the creation or change of a Windows executable file over network shar
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Lateral Tool Transfer via SMB Share
+*Triage and analysis*
+
+
+
+*Investigating Potential Lateral Tool Transfer via SMB Share*
+
 
 Adversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These tools can include discovery utilities, credential dumpers, malware, etc. Attackers can also leverage file shares that employees frequently access to host malicious files to gain a foothold in other machines.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -66,11 +70,15 @@ Adversaries can use network shares to host tooling to support the compromise of
   - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity can happen legitimately. Consider adding exceptions if it is expected and noisy in your environment.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -85,7 +93,6 @@ Adversaries can use network shares to host tooling to support the compromise of
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
index 03e0b52540..a58c6db7c4 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
@@ -44,11 +44,13 @@ Identifies the attempt to create a new backdoor user by setting the user's UID t
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Linux Backdoor User Account Creation
+*Triage and analysis*
+
+
+
+*Investigating Potential Linux Backdoor User Account Creation*
+
 
 The `usermod` command is used to modify user account attributes and settings in Linux-based operating systems.
 
@@ -57,10 +59,12 @@ Attackers may create new accounts with a UID of 0 to maintain root access to tar
 This rule identifies the usage of the `usermod` command to set a user's UID to 0, indicating that the user becomes a root account. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 - Investigate the user account that got assigned a uid of 0, and analyze its corresponding attributes.
   - !{osquery{"label":"Osquery - Retrieve User Accounts with a UID of 0","query":"SELECT description, gid, gid_signed, shell, uid, uid_signed, username FROM users WHERE username != 'root' AND uid LIKE '0'"}}
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
@@ -73,11 +77,15 @@ This rule identifies the usage of the `usermod` command to set a user's UID to 0
   - !{osquery{"label":"Osquery - Retrieve Information for a Specific Group","query":"SELECT * FROM groups WHERE groupname = {{group.name}}"}}
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -94,7 +102,41 @@ This rule identifies the usage of the `usermod` command to set a user's UID to 0
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-proc-filesystem.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-proc-filesystem.asciidoc
index 7fd3385407..600ffee2d9 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-proc-filesystem.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-proc-filesystem.asciidoc
@@ -33,7 +33,7 @@ Identifies the execution of the mimipenguin exploit script which is linux adapta
 * Use Case: Vulnerability
 * Data Source: Elastic Defend
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -42,17 +42,51 @@ Identifies the execution of the mimipenguin exploit script which is linux adapta
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-sequence by process.parent.name,host.name with maxspan=1m
-[process where host.os.type == "linux" and process.name == "ps" and event.action == "exec"
- and process.args in ("-eo", "pid", "command") ]
-
-[process where host.os.type == "linux" and process.name == "strings" and event.action == "exec"
- and process.args : "/tmp/*" ]
+sequence by host.id, process.parent.name with maxspan=1m
+  [process where host.os.type == "linux" and process.name == "ps" and event.action == "exec"
+   and process.args in ("-eo", "pid", "command")]
+  [process where host.os.type == "linux" and process.name == "strings" and event.action == "exec"
+   and process.args : "/tmp/*"]
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-unshadow.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-unshadow.asciidoc
index 3c027fe719..de7e2fa928 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-unshadow.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-credential-dumping-via-unshadow.asciidoc
@@ -26,14 +26,14 @@ Identifies the execution of the unshadow utility which is part of John the Rippe
 
 *Tags*: 
 
-* Data Source: Elastic Endgame
 * Domain: Endpoint
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Credential Access
 * Data Source: Elastic Defend
+* Data Source: Elastic Endgame
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
@@ -42,13 +42,48 @@ Identifies the execution of the unshadow utility which is part of John the Rippe
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-process where host.os.type == "linux" and process.name == "unshadow" and
-  event.type == "start" and event.action in ("exec", "exec_event") and process.args_count >= 2
+process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event") and
+process.name == "unshadow" and process.args_count >= 3
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-hack-tool-launched.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-hack-tool-launched.asciidoc
index 6ba1a74b36..8bb3cc99f2 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-linux-hack-tool-launched.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-hack-tool-launched.asciidoc
@@ -40,6 +40,42 @@ Monitors for the execution of different processes that might be used by attacker
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-local-account-brute-force-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-local-account-brute-force-detected.asciidoc
index 69324f7646..4371adbfca 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-linux-local-account-brute-force-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-local-account-brute-force-detected.asciidoc
@@ -29,7 +29,7 @@ Identifies multiple consecutive login attempts executed by one process targeting
 * Tactic: Credential Access
 * Data Source: Elastic Defend
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -38,16 +38,53 @@ Identifies multiple consecutive login attempts executed by one process targeting
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
 sequence by host.id, process.parent.executable, user.id with maxspan=1s
- [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "su" and 
-  not process.parent.name in (
-   "bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "clickhouse-server"
-  )] with runs=10
+  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "su" and 
+   not process.parent.name in (
+     "bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "clickhouse-server", "ma", "gitlab-runner",
+     "updatedb.findutils", "cron"
+   )
+  ] with runs=10
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-ransomware-note-creation-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-ransomware-note-creation-detected.asciidoc
index 4ca536e754..53a6df402f 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-linux-ransomware-note-creation-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-ransomware-note-creation-detected.asciidoc
@@ -38,6 +38,41 @@ This rule identifies a sequence of a mass file encryption event in conjunction w
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-ssh-x11-forwarding.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-ssh-x11-forwarding.asciidoc
index 7fb714fb88..8d5ed15d88 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-linux-ssh-x11-forwarding.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-ssh-x11-forwarding.asciidoc
@@ -44,21 +44,25 @@ This rule monitors for X11 forwarding via SSH. X11 forwarding is a feature that
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Linux SSH X11 Forwarding
+*Triage and analysis*
+
+
+
+*Investigating Potential Linux SSH X11 Forwarding*
+
 
 Attackers can leverage SSH X11 forwarding to capture a user's graphical desktop session and potentially execute unauthorized GUI applications remotely.
 
 This rule looks for the execution of SSH in conjunction with command line arguments that are capable of setting up X11 forwarding. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify any signs of suspicious network activity or anomalies that may indicate network forwarding activity. This could include unexpected traffic patterns or unusual network behavior.
   - Investigate listening ports and open sockets to look for potential protocol tunneling, reverse shells, or data exfiltration.
@@ -80,17 +84,23 @@ This rule looks for the execution of SSH in conjunction with command line argume
           - Check the reputation of the domain or IP address.
         - File access, modification, and creation activities.
 
-### Related rules
+
+*Related rules*
+
 
 - Potential Linux Tunneling and/or Port Forwarding - 6ee947e9-de7e-4281-a55d-09289bdf947e
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator or developer who uses port tunneling/forwarding for benign purposes, consider adding exceptions for specific user accounts or hosts. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -105,7 +115,6 @@ This rule looks for the execution of SSH in conjunction with command line argume
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-tunneling-and-or-port-forwarding.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-tunneling-and-or-port-forwarding.asciidoc
index e892a83217..3ebb5c7a36 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-linux-tunneling-and-or-port-forwarding.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-tunneling-and-or-port-forwarding.asciidoc
@@ -8,6 +8,7 @@ This rule monitors for a set of Linux utilities that can be used for tunneling a
 *Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
 
 *Severity*: medium
 
@@ -31,8 +32,9 @@ This rule monitors for a set of Linux utilities that can be used for tunneling a
 * Use Case: Threat Detection
 * Tactic: Command and Control
 * Data Source: Elastic Defend
+* Data Source: Elastic Endgame
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -44,21 +46,25 @@ This rule monitors for a set of Linux utilities that can be used for tunneling a
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Linux Tunneling and/or Port Forwarding
+*Triage and analysis*
+
+
+
+*Investigating Potential Linux Tunneling and/or Port Forwarding*
+
 
 Attackers can leverage many utilities to clandestinely tunnel network communications and evade security measures, potentially gaining unauthorized access to sensitive systems.
 
 This rule looks for several utilities that are capable of setting up tunnel network communications by analyzing process names or command line arguments. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify any signs of suspicious network activity or anomalies that may indicate protocol tunneling. This could include unexpected traffic patterns or unusual network behavior.
   - Investigate listening ports and open sockets to look for potential protocol tunneling, reverse shells, or data exfiltration.
@@ -80,7 +86,9 @@ This rule looks for several utilities that are capable of setting up tunnel netw
           - Check the reputation of the domain or IP address.
         - File access, modification, and creation activities.
 
-### Related rules
+
+*Related rules*
+
 
 - Potential Protocol Tunneling via Chisel Client - 3f12325a-4cc6-410b-8d4c-9fbbeb744cfd
 - Potential Protocol Tunneling via Chisel Server - ac8805f6-1e08-406c-962e-3937057fa86f
@@ -88,13 +96,17 @@ This rule looks for several utilities that are capable of setting up tunnel netw
 - Suspicious Utility Launched via ProxyChains - 6ace94ba-f02c-4d55-9f53-87d99b6f9af4
 - ProxyChains Activity - 4b868f1f-15ff-4ba3-8c11-d5a7a6356d37
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator or developer who uses port tunneling/forwarding for benign purposes, consider adding exceptions for specific user accounts or hosts. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -109,27 +121,61 @@ This rule looks for several utilities that are capable of setting up tunnel netw
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
 
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and ((
-  // gost & pivotnacci - spawned without process.parent.name
-  (process.name == "gost" and process.args : ("-L*", "-C*", "-R*")) or (process.name == "pivotnacci")) or (
-  // ssh
-  (process.name in ("ssh", "sshd") and (process.args in ("-R", "-L", "D", "-w") and process.args_count >= 4 and 
-  not process.args : "chmod")) or
-  // sshuttle
-  (process.name == "sshuttle" and process.args in ("-r", "--remote", "-l", "--listen") and process.args_count >= 4) or
-  // socat
-  (process.name == "socat" and process.args : ("TCP4-LISTEN:*", "SOCKS*") and process.args_count >= 3) or
-  // chisel
-  (process.name : "chisel*" and process.args in ("client", "server")) or
-  // iodine(d), dnscat, hans, ptunnel-ng, ssf, 3proxy & ngrok 
-  (process.name in ("iodine", "iodined", "dnscat", "hans", "hans-ubuntu", "ptunnel-ng", "ssf", "3proxy", "ngrok"))
+process where host.os.type == "linux" and event.action in ("exec", "exec_event") and
+event.type == "start" and (
+  (
+    // gost & pivotnacci - spawned without process.parent.name
+    (process.name == "gost" and process.args : ("-L*", "-C*", "-R*")) or (process.name == "pivotnacci")) or (
+    // ssh
+    (process.name in ("ssh", "sshd") and (process.args in ("-R", "-L", "D", "-w") and process.args_count >= 4 and 
+     not process.args : "chmod")) or
+    // sshuttle
+    (process.name == "sshuttle" and process.args in ("-r", "--remote", "-l", "--listen") and process.args_count >= 4) or
+    // socat
+    (process.name == "socat" and process.args : ("TCP4-LISTEN:*", "SOCKS*") and process.args_count >= 3) or
+    // chisel
+    (process.name : "chisel*" and process.args in ("client", "server")) or
+    // iodine(d), dnscat, hans, ptunnel-ng, ssf, 3proxy & ngrok 
+    (process.name in ("iodine", "iodined", "dnscat", "hans", "hans-ubuntu", "ptunnel-ng", "ssf", "3proxy", "ngrok"))
   ) and process.parent.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")
 )
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-lsass-clone-creation-via-psscapturesnapshot.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-lsass-clone-creation-via-psscapturesnapshot.asciidoc
index 4e932f7134..8056cd546a 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-lsass-clone-creation-via-psscapturesnapshot.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-lsass-clone-creation-via-psscapturesnapshot.asciidoc
@@ -43,6 +43,19 @@ Identifies the creation of an LSASS process clone via PssCaptureSnapShot where t
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This is meant to run only on datasources using Windows security event 4688 that captures the process clone creation.
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-lsass-memory-dump-via-psscapturesnapshot.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-lsass-memory-dump-via-psscapturesnapshot.asciidoc
index ab6fa5b12a..6ff990b0e3 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-lsass-memory-dump-via-psscapturesnapshot.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-lsass-memory-dump-via-psscapturesnapshot.asciidoc
@@ -42,6 +42,14 @@ Identifies suspicious access to an LSASS handle via PssCaptureSnapShot where two
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This is meant to run only on datasources using Elastic Agent 7.14+ since versions prior to that will be missing the threshold
+rule cardinality feature.
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-macos-ssh-brute-force-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-macos-ssh-brute-force-detected.asciidoc
index b31f90c3c8..3310913e08 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-macos-ssh-brute-force-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-macos-ssh-brute-force-detected.asciidoc
@@ -40,6 +40,41 @@ Identifies a high number (20) of macOS SSH KeyGen process executions from the sa
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-browser-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-browser-process.asciidoc
index 062b3d9bd0..1b6474b059 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-browser-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-browser-process.asciidoc
@@ -31,7 +31,7 @@ Identifies suspicious instances of browser processes, such as unsigned or signed
 * Rule Type: BBR
 * Data Source: Elastic Defend
 
-*Version*: 2
+*Version*: 3
 
 *Rule authors*: 
 
@@ -62,6 +62,12 @@ process where host.os.type == "windows" and event.type == "start" and
           "?:\\Program Files\\HP\\Sure Click\\*\\servers\\chrome.exe"
         ) and
         process.code_signature.subject_name : ("Bromium, Inc.") and process.code_signature.trusted == true
+      ) and not
+      (
+        process.executable : (
+          "?:\\Program Files\\dynatrace\\synthetic\\Chrome-bin\\chrome.exe"
+        ) and
+        process.code_signature.subject_name : ("Dynatrace LLC") and process.code_signature.trusted == true
       ) and
      not (
        process.executable : (
@@ -90,7 +96,7 @@ process where host.os.type == "windows" and event.type == "start" and
      and not
       (
         process.name : "msedgewebview2.exe" and
-        process.code_signature.subject_name : ("Bromium, Inc.") and process.code_signature.trusted == true
+        process.code_signature.subject_name : ("Bromium, Inc.", "Amazon.com Services LLC") and process.code_signature.trusted == true
       )
     ) or
 
@@ -130,7 +136,7 @@ process where host.os.type == "windows" and event.type == "start" and
     (process.name : (
       "opera.exe", "opera_*.exe", "browser_assistant.exe"
      ) and not
-      (process.code_signature.subject_name : "Opera Norway AS" and process.code_signature.trusted == true)
+      (process.code_signature.subject_name : ("Opera Norway AS", "Opera Software AS") and process.code_signature.trusted == true)
     ) or
 
     /* Whale Related Processes */
@@ -153,7 +159,9 @@ process where host.os.type == "windows" and event.type == "start" and
         "Microsoft Corporation",
         "NAVER Corp.",
         "AVG Technologies USA, LLC",
-        "Avast Software s.r.o."
+        "Avast Software s.r.o.",
+        "PIRIFORM SOFTWARE LIMITED",
+        "NortonLifeLock Inc."
        ) and process.code_signature.trusted == true
       )
     )
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-business-app-installer.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-business-app-installer.asciidoc
index 3d87d4d879..a551b5c745 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-business-app-installer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-business-app-installer.asciidoc
@@ -32,9 +32,8 @@ Identifies executables with names resembling legitimate business applications bu
 * Tactic: Defense Evasion
 * Tactic: Initial Access
 * Tactic: Execution
-* Rule Type: BBR
 
-*Version*: 2
+*Version*: 3
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-dll.asciidoc
index f0248aae83..07603dc0e7 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-dll.asciidoc
@@ -31,7 +31,7 @@ Identifies suspicious instances of default system32 DLLs either unsigned or sign
 * Tactic: Persistence
 * Rule Type: BBR
 
-*Version*: 102
+*Version*: 103
 
 *Rule authors*: 
 
@@ -86,7 +86,7 @@ library where event.action == "load" and dll.Ext.relative_file_creation_time <=
       ) or
       (
         dll.name : "libcrypto.dll" and dll.code_signature.subject_name in (
-          "NoMachine S.a.r.l.", "Bitdefender SRL", "Oculus VR, LLC"
+          "NoMachine S.a.r.l.", "Oculus VR, LLC"
         ) and dll.code_signature.trusted == true
       ) or
       (
@@ -94,8 +94,11 @@ library where event.action == "load" and dll.Ext.relative_file_creation_time <=
           "Proofpoint, Inc.", "Rapid7 LLC", "Eclipse.org Foundation, Inc.", "Amazon.com Services LLC", "Windows Phone"
         ) and dll.code_signature.trusted == true
       ) or
+      (
+        dll.name : ("libcrypto.dll", "wmi.dll", "geolocation.dll", "kerberos.dll") and
+        dll.code_signature.subject_name == "Bitdefender SRL" and dll.code_signature.trusted == true
+      ) or
       (dll.name : "ICMP.dll" and dll.code_signature.subject_name == "Paessler AG" and dll.code_signature.trusted == true) or
-      (dll.name : "kerberos.dll" and dll.code_signature.subject_name == "Bitdefender SRL" and dll.code_signature.trusted == true) or
       (dll.name : "dbghelp.dll" and dll.code_signature.trusted == true) or
       (dll.name : "DirectML.dll" and dll.code_signature.subject_name == "Adobe Inc." and dll.code_signature.trusted == true) or
       (
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-executable.asciidoc
index e3d6658c06..726876b2a3 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-executable.asciidoc
@@ -31,7 +31,7 @@ Identifies suspicious instances of default system32 executables, either unsigned
 * Tactic: Persistence
 * Rule Type: BBR
 
-*Version*: 2
+*Version*: 3
 
 *Rule authors*: 
 
@@ -45,7 +45,8 @@ Identifies suspicious instances of default system32 executables, either unsigned
 
 [source, js]
 ----------------------------------
-process where event.type == "start" and process.code_signature.status : "*" and
+process where host.os.type == "windows" and event.type == "start" and 
+  (process.code_signature.status : "?*" or process.code_signature.exists != null) and
   process.name: (
       "agentactivationruntimestarter.exe", "agentservice.exe", "aitstatic.exe", "alg.exe", "apphostregistrationverifier.exe", "appidcertstorecheck.exe", "appidpolicyconverter.exe", "appidtel.exe", "applicationframehost.exe", "applysettingstemplatecatalog.exe", "applytrustoffline.exe", "approvechildrequest.exe", "appvclient.exe", "appvdllsurrogate.exe", "appvnice.exe", "appvshnotify.exe", "arp.exe", "assignedaccessguard.exe", "at.exe", "atbroker.exe", "attrib.exe", "audiodg.exe", "auditpol.exe", "authhost.exe", "autochk.exe", "autoconv.exe", "autofmt.exe", "axinstui.exe", "baaupdate.exe", "backgroundtaskhost.exe", "backgroundtransferhost.exe", "bcdboot.exe", "bcdedit.exe", "bdechangepin.exe", "bdehdcfg.exe", "bdeuisrv.exe", "bdeunlock.exe", "bioiso.exe", "bitlockerdeviceencryption.exe", "bitlockerwizard.exe", "bitlockerwizardelev.exe", "bitsadmin.exe", "bootcfg.exe", "bootim.exe", "bootsect.exe", "bridgeunattend.exe", "browserexport.exe", "browser_broker.exe", "bthudtask.exe", "bytecodegenerator.exe", "cacls.exe", "calc.exe", "camerasettingsuihost.exe", "castsrv.exe", "certenrollctrl.exe", "certreq.exe", "certutil.exe", "change.exe", "changepk.exe", "charmap.exe", "checknetisolation.exe", "chglogon.exe", "chgport.exe", "chgusr.exe", "chkdsk.exe", "chkntfs.exe", "choice.exe", "cidiag.exe", "cipher.exe", "cleanmgr.exe", "cliconfg.exe", "clip.exe", "clipup.exe", "cloudexperiencehostbroker.exe", "cloudnotifications.exe", "cmd.exe", "cmdkey.exe", "cmdl32.exe", "cmmon32.exe", "cmstp.exe", "cofire.exe", "colorcpl.exe", "comp.exe", "compact.exe", "compattelrunner.exe", "compmgmtlauncher.exe", "comppkgsrv.exe", "computerdefaults.exe", "conhost.exe", "consent.exe", "control.exe", "convert.exe", "convertvhd.exe", "coredpussvr.exe", "credentialenrollmentmanager.exe", "credentialuibroker.exe", "credwiz.exe", "cscript.exe", "csrss.exe", "ctfmon.exe", "cttune.exe", "cttunesvr.exe", "custominstallexec.exe", "customshellhost.exe", "dashost.exe", "dataexchangehost.exe", "datastorecachedumptool.exe", "dccw.exe", "dcomcnfg.exe", "ddodiag.exe", "defrag.exe", "deploymentcsphelper.exe", "desktopimgdownldr.exe", "devicecensus.exe", "devicecredentialdeployment.exe", "deviceeject.exe", "deviceenroller.exe", "devicepairingwizard.exe", "deviceproperties.exe", "dfdwiz.exe", "dfrgui.exe", "dialer.exe", "directxdatabaseupdater.exe", "diskpart.exe", "diskperf.exe", "diskraid.exe", "disksnapshot.exe", "dism.exe", "dispdiag.exe", "displayswitch.exe", "djoin.exe", "dllhost.exe", "dllhst3g.exe", "dmcertinst.exe", "dmcfghost.exe", "dmclient.exe", "dmnotificationbroker.exe", "dmomacpmo.exe", "dnscacheugc.exe", "doskey.exe", "dpapimig.exe", "dpiscaling.exe", "dpnsvr.exe", "driverquery.exe", "drvinst.exe", "dsmusertask.exe", "dsregcmd.exe", "dstokenclean.exe", "dusmtask.exe", "dvdplay.exe", "dwm.exe", "dwwin.exe", "dxdiag.exe", "dxgiadaptercache.exe", "dxpserver.exe", "eap3host.exe", "easeofaccessdialog.exe", "easinvoker.exe", "easpolicymanagerbrokerhost.exe", "edpcleanup.exe", "edpnotify.exe", "eduprintprov.exe", "efsui.exe", "ehstorauthn.exe", "eoaexperiences.exe", "esentutl.exe", "eudcedit.exe", "eventcreate.exe", "eventvwr.exe", "expand.exe", "extrac32.exe", "fc.exe", "fclip.exe", "fhmanagew.exe", "filehistory.exe", "find.exe", "findstr.exe", "finger.exe", "fixmapi.exe", "fltmc.exe", "fodhelper.exe", "fondue.exe", "fontdrvhost.exe", "fontview.exe", "forfiles.exe", "fsavailux.exe", "fsiso.exe", "fsquirt.exe", "fsutil.exe", "ftp.exe", "fvenotify.exe", "fveprompt.exe", "gamebarpresencewriter.exe", "gamepanel.exe", "genvalobj.exe", "getmac.exe", "gpresult.exe", "gpscript.exe", "gpupdate.exe", "grpconv.exe", "hdwwiz.exe", "help.exe", "hostname.exe", "hvax64.exe", "hvix64.exe", "hvsievaluator.exe", "icacls.exe", "icsentitlementhost.exe", "icsunattend.exe", "ie4uinit.exe", "ie4ushowie.exe", "iesettingsync.exe", "ieunatt.exe", "iexpress.exe", "immersivetpmvscmgrsvr.exe", "infdefaultinstall.exe", "inputswitchtoasthandler.exe", "iotstartup.exe", "ipconfig.exe", "iscsicli.exe", "iscsicpl.exe", "isoburn.exe", "klist.exe", "ksetup.exe", "ktmutil.exe", "label.exe", "languagecomponentsinstallercomhandler.exe", "launchtm.exe", "launchwinapp.exe", "legacynetuxhost.exe", "licensemanagershellext.exe", "licensingdiag.exe", "licensingui.exe", "locationnotificationwindows.exe", "locator.exe", "lockapphost.exe", "lockscreencontentserver.exe", "lodctr.exe", "logagent.exe", "logman.exe", "logoff.exe", "logonui.exe", "lpkinstall.exe", "lpksetup.exe", "lpremove.exe", "lsaiso.exe", "lsass.exe", "magnify.exe", "makecab.exe", "manage-bde.exe", "mavinject.exe", "mbaeparsertask.exe", "mblctr.exe", "mbr2gpt.exe", "mcbuilder.exe", "mdeserver.exe", "mdmagent.exe", "mdmappinstaller.exe", "mdmdiagnosticstool.exe", "mdres.exe", "mdsched.exe", "mfpmp.exe", "microsoft.uev.cscunpintool.exe", "microsoft.uev.synccontroller.exe", "microsoftedgebchost.exe", "microsoftedgecp.exe", "microsoftedgedevtools.exe", "microsoftedgesh.exe", "mmc.exe", "mmgaserver.exe", "mobsync.exe", "mountvol.exe", "mousocoreworker.exe", "mpnotify.exe", "mpsigstub.exe", "mrinfo.exe", "mschedexe.exe", "msconfig.exe", "msdt.exe", "msdtc.exe", "msfeedssync.exe", "msg.exe", "mshta.exe", "msiexec.exe", "msinfo32.exe", "mspaint.exe", "msra.exe", "msspellcheckinghost.exe", "mstsc.exe", "mtstocom.exe", "muiunattend.exe", "multidigimon.exe", "musnotification.exe", "musnotificationux.exe", "musnotifyicon.exe", "narrator.exe", "nbtstat.exe", "ndadmin.exe", "ndkping.exe", "net.exe", "net1.exe", "netbtugc.exe", "netcfg.exe", "netcfgnotifyobjecthost.exe", "netevtfwdr.exe", "nethost.exe", "netiougc.exe", "netplwiz.exe", "netsh.exe", "netstat.exe", "newdev.exe", "ngciso.exe", "nltest.exe", "notepad.exe", "nslookup.exe", "ntoskrnl.exe", "ntprint.exe", "odbcad32.exe", "odbcconf.exe", "ofdeploy.exe", "omadmclient.exe", "omadmprc.exe", "openfiles.exe", "openwith.exe", "optionalfeatures.exe", "osk.exe", "pacjsworker.exe", "packagedcwalauncher.exe", "packageinspector.exe", "passwordonwakesettingflyout.exe", "pathping.exe", "pcalua.exe", "pcaui.exe", "pcwrun.exe", "perfmon.exe", "phoneactivate.exe", "pickerhost.exe", "pinenrollmentbroker.exe", "ping.exe", "pkgmgr.exe", "pktmon.exe", "plasrv.exe", "pnpunattend.exe", "pnputil.exe", "poqexec.exe", "pospaymentsworker.exe", "powercfg.exe", "presentationhost.exe", "presentationsettings.exe", "prevhost.exe", "printbrmui.exe", "printfilterpipelinesvc.exe", "printisolationhost.exe", "printui.exe", "proquota.exe", "provlaunch.exe", "provtool.exe", "proximityuxhost.exe", "prproc.exe", "psr.exe", "pwlauncher.exe", "qappsrv.exe", "qprocess.exe", "query.exe", "quser.exe", "qwinsta.exe", "rasautou.exe", "rasdial.exe", "raserver.exe", "rasphone.exe", "rdpclip.exe", "rdpinit.exe", "rdpinput.exe", "rdpsa.exe", "rdpsaproxy.exe", "rdpsauachelper.exe", "rdpshell.exe", "rdpsign.exe", "rdrleakdiag.exe", "reagentc.exe", "recdisc.exe", "recover.exe", "recoverydrive.exe", "refsutil.exe", "reg.exe", "regedt32.exe", "regini.exe", "register-cimprovider.exe", "regsvr32.exe", "rekeywiz.exe", "relog.exe", "relpost.exe", "remoteapplifetimemanager.exe", "remoteposworker.exe", "repair-bde.exe", "replace.exe", "reset.exe", "resetengine.exe", "resmon.exe", "rmactivate.exe", "rmactivate_isv.exe", "rmactivate_ssp.exe", "rmactivate_ssp_isv.exe", "rmclient.exe", "rmttpmvscmgrsvr.exe", "robocopy.exe", "route.exe", "rpcping.exe", "rrinstaller.exe", "rstrui.exe", "runas.exe", "rundll32.exe", "runexehelper.exe", "runlegacycplelevated.exe", "runonce.exe", "runtimebroker.exe", "rwinsta.exe", "sc.exe", "schtasks.exe", "scriptrunner.exe", "sdbinst.exe", "sdchange.exe", "sdclt.exe", "sdiagnhost.exe", "searchfilterhost.exe", "searchindexer.exe", "searchprotocolhost.exe", "secedit.exe", "secinit.exe", "securekernel.exe", "securityhealthhost.exe", "securityhealthservice.exe", "securityhealthsystray.exe", "sensordataservice.exe", "services.exe", "sessionmsg.exe", "sethc.exe", "setspn.exe", "settingsynchost.exe", "setupcl.exe", "setupugc.exe", "setx.exe", "sfc.exe", "sgrmbroker.exe", "sgrmlpac.exe", "shellappruntime.exe", "shrpubw.exe", "shutdown.exe", "sigverif.exe", "sihclient.exe", "sihost.exe", "slidetoshutdown.exe", "slui.exe", "smartscreen.exe", "smss.exe", "sndvol.exe", "snippingtool.exe", "snmptrap.exe", "sort.exe", "spaceagent.exe", "spaceman.exe", "spatialaudiolicensesrv.exe", "spectrum.exe", "spoolsv.exe", "sppextcomobj.exe", "sppsvc.exe", "srdelayed.exe", "srtasks.exe", "stordiag.exe", "subst.exe", "svchost.exe", "sxstrace.exe", "syncappvpublishingserver.exe", "synchost.exe", "sysreseterr.exe", "systeminfo.exe", "systempropertiesadvanced.exe", "systempropertiescomputername.exe", "systempropertiesdataexecutionprevention.exe", "systempropertieshardware.exe", "systempropertiesperformance.exe", "systempropertiesprotection.exe", "systempropertiesremote.exe", "systemreset.exe", "systemsettingsadminflows.exe", "systemsettingsbroker.exe", "systemsettingsremovedevice.exe", "systemuwplauncher.exe", "systray.exe", "tabcal.exe", "takeown.exe", "tapiunattend.exe", "tar.exe", "taskhostw.exe", "taskkill.exe", "tasklist.exe", "taskmgr.exe", "tcblaunch.exe", "tcmsetup.exe", "tcpsvcs.exe", "thumbnailextractionhost.exe", "tieringengineservice.exe", "timeout.exe", "tokenbrokercookies.exe", "tpminit.exe", "tpmtool.exe", "tpmvscmgr.exe", "tpmvscmgrsvr.exe", "tracerpt.exe", "tracert.exe", "tscon.exe", "tsdiscon.exe", "tskill.exe", "tstheme.exe", "tswbprxy.exe", "ttdinject.exe", "tttracer.exe", "typeperf.exe", "tzsync.exe", "tzutil.exe", "ucsvc.exe", "uevagentpolicygenerator.exe", "uevappmonitor.exe", "uevtemplatebaselinegenerator.exe", "uevtemplateconfigitemgenerator.exe", "uimgrbroker.exe", "unlodctr.exe", "unregmp2.exe", "upfc.exe", "upgraderesultsui.exe", "upnpcont.exe", "upprinterinstaller.exe", "useraccountbroker.exe", "useraccountcontrolsettings.exe", "userinit.exe", "usoclient.exe", "utcdecoderhost.exe", "utilman.exe", "vaultcmd.exe", "vds.exe", "vdsldr.exe", "verclsid.exe", "verifier.exe", "verifiergui.exe", "vssadmin.exe", "vssvc.exe", "w32tm.exe", "waasmedicagent.exe", "waitfor.exe", "wallpaperhost.exe", "wbadmin.exe", "wbengine.exe", "wecutil.exe", "werfault.exe", "werfaultsecure.exe", "wermgr.exe", "wevtutil.exe", "wextract.exe", "where.exe", "whoami.exe", "wiaacmgr.exe", "wiawow64.exe", "wifitask.exe", "wimserv.exe", "winbiodatamodeloobe.exe", "windows.media.backgroundplayback.exe", "windows.warp.jitservice.exe", "windowsactiondialog.exe", "windowsupdateelevatedinstaller.exe", "wininit.exe", "winload.exe", "winlogon.exe", "winresume.exe", "winrs.exe", "winrshost.exe", "winrtnetmuahostserver.exe", "winsat.exe", "winver.exe", "wkspbroker.exe", "wksprt.exe", "wlanext.exe", "wlrmdr.exe", "wmpdmc.exe", "workfolders.exe", "wowreg32.exe", "wpcmon.exe", "wpctok.exe", "wpdshextautoplay.exe", "wpnpinst.exe", "wpr.exe", "write.exe", "wscadminui.exe", "wscollect.exe", "wscript.exe", "wsl.exe", "wsmanhttpconfig.exe", "wsmprovhost.exe", "wsqmcons.exe", "wsreset.exe", "wuapihost.exe", "wuauclt.exe", "wudfcompanionhost.exe", "wudfhost.exe", "wusa.exe", "wwahost.exe", "xblgamesavetask.exe", "xcopy.exe", "xwizard.exe", "aggregatorhost.exe", "diskusage.exe", "dtdump.exe", "ism.exe", "ndkperfcmd.exe", "ntkrla57.exe", "securekernella57.exe", "spaceutil.exe", "configure-smremoting.exe", "dcgpofix.exe", "dcpromo.exe", "dimc.exe", "diskshadow.exe", "drvcfg.exe", "escunattend.exe", "iashost.exe", "ktpass.exe", "lbfoadmin.exe", "netdom.exe", "rdspnf.exe", "rsopprov.exe", "sacsess.exe", "servermanager.exe", "servermanagerlauncher.exe", "setres.exe", "tsecimp.exe", "vssuirun.exe", "webcache.exe", "win32calc.exe", "certoc.exe", "sdndiagnosticstask.exe", "xpsrchvw.exe"
     ) and
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-meterpreter-reverse-shell.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-meterpreter-reverse-shell.asciidoc
index a333f2fb70..58b7348b8b 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-meterpreter-reverse-shell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-meterpreter-reverse-shell.asciidoc
@@ -24,12 +24,13 @@ This detection rule identifies a sample of suspicious Linux system file reads us
 
 *Tags*: 
 
+* Data Source: Auditd Manager
 * Domain: Endpoint
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Execution
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -38,22 +39,69 @@ This detection rule identifies a sample of suspicious Linux system file reads us
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Auditbeat
+- Auditd Manager
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule the following additional audit rules are required to be added to the integration:
+  -w /proc/net/ -p r -k audit_proc
+  -w /etc/machine-id -p wa -k machineid
+  -w /etc/passwd -p wa -k passwd
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
 sample by host.id, process.pid, user.id
-[file where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and auditd.data.syscall == "open" and 
-  auditd.data.a2 == "1b6" and file.path == "/etc/machine-id"]
-[file where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and auditd.data.syscall == "open" and
-  auditd.data.a2 == "1b6" and file.path == "/etc/passwd"]
-[file where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and auditd.data.syscall == "open" and 
-  auditd.data.a2 == "1b6" and file.path == "/proc/net/route"]
-[file where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and auditd.data.syscall == "open" and
-  auditd.data.a2 == "1b6" and file.path == "/proc/net/ipv6_route"]
-[file where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and auditd.data.syscall == "open" and
-  auditd.data.a2 == "1b6" and file.path == "/proc/net/if_inet6"]
+  [file where host.os.type == "linux" and auditd.data.syscall == "open" and auditd.data.a2 == "1b6" and file.path == "/etc/machine-id"]
+  [file where host.os.type == "linux" and auditd.data.syscall == "open" and auditd.data.a2 == "1b6" and file.path == "/etc/passwd"]
+  [file where host.os.type == "linux" and auditd.data.syscall == "open" and auditd.data.a2 == "1b6" and file.path == "/proc/net/route"]
+  [file where host.os.type == "linux" and auditd.data.syscall == "open" and auditd.data.a2 == "1b6" and file.path == "/proc/net/ipv6_route"]
+  [file where host.os.type == "linux" and auditd.data.syscall == "open" and auditd.data.a2 == "1b6" and file.path == "/proc/net/if_inet6"]
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-microsoft-office-sandbox-evasion.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-microsoft-office-sandbox-evasion.asciidoc
index 5068efa8ab..85bdee4853 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-microsoft-office-sandbox-evasion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-microsoft-office-sandbox-evasion.asciidoc
@@ -42,6 +42,41 @@ Identifies the creation of a suspicious zip file prepended with special characte
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
index 3549cf5af8..38147d2745 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
@@ -48,22 +48,26 @@ Windows contains accessibility features that may be launched with a key combinat
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Modification of Accessibility Binaries
+*Triage and analysis*
+
+
+
+*Investigating Potential Modification of Accessibility Binaries*
+
 
 Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
 
-More details can be found [here](https://attack.mitre.org/techniques/T1546/008/).
+More details can be found https://attack.mitre.org/techniques/T1546/008/[here].
 
 This rule looks for the execution of supposed accessibility binaries that don't match any of the accessibility features binaries' original file names, which is likely a custom binary deployed by the attacker.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -85,11 +89,15 @@ This rule looks for the execution of supposed accessibility binaries that don't
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -106,7 +114,17 @@ This rule looks for the execution of supposed accessibility binaries that don't
 
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-network-scan-executed-from-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-network-scan-executed-from-host.asciidoc
index 4df747b5cc..02cc54248b 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-network-scan-executed-from-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-network-scan-executed-from-host.asciidoc
@@ -38,6 +38,42 @@ This threshold rule monitors for the rapid execution of unix utilities that are
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-non-standard-port-http-https-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-non-standard-port-http-https-connection.asciidoc
index f0a42b1a73..56166f2205 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-non-standard-port-http-https-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-non-standard-port-http-https-connection.asciidoc
@@ -43,21 +43,25 @@ Identifies potentially malicious processes communicating via a port paring typic
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Non-Standard Port HTTP/HTTPS connection
+*Triage and analysis*
+
+
+
+*Investigating Potential Non-Standard Port HTTP/HTTPS connection*
+
 
 Attackers may alter standard protocol ports, like using HTTP on port 8443 instead of 80, to bypass network filtering and complicate network data analysis. 
 
 This rule looks for HTTP/HTTPS processes where the destination port is not any of the default 80/443 HTTP/HTTPS ports. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify any signs of suspicious network activity or anomalies that may indicate command and control activity or data exfiltration. This could include unexpected traffic patterns or unusual network behavior.
   - Investigate listening ports and open sockets to look for potential suspicious network traffic, reverse shells or data exfiltration.
@@ -79,16 +83,22 @@ This rule looks for HTTP/HTTPS processes where the destination port is not any o
           - Check the reputation of the domain or IP address.
         - File access, modification, and creation activities.
 
-### Related rules
+
+*Related rules*
+
 
 - Suspicious Network Activity to the Internet by Previously Unknown Executable - 53617418-17b4-4e9c-8a2c-8deb8086ca4b
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -103,7 +113,6 @@ This rule looks for HTTP/HTTPS processes where the destination port is not any o
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-okta-mfa-bombing-via-push-notifications.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-okta-mfa-bombing-via-push-notifications.asciidoc
index 173ad39e49..5cf111126e 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-okta-mfa-bombing-via-push-notifications.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-okta-mfa-bombing-via-push-notifications.asciidoc
@@ -45,17 +45,21 @@ Detects when an attacker abuses the Multi-Factor authentication mechanism by rep
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Okta MFA Bombing via Push Notifications
+*Triage and analysis*
+
+
+
+*Investigating Potential Okta MFA Bombing via Push Notifications*
+
 
 Multi-Factor Authentication (MFA) is an effective method to prevent unauthorized access. However, some adversaries may abuse the system by repeatedly sending MFA push notifications until the user unwittingly approves the access.
 
 This rule detects when a user denies MFA Okta Verify push notifications twice, followed by a successful authentication event within a 10-minute window. This sequence could indicate an adversary's attempt to bypass the Okta MFA policy.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 
 - Identify the user who received the MFA notifications by reviewing the `user.email` field.
 - Identify the time, source IP, and geographical location of the MFA requests and the subsequent successful login.
@@ -65,12 +69,16 @@ This rule detects when a user denies MFA Okta Verify push notifications twice, f
 - Look for any other suspicious activity on the account around the same time.
 - Identify whether the same pattern is repeated for other users in your organization. Multiple users receiving push notifications simultaneously might indicate a larger attack.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 
 - Determine if the MFA push notifications were legitimate. Sometimes, users accidentally trigger MFA requests or deny them unintentionally and later approve them.
 - Check if there are known issues with the MFA system causing false denials.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 
 - If unauthorized access is confirmed, initiate your incident response process.
 - Alert the user and your IT department immediately.
@@ -81,7 +89,12 @@ This rule detects when a user denies MFA Okta Verify push notifications twice, f
 - Encourage users to report any unexpected MFA notifications immediately.
 - Review and update your incident response plans and security policies based on the findings from the incident.
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc
index 1816e9d8d5..86c8d2702d 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc
@@ -45,6 +45,62 @@ Identifies a Secure Shell (SSH) client or server process creating or writing to
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Custom Ingest Pipeline*
+
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html[guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-outgoing-rdp-connection-by-unusual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-outgoing-rdp-connection-by-unusual-process.asciidoc
index c8ed0c6818..b81631f210 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-outgoing-rdp-connection-by-unusual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-outgoing-rdp-connection-by-unusual-process.asciidoc
@@ -29,7 +29,7 @@ Adversaries may attempt to connect to a remote system over Windows Remote Deskto
 * Tactic: Lateral Movement
 * Data Source: Elastic Defend
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -45,8 +45,16 @@ Adversaries may attempt to connect to a remote system over Windows Remote Deskto
 ----------------------------------
 network where host.os.type == "windows" and
   event.action == "connection_attempted" and destination.port == 3389 and
-  not process.executable : "?:\\Windows\\System32\\mstsc.exe" and
-  destination.ip != "::1" and destination.ip != "127.0.0.1"
+  destination.ip != "::1" and destination.ip != "127.0.0.1" and
+  not (
+    process.executable : (
+      "?:\\Windows\\System32\\mstsc.exe",
+      "?:\\Program Files (x86)\\mRemoteNG\\mRemoteNG.exe",
+      "?:\\Program Files (x86)\\PRTG Network Monitor\\PRTG Probe.exe",
+      "?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
+      "?:\\Program Files (x86)\\Microsoft\\Remote Desktop Connection Manager\\RDCMan.exe"
+    ) and process.code_signature.trusted == true
+  )
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-password-spraying-of-microsoft-365-user-accounts.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-password-spraying-of-microsoft-365-user-accounts.asciidoc
index ff100cd27e..5a12d8bdd1 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-password-spraying-of-microsoft-365-user-accounts.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-password-spraying-of-microsoft-365-user-accounts.asciidoc
@@ -41,10 +41,12 @@ Identifies a high number (25) of failed Microsoft 365 user authentication attemp
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
index af74a933bf..ce946fda85 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
@@ -48,11 +48,13 @@ Files that are placed in the /etc/init.d/ directory in Unix can be used to start
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Persistence Through init.d Detected
+*Triage and analysis*
+
+
+
+*Investigating Potential Persistence Through init.d Detected*
+
 
 The `/etc/init.d` directory is used in Linux systems to store the initialization scripts for various services and daemons that are executed during system startup and shutdown.
 
@@ -61,9 +63,11 @@ Attackers can abuse files within the `/etc/init.d/` directory to run scripts, co
 This rule looks for the creation of new files within the `/etc/init.d/` directory. Executable files in these directories will automatically run at boot with root privileges.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
-#### Possible Investigation Steps
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+*Possible Investigation Steps*
+
 
 - Investigate the file that was created or modified.
   - !{osquery{"label":"Osquery - Retrieve File Information","query":"SELECT * FROM file WHERE path = {{file.path}}"}}
@@ -86,17 +90,23 @@ This rule looks for the creation of new files within the `/etc/init.d/` director
         - Cron jobs, services and other persistence mechanisms.
             - !{osquery{"label":"Osquery - Retrieve Crontab Information","query":"SELECT * FROM crontab"}}
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator who uses init.d for administrative purposes, consider adding exceptions for this specific administrator user account. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Suspicious File Creation in /etc for Persistence - 1c84dd64-7e6c-4bad-ac73-a5014ee37042
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -113,7 +123,41 @@ This rule looks for the creation of new files within the `/etc/init.d/` director
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
index 284a961e3c..4642633ce7 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
@@ -46,11 +46,13 @@ Message of the day (MOTD) is the message that is presented to the user when a us
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Persistence Through MOTD File Creation Detected
+*Triage and analysis*
+
+
+
+*Investigating Potential Persistence Through MOTD File Creation Detected*
+
 
 The message-of-the-day (MOTD) is used to display a customizable system-wide message or information to users upon login in Linux.
 
@@ -59,10 +61,12 @@ Attackers can abuse message-of-the-day (motd) files to run scripts, commands or
 This rule identifies the creation of new files within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible Investigation Steps*
 
-#### Possible Investigation Steps
 
 - Investigate the file that was created or modified.
   - !{osquery{"label":"Osquery - Retrieve File Information","query":"SELECT * FROM file WHERE path = {{file.path}}"}}
@@ -83,15 +87,21 @@ This rule identifies the creation of new files within the `/etc/update-motd.d/`
         - Cron jobs, services and other persistence mechanisms.
             - !{osquery{"label":"Osquery - Retrieve Crontab Information","query":"SELECT * FROM crontab"}}
 
-### Related Rules
+
+*Related Rules*
+
 
 - Suspicious Process Spawned from MOTD Detected - 4ec47004-b34a-42e6-8003-376a123ea447
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -107,7 +117,41 @@ This rule identifies the creation of new files within the `/etc/update-motd.d/`
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
index e105b5d456..dd30dcc581 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
@@ -48,11 +48,13 @@ This rule monitors the creation/alteration of the rc.local file by a previously
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Persistence Through Run Control Detected
+*Triage and analysis*
+
+
+
+*Investigating Potential Persistence Through Run Control Detected*
+
 
 The `rc.local` file executes custom commands or scripts during system startup on Linux systems. `rc.local` has been deprecated in favor of the use of `systemd services`, and more recent Unix distributions no longer leverage this method of on-boot script execution.
 
@@ -61,10 +63,12 @@ There might still be users that use `rc.local` in a benign matter, so investigat
 Detection alerts from this rule indicate the creation of a new `/etc/rc.local` file.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible Investigation Steps*
 
-#### Possible Investigation Steps
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate the file that was created or modified.
@@ -89,13 +93,17 @@ Detection alerts from this rule indicate the creation of a new `/etc/rc.local` f
         - Cron jobs, services and other persistence mechanisms.
             - !{osquery{"label":"Osquery - Retrieve Crontab Information","query":"SELECT * FROM crontab"}}
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator who uses `rc.local` for administrative purposes, consider adding exceptions for this specific administrator user account.
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and remediation
+
+*Response and remediation*
+
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
 - If the triage identified malware, search the environment for additional compromised hosts.
@@ -110,7 +118,41 @@ Detection alerts from this rule indicate the creation of a new `/etc/rc.local` f
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-systemd-udevd.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-systemd-udevd.asciidoc
index 703daf57b9..856c37d7f6 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-systemd-udevd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-systemd-udevd.asciidoc
@@ -41,6 +41,44 @@ Monitors for the creation of rule files that are used by systemd-udevd to manage
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Elastic Defend and select the integration to see more details about it.
+- Click Add Elastic Defend.
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click Save and Continue.
+- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-atom-init-script-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-atom-init-script-modification.asciidoc
index 5871b85635..66206d0469 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-atom-init-script-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-atom-init-script-modification.asciidoc
@@ -41,6 +41,41 @@ Identifies modifications to the Atom desktop text editor Init File. Adversaries
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-login-hook.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-login-hook.asciidoc
index 163e0c1626..f13c94af18 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-login-hook.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-login-hook.asciidoc
@@ -43,12 +43,46 @@ Identifies the creation or modification of the login window property list (plist
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
+
+*Triage and analysis*
+
 
 Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user reboots their machine. This can be abused to establish or maintain persistence on a compromised system.
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-periodic-tasks.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-periodic-tasks.asciidoc
index 7bdcbfdb32..7cf80fb387 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-periodic-tasks.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-periodic-tasks.asciidoc
@@ -42,6 +42,41 @@ Identifies the creation or modification of the default configuration for periodi
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-time-provider-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-time-provider-modification.asciidoc
index 747a15982b..b7948e2532 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-time-provider-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-time-provider-modification.asciidoc
@@ -46,20 +46,24 @@ Identifies modification of the Time Provider. Adversaries may establish persiste
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Persistence via Time Provider Modification
+*Triage and analysis*
+
+
+
+*Investigating Potential Persistence via Time Provider Modification*
+
 
 The Time Provider architecture in Windows is responsible for obtaining accurate timestamps from network devices or clients. It is implemented as a DLL file in the System32 folder and is initiated by the W32Time service during Windows startup. Adversaries may exploit this by registering and enabling a malicious DLL as a time provider to establish persistence. 
 
 This rule identifies changes in the registry paths associated with Time Providers, specifically targeting the addition of new DLL files.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -78,11 +82,15 @@ This rule identifies changes in the registry paths associated with Time Provider
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -98,7 +106,6 @@ This rule identifies changes in the registry paths associated with Time Provider
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc
index 7044a0de23..360b34ac60 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc
@@ -45,20 +45,24 @@ Detects known PowerShell offensive tooling functions names in PowerShell scripts
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential PowerShell HackTool Script by Function Names
+*Triage and analysis*
+
+
+
+*Investigating Potential PowerShell HackTool Script by Function Names*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
 Adversaries often exploit PowerShell's capabilities to execute malicious scripts and perform various attacks. This rule identifies known offensive tooling function names in PowerShell scripts, as attackers commonly use out-of-the-box tools without modifying the code. By monitoring these specific function names, the rule aims to detect and alert potential malicious PowerShell activity.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -82,19 +86,25 @@ Adversaries often exploit PowerShell's capabilities to execute malicious scripts
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This rule may generate false positives if legitimate scripts or tools used by administrators contain any of the listed function names. These function names are commonly associated with offensive tooling, but they may also be present in benign scripts or tools.
 - To handle these false positives consider adding exceptions - preferably with a combination of full file path and users.
 
-### Related Rules
+
+*Related Rules*
+
 
 - PowerShell Invoke-NinjaCopy script - b8386923-b02c-4b94-986a-d223d9b01f88
 - PowerShell Suspicious Discovery Related Windows API Functions - 61ac3638-40a3-44b2-855a-985636ca985e
 - Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
 - PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
   - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
@@ -112,7 +122,27 @@ Adversaries often exploit PowerShell's capabilities to execute malicious scripts
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc
index 51d459877f..adcd576296 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc
@@ -41,6 +41,41 @@ Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusin
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc
index b61b029626..1ee6cba03a 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc
@@ -42,6 +42,41 @@ Identifies the use of sqlite3 to directly modify the Transparency, Consent, and
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-through-writable-docker-socket.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-through-writable-docker-socket.asciidoc
index fa53b875dd..e9d789ac13 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-through-writable-docker-socket.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-through-writable-docker-socket.asciidoc
@@ -41,6 +41,41 @@ This rule monitors for the usage of Docker runtime sockets to escalate privilege
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-container-misconfiguration.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-container-misconfiguration.asciidoc
index f4a3967fda..d02b0b3b28 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-container-misconfiguration.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-container-misconfiguration.asciidoc
@@ -42,6 +42,52 @@ This rule monitors for the execution of processes that interact with Linux conta
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+Session View uses process data collected by the Elastic Defend integration, but this data is not always collected by default. Session View is available on enterprise subscription for versions 8.3 and above.
+
+*To confirm that Session View data is enabled:*
+
+- Go to “Manage → Policies”, and edit one or more of your Elastic Defend integration policies.
+- Select the” Policy settings” tab, then scroll down to the “Linux event collection” section near the bottom.
+- Check the box for “Process events”, and turn on the “Include session data” toggle.
+- If you want to include file and network alerts in Session View, check the boxes for “Network and File events”.
+- If you want to enable terminal output capture, turn on the “Capture terminal output” toggle.
+For more information about the additional fields collected when this setting is enabled and the usage of Session View for Analysis refer to the https://www.elastic.co/guide/en/security/current/session-view.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-cve-2023-4911.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-cve-2023-4911.asciidoc
index 4ab33d4073..d8feebba63 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-cve-2023-4911.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-cve-2023-4911.asciidoc
@@ -41,6 +41,54 @@ This rule detects potential privilege escalation attempts through Looney Tunable
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+Elastic Defend integration does not collect environment variable logging by default.
+In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
+ #### To set up environment variable capture for an Elastic Agent policy:
+- Go to “Security → Manage → Policies”.
+- Select an “Elastic Agent policy”.
+- Click “Show advanced settings”.
+- Scroll down or search for “linux.advanced.capture_env_vars”.
+- Enter the names of environment variables you want to capture, separated by commas.
+- For this rule the linux.advanced.capture_env_vars variable should be set to "GLIBC_TUNABLES".
+- Click “Save”.
+After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.
+For more information on capturing environment variables refer to the https://www.elastic.co/guide/en/security/current/environment-variable-capture.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-enlightenment.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-enlightenment.asciidoc
index 4a6c0b2aa0..622e825e3d 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-enlightenment.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-enlightenment.asciidoc
@@ -42,6 +42,41 @@ Identifies an attempt to exploit a local privilege escalation CVE-2022-37706 via
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
index 8c8e5170c6..1c7eb350fe 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
@@ -45,20 +45,24 @@ Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) defaul
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Privilege Escalation via InstallerFileTakeOver
+*Triage and analysis*
+
+
+
+*Investigating Potential Privilege Escalation via InstallerFileTakeOver*
+
 
 InstallerFileTakeOver is a weaponized escalation of privilege proof of concept (EoP PoC) to the CVE-2021-41379 vulnerability. Upon successful exploitation, an unprivileged user will escalate privileges to SYSTEM/NT AUTHORITY.
 
 This rule detects the default execution of the PoC, which overwrites the `elevation_service.exe` DACL and copies itself to the location to escalate privileges. An attacker is able to still take over any file that is not in use (locked), which is outside the scope of this rule.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -79,15 +83,21 @@ This rule detects the default execution of the PoC, which overwrites the `elevat
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Verify whether a digital signature exists in the executable, and if it is valid.
 
-### Related rules
+
+*Related rules*
+
 
 - Suspicious DLL Loaded for Persistence or Privilege Escalation - bfeaf89b-a2a7-48a3-817f-e41829dc61ee
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -103,7 +113,17 @@ This rule detects the default execution of the PoC, which overwrites the `elevat
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-linux-dac-permissions.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-linux-dac-permissions.asciidoc
index 69f4d7a0c6..3b3456503c 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-linux-dac-permissions.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-linux-dac-permissions.asciidoc
@@ -38,6 +38,41 @@ Identifies potential privilege escalation exploitation of DAC (Discretionary acc
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-overlayfs.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-overlayfs.asciidoc
index 98d510db21..1f8b271806 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-overlayfs.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-overlayfs.asciidoc
@@ -42,6 +42,41 @@ Identifies an attempt to exploit a local privilege escalation (CVE-2023-2640 and
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-pkexec.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-pkexec.asciidoc
index 9badfeb5cc..1116ece582 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-pkexec.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-pkexec.asciidoc
@@ -44,6 +44,41 @@ Identifies an attempt to exploit a local privilege escalation in polkit pkexec (
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-python-cap-setuid.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-python-cap-setuid.asciidoc
index 5229bba0a1..8f955590d9 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-python-cap-setuid.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-python-cap-setuid.asciidoc
@@ -38,6 +38,42 @@ This detection rule monitors for the execution of a system command with setuid o
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-recently-compiled-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-recently-compiled-executable.asciidoc
index 63e4124b3b..7e5b8049bd 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-recently-compiled-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-recently-compiled-executable.asciidoc
@@ -39,6 +39,41 @@ This rule monitors a sequence involving a program compilation event followed by
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-uid-int-max-bug-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-uid-int-max-bug-detected.asciidoc
index 6495da0a38..1fbf2488f1 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-uid-int-max-bug-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-uid-int-max-bug-detected.asciidoc
@@ -42,6 +42,41 @@ This rule monitors for the execution of the systemd-run command by a user with a
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privileged-escalation-via-samaccountname-spoofing.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privileged-escalation-via-samaccountname-spoofing.asciidoc
index 4db7888428..d711e7b4f3 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privileged-escalation-via-samaccountname-spoofing.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privileged-escalation-via-samaccountname-spoofing.asciidoc
@@ -49,6 +49,16 @@ Identifies a suspicious computer account name rename event, which may indicate a
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-process-injection-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-process-injection-via-powershell.asciidoc
index ccc61b4e4d..2ace3c919c 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-process-injection-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-process-injection-via-powershell.asciidoc
@@ -49,11 +49,13 @@ Detects the use of Windows API functions that are commonly abused by malware and
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Process Injection via PowerShell
+*Triage and analysis*
+
+
+
+*Investigating Potential Process Injection via PowerShell*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
@@ -61,7 +63,9 @@ PowerShell also has solid capabilities to make the interaction with the Win32 AP
 
 Red Team tooling and malware developers take advantage of these capabilities to develop stagers and loaders that inject payloads directly into the memory without touching the disk to circumvent file-based security protections.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -71,15 +75,21 @@ Red Team tooling and malware developers take advantage of these capabilities to
 - Check if the imported function was executed and which process it targeted.
 - Check if the injected code can be retrieved (hardcoded in the script or on command line logs).
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Related rules
+
+*Related rules*
+
 
 - PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -90,7 +100,27 @@ Red Team tooling and malware developers take advantage of these capabilities to
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-chisel-client.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-chisel-client.asciidoc
index 6bfc76c665..c0ad6fa4db 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-chisel-client.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-chisel-client.asciidoc
@@ -44,21 +44,25 @@ This rule monitors for common command line flags leveraged by the Chisel client
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Protocol Tunneling via Chisel Client
+*Triage and analysis*
+
+
+
+*Investigating Potential Protocol Tunneling via Chisel Client*
+
 
 Attackers can leverage `chisel` to clandestinely tunnel network communications and evade security measures, potentially gaining unauthorized access to sensitive systems.
 
 This rule looks for a sequence of command line arguments that are consistent with `chisel` client tunneling behavior, followed by a network event by an uncommon process. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify any signs of suspicious network activity or anomalies that may indicate protocol tunneling. This could include unexpected traffic patterns or unusual network behavior.
   - Investigate listening ports and open sockets to look for potential protocol tunneling, reverse shells, or data exfiltration.
@@ -80,19 +84,25 @@ This rule looks for a sequence of command line arguments that are consistent wit
           - Check the reputation of the domain or IP address.
         - File access, modification, and creation activities.
 
-### Related rules
+
+*Related rules*
+
 
 - Potential Protocol Tunneling via Chisel Server - ac8805f6-1e08-406c-962e-3937057fa86f
 - Potential Linux Tunneling and/or Port Forwarding - 6ee947e9-de7e-4281-a55d-09289bdf947e
 - Potential Protocol Tunneling via EarthWorm - 9f1c4ca3-44b5-481d-ba42-32dc215a2769
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator or developer who uses port tunneling for benign purposes, consider adding exceptions for specific user accounts or hosts. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -107,7 +117,39 @@ This rule looks for a sequence of command line arguments that are consistent wit
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-chisel-server.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-chisel-server.asciidoc
index ec0567189f..4d39a66866 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-chisel-server.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-chisel-server.asciidoc
@@ -32,7 +32,7 @@ This rule monitors for common command line flags leveraged by the Chisel server
 * Tactic: Command and Control
 * Data Source: Elastic Defend
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -44,21 +44,25 @@ This rule monitors for common command line flags leveraged by the Chisel server
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Protocol Tunneling via Chisel Server
+*Triage and analysis*
+
+
+
+*Investigating Potential Protocol Tunneling via Chisel Server*
+
 
 Attackers can leverage `chisel` to clandestinely tunnel network communications and evade security measures, potentially gaining unauthorized access to sensitive systems.
 
 This rule looks for a sequence of command line arguments that are consistent with `chisel` server tunneling behavior, followed by a network event by an uncommon process. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify any signs of suspicious network activity or anomalies that may indicate protocol tunneling. This could include unexpected traffic patterns or unusual network behavior.
   - Investigate listening ports and open sockets to look for potential protocol tunneling, reverse shells, or data exfiltration.
@@ -80,19 +84,25 @@ This rule looks for a sequence of command line arguments that are consistent wit
           - Check the reputation of the domain or IP address.
         - File access, modification, and creation activities.
 
-### Related rules
+
+*Related rules*
+
 
 - Potential Protocol Tunneling via Chisel Client - 3f12325a-4cc6-410b-8d4c-9fbbeb744cfd
 - Potential Linux Tunneling and/or Port Forwarding - 6ee947e9-de7e-4281-a55d-09289bdf947e
 - Potential Protocol Tunneling via EarthWorm - 9f1c4ca3-44b5-481d-ba42-32dc215a2769
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator or developer who uses port tunneling for benign purposes, consider adding exceptions for specific user accounts or hosts. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -107,7 +117,39 @@ This rule looks for a sequence of command line arguments that are consistent wit
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc
index 594522aade..c49851b6a7 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc
@@ -47,21 +47,25 @@ Identifies the execution of the EarthWorm tunneler. Adversaries may tunnel netwo
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Protocol Tunneling via EarthWorm
+*Triage and analysis*
+
+
+
+*Investigating Potential Protocol Tunneling via EarthWorm*
+
 
 Attackers can leverage `earthworm` to clandestinely tunnel network communications and evade security measures, potentially gaining unauthorized access to sensitive systems.
 
 This rule looks for several command line arguments that are consistent with `earthworm` tunneling behavior. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify any signs of suspicious network activity or anomalies that may indicate protocol tunneling. This could include unexpected traffic patterns or unusual network behavior.
   - Investigate listening ports and open sockets to look for potential protocol tunneling, reverse shells, or data exfiltration.
@@ -83,19 +87,25 @@ This rule looks for several command line arguments that are consistent with `ear
           - Check the reputation of the domain or IP address.
         - File access, modification, and creation activities.
 
-### Related rules
+
+*Related rules*
+
 
 - Potential Protocol Tunneling via Chisel Client - 3f12325a-4cc6-410b-8d4c-9fbbeb744cfd
 - Potential Protocol Tunneling via Chisel Server - ac8805f6-1e08-406c-962e-3937057fa86f
 - Potential Linux Tunneling and/or Port Forwarding - 6ee947e9-de7e-4281-a55d-09289bdf947e
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator or developer who uses port tunneling for benign purposes, consider adding exceptions for specific user accounts or hosts. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -110,7 +120,59 @@ This rule looks for several command line arguments that are consistent with `ear
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+This rule requires data coming in either from Elastic Defend, or Auditbeat integration.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Custom Ingest Pipeline*
+
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html[guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-pspy-process-monitoring-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-pspy-process-monitoring-detected.asciidoc
index 39f3d54c5c..02bff04fe6 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-pspy-process-monitoring-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-pspy-process-monitoring-detected.asciidoc
@@ -25,12 +25,13 @@ This rule leverages auditd to monitor for processes scanning different processes
 
 *Tags*: 
 
+* Data Source: Auditd Manager
 * Domain: Endpoint
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Discovery
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -39,15 +40,48 @@ This rule leverages auditd to monitor for processes scanning different processes
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Auditd Manager.
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule the following additional audit rules are required to be added to the integration:
+  -- "-w /proc/ -p r -k audit_proc"
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
 sequence by process.pid, host.id with maxspan=5s
-[ file where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
-  auditd.data.syscall == "openat" and file.path == "/proc" and auditd.data.a0 : ("ffffffffffffff9c", "ffffff9c") and 
-  auditd.data.a2 : ("80000", "88000") ] with runs=10
+  [file where host.os.type == "linux" and auditd.data.syscall == "openat" and file.path == "/proc" and
+   auditd.data.a0 : ("ffffffffffffff9c", "ffffff9c") and auditd.data.a2 : ("80000", "88000") ] with runs=10
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
index 6c6caac0ce..3325717a17 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
@@ -49,21 +49,25 @@ Identifies suspicious commands executed via a web server, which may suggest a vu
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Remote Code Execution via Web Server
+*Triage and analysis*
+
+
+
+*Investigating Potential Remote Code Execution via Web Server*
+
 
 Adversaries may backdoor web servers with web shells to establish persistent access to systems. A web shell is a malicious script, often embedded into a compromised web server, that grants an attacker remote access and control over the server. This enables the execution of arbitrary commands, data exfiltration, and further exploitation of the target network.
 
 This rule detects a web server process spawning script and command line interface programs, potentially indicating attackers executing commands using the web shell.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate abnormal behaviors by the subject process such as network connections, file modifications, and any other spawned child processes.
   - Investigate listening ports and open sockets to look for potential reverse shells or data exfiltration.
@@ -85,11 +89,15 @@ This rule detects a web server process spawning script and command line interfac
       - Cron jobs, services and other persistence mechanisms.
         - !{osquery{"label":"Osquery - Retrieve Crontab Information","query":"SELECT * FROM crontab"}}
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -105,7 +113,41 @@ This rule detects a web server process spawning script and command line interfac
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-credential-access-via-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-credential-access-via-registry.asciidoc
index 6c9080ec43..45414720c8 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-credential-access-via-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-credential-access-via-registry.asciidoc
@@ -46,17 +46,21 @@ Identifies remote access to the registry to potentially dump credential data fro
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Remote Credential Access via Registry
+*Triage and analysis*
+
+
+
+*Investigating Potential Remote Credential Access via Registry*
+
 
 Dumping registry hives is a common way to access credential information. Some hives store credential material, such as the SAM hive, which stores locally cached credentials (SAM secrets), and the SECURITY hive, which stores domain cached credentials (LSA secrets). Dumping these hives in combination with the SYSTEM hive enables the attacker to decrypt these secrets.
 
 Attackers can use tools like secretsdump.py or CrackMapExec to dump the registry hives remotely, and use dumped credentials to access other systems in the domain.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the specifics of the involved assets, such as their role, criticality, and associated users.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -64,15 +68,21 @@ Attackers can use tools like secretsdump.py or CrackMapExec to dump the registry
 - Investigate other alerts associated with the user/source host during the past 48 hours.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
-### Related rules
+
+*Related rules*
+
 
 - Credential Acquisition via Registry Hive Dumping - a7e7bfa3-088e-4f13-b29e-3986e0e756b8
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -84,7 +94,19 @@ Attackers can use tools like secretsdump.py or CrackMapExec to dump the registry
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule uses Elastic Endpoint file creation and system integration events for correlation. Both data should be collected from the host for this detection to work.
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-shadowing-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-shadowing-activity.asciidoc
index 26cf90811e..06dc9fb6bd 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-shadowing-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-shadowing-activity.asciidoc
@@ -45,6 +45,17 @@ Identifies the modification of the Remote Desktop Protocol (RDP) Shadow registry
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-tunneling-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-tunneling-detected.asciidoc
index 96cd096855..1c53a27e9a 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-tunneling-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-tunneling-detected.asciidoc
@@ -49,11 +49,13 @@ Identifies potential use of an SSH utility to establish RDP over a reverse SSH T
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Remote Desktop Tunneling Detected
+*Triage and analysis*
+
+
+
+*Investigating Potential Remote Desktop Tunneling Detected*
+
 
 Protocol Tunneling is a mechanism that involves explicitly encapsulating a protocol within another for various use cases, ranging from providing an outer layer of encryption (similar to a VPN) to enabling traffic that network appliances would filter to reach their destination.
 
@@ -61,7 +63,9 @@ Attackers may tunnel Remote Desktop Protocol (RDP) traffic through other protoco
 
 This rule looks for command lines involving the `3389` port, which RDP uses by default and options commonly associated with tools that perform tunneling.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -70,12 +74,16 @@ This rule looks for command lines involving the `3389` port, which RDP uses by d
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 - Examine network data to determine if the host communicated with external servers using the tunnel.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 - Investigate the command line for the execution of programs that are unrelated to tunneling, like Remote Desktop clients.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -87,7 +95,17 @@ This rule looks for command lines involving the `3389` port, which RDP uses by d
 
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-file-execution-via-msiexec.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-file-execution-via-msiexec.asciidoc
index bf13cebed9..33d960615c 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-file-execution-via-msiexec.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-file-execution-via-msiexec.asciidoc
@@ -28,10 +28,9 @@ Identifies the execution of the built-in Windows Installer, msiexec.exe, to inst
 * Use Case: Threat Detection
 * Tactic: Initial Access
 * Tactic: Defense Evasion
-* Rule Type: BBR
 * Data Source: Elastic Defend
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-activity-via-terminal.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-activity-via-terminal.asciidoc
index efa411d691..95fba24da1 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-activity-via-terminal.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-activity-via-terminal.asciidoc
@@ -48,17 +48,21 @@ Identifies the execution of a shell process with suspicious arguments which may
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Reverse Shell Activity via Terminal
+*Triage and analysis*
+
+
+
+*Investigating Potential Reverse Shell Activity via Terminal*
+
 
 A reverse shell is a mechanism that's abused to connect back to an attacker-controlled system. It effectively redirects the system's input and output and delivers a fully functional remote shell to the attacker. Even private systems are vulnerable since the connection is outgoing. This activity is typically the result of vulnerability exploitation, malware infection, or penetration testing.
 
 This rule identifies commands that are potentially related to reverse shell activities using shell applications.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the command line and extract the target domain or IP address information.
   - Check if the domain is newly registered or unexpected.
@@ -68,11 +72,15 @@ This rule identifies commands that are potentially related to reverse shell acti
 - Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 - Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -83,7 +91,18 @@ This rule identifies commands that are potentially related to reverse shell acti
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-background-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-background-process.asciidoc
index b2231ecb9e..1cb5de10f4 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-background-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-background-process.asciidoc
@@ -38,6 +38,41 @@ Monitors for the execution of background processes with process arguments capabl
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-child.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-child.asciidoc
index 08a19ce260..03df8a1d9b 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-child.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-child.asciidoc
@@ -40,6 +40,42 @@ This detection rule identifies suspicious network traffic patterns associated wi
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Elastic Defend and select the integration to see more details about it.
+- Click Add Elastic Defend.
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click Save and Continue.
+- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-java.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-java.asciidoc
index 02986dc7bd..5da4aa2c4d 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-java.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-java.asciidoc
@@ -40,6 +40,41 @@ This detection rule identifies the execution of a Linux shell process from a Jav
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-binary.asciidoc
index 56de923426..31f3b70d23 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-binary.asciidoc
@@ -40,6 +40,41 @@ This detection rule detects the creation of a shell through a chain consisting o
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-child-process.asciidoc
index 9e827cd99d..49160e69ef 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-suspicious-child-process.asciidoc
@@ -40,6 +40,41 @@ This detection rule detects the creation of a shell through a suspicious process
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-udp.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-udp.asciidoc
index 9ff1ce54f2..11d1738364 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-udp.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell-via-udp.asciidoc
@@ -26,12 +26,13 @@ This detection rule identifies suspicious network traffic patterns associated wi
 
 *Tags*: 
 
+* Data Source: Auditd Manager
 * Domain: Endpoint
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Execution
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -40,25 +41,77 @@ This detection rule identifies suspicious network traffic patterns associated wi
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Auditbeat
+- Auditd Manager
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule no additional audit rules are required to be added to the integration.
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
 sample by host.id, process.pid, process.parent.pid
-[process where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
- auditd.data.syscall == "execve" and process.name : ("bash", "dash", "sh", "tcsh",
- "csh", "zsh", "ksh", "fish", "perl", "python*", "nc", "ncat", "netcat", "php*", "ruby",
- "openssl", "awk", "telnet", "lua*", "socat")]
-[process where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
- auditd.data.syscall == "socket" and process.name : ("bash", "dash", "sh", "tcsh", "csh",
- "zsh", "ksh", "fish", "perl", "python*", "nc", "ncat", "netcat", "php*", "ruby", "openssl",
- "awk", "telnet", "lua*", "socat") and auditd.data.a0 == "2" and auditd.data.a1 : ("2", "802")]
-[network where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
- auditd.data.syscall == "connect" and process.name : ("bash", "dash", "sh", "tcsh", "csh",
- "zsh", "ksh", "fish", "perl", "python*", "nc", "ncat", "netcat", "php*", "ruby", "openssl",
- "awk", "telnet", "lua*", "socat") and network.direction == "egress" and destination.ip != null and 
- destination.ip != "127.0.0.1" and destination.ip != "127.0.0.53" and destination.ip != "::1"]
+  [process where host.os.type == "linux" and auditd.data.syscall == "execve" and process.name : (
+     "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "perl", "python*", "nc", "ncat", "netcat", "php*",
+     "ruby", "openssl", "awk", "telnet", "lua*", "socat"
+   )
+  ]
+  [process where host.os.type == "linux" and auditd.data.syscall == "socket" and process.name : (
+     "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "perl", "python*", "nc", "ncat", "netcat", "php*",
+     "ruby", "openssl", "awk", "telnet", "lua*", "socat"
+   ) and
+   auditd.data.a0 == "2" and auditd.data.a1 : ("2", "802")]
+[network where host.os.type == "linux" and auditd.data.syscall == "connect" and process.name : (
+   "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "perl", "python*", "nc", "ncat", "netcat", "php*",
+   "ruby", "openssl", "awk", "telnet", "lua*", "socat"
+ ) and
+ network.direction == "egress" and destination.ip != null and destination.ip != "127.0.0.1" and
+ destination.ip != "127.0.0.53" and destination.ip != "::1"]
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell.asciidoc
index 550e908d8c..9ef5dd7195 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-reverse-shell.asciidoc
@@ -40,6 +40,41 @@ This detection rule identifies suspicious network traffic patterns associated wi
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-secure-file-deletion-via-sdelete-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-secure-file-deletion-via-sdelete-utility.asciidoc
index 278a83d1a0..feb51db940 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-secure-file-deletion-via-sdelete-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-secure-file-deletion-via-sdelete-utility.asciidoc
@@ -47,28 +47,36 @@ Detects file name patterns generated by the use of Sysinternals SDelete utility
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Secure File Deletion via SDelete Utility
+*Triage and analysis*
+
+
+
+*Investigating Potential Secure File Deletion via SDelete Utility*
+
 
 SDelete is a tool primarily used for securely deleting data from storage devices, making it unrecoverable. Microsoft develops it as part of the Sysinternals Suite. Although commonly used to delete data securely, attackers can abuse it to delete forensic indicators and remove files as a post-action to a destructive action such as ransomware or data theft to hinder recovery efforts.
 
 This rule identifies file name patterns generated by the use of SDelete utility to securely delete a file via multiple file overwrite and rename operations.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Examine the command line and identify the files deleted, their importance and whether they could be the target of antiforensics activity.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This is a dual-use tool, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the administrator is aware of the activity, no other suspicious activity was identified, and there are justifications for the execution.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
   - Prioritize cases involving critical servers and users.
@@ -81,7 +89,6 @@ This rule identifies file name patterns generated by the use of SDelete utility
 - Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-shadow-credentials-added-to-ad-object.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-shadow-credentials-added-to-ad-object.asciidoc
index 2cefe0e47b..8503186565 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-shadow-credentials-added-to-ad-object.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-shadow-credentials-added-to-ad-object.asciidoc
@@ -50,17 +50,21 @@ Identify the modification of the msDS-KeyCredentialLink attribute in an Active D
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Shadow Credentials added to AD Object
+*Triage and analysis*
+
+
+
+*Investigating Potential Shadow Credentials added to AD Object*
+
 
 The msDS-KeyCredentialLink is an Active Directory (AD) attribute that links cryptographic certificates to a user or computer for domain authentication.
 
 Attackers with write privileges on this attribute over an object can abuse it to gain access to the object or maintain persistence. This means they can authenticate and perform actions on behalf of the exploited identity, and they can use Shadow Credentials to request Ticket Granting Tickets (TGTs) on behalf of the identity.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify whether Windows Hello for Business (WHfB) and/or Azure AD is used in the environment.
   - Review the event ID 4624 for logon events involving the subject identity (`winlog.event_data.SubjectUserName`).
@@ -70,11 +74,15 @@ Attackers with write privileges on this attribute over an object can abuse it to
 - Review the event IDs 4768 and 4769 for suspicious ticket requests involving the modified identity (`winlog.event_data.ObjectDN`).
   - Extract the source IP addresses from these events and use them as indicators of compromise (IoCs) to investigate whether the host is compromised and to scope the attacker's access to the environment.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Administrators might use custom accounts on Azure AD Connect. If this is the case, make sure the account is properly secured. You can also create an exception for the account if expected activity makes too much noise in your environment.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
@@ -84,7 +92,32 @@ Attackers with write privileges on this attribute over an object can abuse it to
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success,Failure)
+```
+
+The above policy does not cover User objects, so we need to set up an AuditRule using https://github.com/OTRF/Set-AuditRule.
+As this specifies the msDS-KeyCredentialLink Attribute GUID, it is expected to be low noise.
+
+```
+Set-AuditRule -AdObjectPath 'AD:\CN=Users,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights WriteProperty -InheritanceFlags Children -AttributeGUID 5b47d60f-6090-40b2-9f37-2a4de88f3063 -AuditFlags Success
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-shadow-file-read-via-command-line-utilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-shadow-file-read-via-command-line-utilities.asciidoc
index f38aeeaf07..9b02a8f093 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-shadow-file-read-via-command-line-utilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-shadow-file-read-via-command-line-utilities.asciidoc
@@ -43,6 +43,41 @@ Identifies access to the /etc/shadow file via the commandline using standard sys
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-shell-via-wildcard-injection-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-shell-via-wildcard-injection-detected.asciidoc
index 09114394f9..3c52e0f425 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-shell-via-wildcard-injection-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-shell-via-wildcard-injection-detected.asciidoc
@@ -41,6 +41,41 @@ This rule monitors for the execution of a set of linux binaries, that are potent
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-ssh-it-ssh-worm-downloaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-ssh-it-ssh-worm-downloaded.asciidoc
index 8563643698..451a452f91 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-ssh-it-ssh-worm-downloaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-ssh-it-ssh-worm-downloaded.asciidoc
@@ -41,6 +41,42 @@ Identifies processes that are capable of downloading files with command line arg
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
index de1e49ff21..321764452e 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
@@ -24,12 +24,13 @@ An FTP (file transfer protocol) brute force attack is a method where an attacker
 
 *Tags*: 
 
+* Data Source: Auditd Manager
 * Domain: Endpoint
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Credential Access
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -38,18 +39,67 @@ An FTP (file transfer protocol) brute force attack is a method where an attacker
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Auditbeat
+- Auditd Manager
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule no additional audit rules are required to be added to the integration.
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
 sequence by host.id, auditd.data.addr, related.user with maxspan=5s
-  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
-   event.action == "authenticated" and auditd.data.terminal == "ftp" and event.outcome == "failure" and 
-   auditd.data.addr != null and auditd.data.addr != "0.0.0.0" and auditd.data.addr != "::"] with runs=10
-  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
-   event.action  == "authenticated" and auditd.data.terminal == "ftp" and event.outcome == "success" and 
-   auditd.data.addr != null and auditd.data.addr != "0.0.0.0" and auditd.data.addr != "::"] | tail 1
+  [authentication where host.os.type == "linux" and event.action == "authenticated" and
+   auditd.data.terminal == "ftp" and event.outcome == "failure" and auditd.data.addr != null and
+   auditd.data.addr != "0.0.0.0" and auditd.data.addr != "::"] with runs=10
+  [authentication where host.os.type == "linux" and event.action  == "authenticated" and
+   auditd.data.terminal == "ftp" and event.outcome == "success" and auditd.data.addr != null and
+   auditd.data.addr != "0.0.0.0" and auditd.data.addr != "::"] | tail 1
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
index e247daba5f..da85d20fd9 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
@@ -24,12 +24,13 @@ An RDP (Remote Desktop Protocol) brute force attack involves an attacker repeate
 
 *Tags*: 
 
+* Data Source: Auditd Manager
 * Domain: Endpoint
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Credential Access
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -38,16 +39,65 @@ An RDP (Remote Desktop Protocol) brute force attack involves an attacker repeate
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Auditbeat
+- Auditd Manager
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule no additional audit rules are required to be added to the integration.
+
+
+
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
 sequence by host.id, related.user with maxspan=5s
-  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
-   event.action == "authenticated" and auditd.data.terminal : "*rdp*" and event.outcome == "failure"] with runs=10
-  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
-   event.action  == "authenticated" and auditd.data.terminal : "*rdp*" and event.outcome == "success"] | tail 1
+  [authentication where host.os.type == "linux" and event.action == "authenticated" and
+   auditd.data.terminal : "*rdp*" and event.outcome == "failure"] with runs=10
+  [authentication where host.os.type == "linux" and event.action  == "authenticated" and
+   auditd.data.terminal : "*rdp*" and event.outcome == "success"] | tail 1
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-successful-ssh-brute-force-attack.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-successful-ssh-brute-force-attack.asciidoc
index e13749398d..eff390d1d4 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-successful-ssh-brute-force-attack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-successful-ssh-brute-force-attack.asciidoc
@@ -41,28 +41,36 @@ Identifies multiple SSH login failures followed by a successful one from the sam
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Successful SSH Brute Force Attack
+*Triage and analysis*
+
+
+
+*Investigating Potential Successful SSH Brute Force Attack*
+
 
 The rule identifies consecutive SSH login failures followed by a successful login from the same source IP address to the same target host indicating a successful attempt of brute force password guessing.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the login failure user name(s).
 - Investigate the source IP address of the failed ssh login attempt(s).
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Identify the source and the target computer and their roles in the IT environment.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Authentication misconfiguration or obsolete credentials.
 - Service account password expired.
 - Infrastructure or availability issue.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Ensure active session(s) on the host(s) are terminated as the attacker could have gained initial access to the system(s).
@@ -73,7 +81,52 @@ The rule identifies consecutive SSH login failures followed by a successful logi
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Auditbeat
+- Filebeat
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Filebeat Setup*
+
+Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing.
+
+
+*The following steps should be executed in order to add the Filebeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html[helper guide].
+- To run Filebeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html[helper guide].
+- To run Filebeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html[helper guide].
+- For quick start information for Filebeat refer to the https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html[helper guide].
+- For complete “Setup and Run Filebeat” information refer to the https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html[helper guide].
+
+
+*Rule Specific Setup Note*
+
+- This rule requires the “Filebeat System Module” to be enabled.
+- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions.
+- To run the system module of Filebeat on Linux follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-sudo-hijacking-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-sudo-hijacking-detected.asciidoc
index 6b9010b5e4..ae80f2fe52 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-sudo-hijacking-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-sudo-hijacking-detected.asciidoc
@@ -43,6 +43,41 @@ Identifies the creation of a sudo binary located at /usr/bin/sudo. Attackers may
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-sudo-privilege-escalation-via-cve-2019-14287.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-sudo-privilege-escalation-via-cve-2019-14287.asciidoc
index da67a3987e..37629c15b4 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-sudo-privilege-escalation-via-cve-2019-14287.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-sudo-privilege-escalation-via-cve-2019-14287.asciidoc
@@ -41,6 +41,41 @@ This rule monitors for the execution of a suspicious sudo command that is levera
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-sudo-token-manipulation-via-process-injection.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-sudo-token-manipulation-via-process-injection.asciidoc
index 7e7b9b8971..c09792f822 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-sudo-token-manipulation-via-process-injection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-sudo-token-manipulation-via-process-injection.asciidoc
@@ -40,6 +40,41 @@ This rule detects potential sudo token manipulation attacks through process inje
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-suspicious-debugfs-root-device-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-suspicious-debugfs-root-device-access.asciidoc
index 43266cbd0b..fd7e24bc14 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-suspicious-debugfs-root-device-access.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-suspicious-debugfs-root-device-access.asciidoc
@@ -42,6 +42,41 @@ This rule monitors for the usage of the built-in Linux DebugFS utility to access
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-unauthorized-access-via-wildcard-injection-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-unauthorized-access-via-wildcard-injection-detected.asciidoc
index eeed8bee7c..fd7dbe8a5a 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-unauthorized-access-via-wildcard-injection-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-unauthorized-access-via-wildcard-injection-detected.asciidoc
@@ -43,6 +43,41 @@ This rule monitors for the execution of the "chown" and "chmod" commands with co
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-upgrade-of-non-interactive-shell.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-upgrade-of-non-interactive-shell.asciidoc
index fc21b1c71b..02b43a2425 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-upgrade-of-non-interactive-shell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-upgrade-of-non-interactive-shell.asciidoc
@@ -40,6 +40,41 @@ Identifies when a non-interactive terminal (tty) is being upgraded to a fully in
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
index bd93808e36..cfda0fe933 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
@@ -48,20 +48,24 @@ Identifies suspicious instances of the Windows Error Reporting process (WerFault
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Windows Error Manager Masquerading
+*Triage and analysis*
+
+
+
+*Investigating Potential Windows Error Manager Masquerading*
+
 
 By examining the specific traits of Windows binaries -- such as process trees, command lines, network connections, registry modifications, and so on -- it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading and deserve further investigation.
 
 This rule identifies a potential malicious process masquerading as `wermgr.exe` or `WerFault.exe`, by looking for a process creation with no arguments followed by a network connection.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -82,11 +86,15 @@ This rule identifies a potential malicious process masquerading as `wermgr.exe`
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -100,7 +108,6 @@ This rule identifies a potential malicious process masquerading as `wermgr.exe`
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potentially-successful-mfa-bombing-via-push-notifications.asciidoc b/docs/detections/prebuilt-rules/rule-details/potentially-successful-mfa-bombing-via-push-notifications.asciidoc
index b7562f0d97..3c853ea541 100644
--- a/docs/detections/prebuilt-rules/rule-details/potentially-successful-mfa-bombing-via-push-notifications.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potentially-successful-mfa-bombing-via-push-notifications.asciidoc
@@ -45,17 +45,21 @@ Detects when an attacker abuses the Multi-Factor authentication mechanism by rep
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Potential Abuse of Repeated MFA Push Notifications
+*Triage and analysis*
+
+
+
+*Investigating Potential Abuse of Repeated MFA Push Notifications*
+
 
 Multi-Factor Authentication (MFA) is an effective method to prevent unauthorized access. However, some adversaries may abuse the system by repeatedly sending MFA push notifications until the user unwittingly approves the access.
 
 This rule detects when a user denies MFA Okta Verify push notifications twice, followed by a successful authentication event within a 10-minute window. This sequence could indicate an adversary's attempt to bypass the Okta MFA policy.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 
 - Identify the user who received the MFA notifications by reviewing the `user.email` field.
 - Identify the time, source IP, and geographical location of the MFA requests and the subsequent successful login.
@@ -65,12 +69,16 @@ This rule detects when a user denies MFA Okta Verify push notifications twice, f
 - Look for any other suspicious activity on the account around the same time.
 - Identify whether the same pattern is repeated for other users in your organization. Multiple users receiving push notifications simultaneously might indicate a larger attack.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 
 - Determine if the MFA push notifications were legitimate. Sometimes, users accidentally trigger MFA requests or deny them unintentionally and later approve them.
 - Check if there are known issues with the MFA system causing false denials.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 
 - If unauthorized access is confirmed, initiate your incident response process.
 - Alert the user and your IT department immediately.
@@ -80,7 +88,11 @@ This rule detects when a user denies MFA Okta Verify push notifications twice, f
 - Consider enhancing your MFA policy to prevent such incidents in the future.
 - Encourage users to report any unexpected MFA notifications immediately.
 - Review and update your incident response plans and security policies based on the findings from the incident.
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-invoke-ninjacopy-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-invoke-ninjacopy-script.asciidoc
index a62d9fbe87..3de339267a 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-invoke-ninjacopy-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-invoke-ninjacopy-script.asciidoc
@@ -45,17 +45,21 @@ Detects PowerShell scripts that contain the default exported functions used on I
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell Invoke-NinjaCopy script
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Invoke-NinjaCopy script*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available for use in various environments, creating an attractive way for attackers to execute code.
 
 Invoke-NinjaCopy is a PowerShell script capable of reading SYSTEM files that were normally locked, such as `NTDS.dit` or sensitive registry locations. It does so by using the direct volume access technique, which enables attackers to bypass access control mechanisms and file system monitoring by reading the raw data directly from the disk and extracting the file by parsing the file system structures.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -65,11 +69,15 @@ Invoke-NinjaCopy is a PowerShell script capable of reading SYSTEM files that wer
 - Determine whether the script stores the captured data locally.
 - Check if the imported function was executed and which file it targeted.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -79,7 +87,6 @@ Invoke-NinjaCopy is a PowerShell script capable of reading SYSTEM files that wer
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-dump.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-dump.asciidoc
index 0d95941272..cd9df9f2fe 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-dump.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-dump.asciidoc
@@ -44,17 +44,21 @@ Detects PowerShell scripts that have the capability of dumping Kerberos tickets
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell Kerberos Ticket Dump
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Kerberos Ticket Dump*
+
 
 Kerberos is an authentication protocol that relies on tickets to grant access to network resources. Adversaries may abuse this protocol to acquire credentials for lateral movement within a network.
 
 This rule indicates the use of scripts that contain code capable of dumping Kerberos tickets, which can indicate potential PowerShell abuse for credential theft.
 
-### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -64,15 +68,21 @@ This rule indicates the use of scripts that contain code capable of dumping Kerb
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate other potentially compromised accounts and hosts. Review login events (like 4624) for suspicious events involving the subject and target accounts.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of file path and user ID conditions.
 
-### Related Rules
+
+*Related Rules*
+
 
 - PowerShell Kerberos Ticket Request - eb610e70-f9e6-4949-82b9-f1c5bcd37c39
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
   - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
@@ -91,7 +101,27 @@ This rule indicates the use of scripts that contain code capable of dumping Kerb
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-request.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-request.asciidoc
index 7eec5df28e..2127e66385 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-request.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-request.asciidoc
@@ -46,11 +46,13 @@ Detects PowerShell scripts that have the capability of requesting kerberos ticke
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell Kerberos Ticket Request
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Kerberos Ticket Request*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available for use in various environments, creating an attractive way for attackers to execute code.
 
@@ -58,7 +60,9 @@ Accounts associated with a service principal name (SPN) are viable targets for K
 
 Attackers can use PowerShell to request these Kerberos tickets, with the intent of extracting them from memory to perform Kerberoasting.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -68,13 +72,17 @@ Attackers can use PowerShell to request these Kerberos tickets, with the intent
 - Contact the account owner and confirm whether they are aware of this activity.
 - Check if the script has any other functionality that can be potentially malicious.
 - Investigate other alerts associated with the user/host during the past 48 hours.
-- Review event ID [4769](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769) related to this account and service name for additional information.
+- Review event ID https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769[4769] related to this account and service name for additional information.
+
+
+*False positive analysis*
 
-### False positive analysis
 
 - A possible false positive can be identified if the script content is not malicious/harmful or does not request Kerberos tickets for user accounts, as computer accounts are not vulnerable to Kerberoasting due to complex password requirements and policy.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. Prioritize privileged accounts.
@@ -83,7 +91,27 @@ Attackers can use PowerShell to request these Kerberos tickets, with the intent
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-keylogging-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-keylogging-script.asciidoc
index 029ecd4426..173f08aa95 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-keylogging-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-keylogging-script.asciidoc
@@ -46,17 +46,21 @@ Detects the use of Win32 API Functions that can be used to capture user keystrok
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell Keylogging Script
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Keylogging Script*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
 Attackers can abuse PowerShell capabilities to capture user keystrokes with the goal of stealing credentials and other valuable information as credit card data and confidential conversations.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -67,15 +71,21 @@ Attackers can abuse PowerShell capabilities to capture user keystrokes with the
 - Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
 - Assess network data to determine if the host communicated with the exfiltration server.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Regular users do not have a business justification for using scripting utilities to capture keystrokes, making false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
 
-### Related rules
+
+*Related rules*
+
 
 - PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -87,7 +97,27 @@ Attackers can abuse PowerShell capabilities to capture user keystrokes with the
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-mailbox-collection-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-mailbox-collection-script.asciidoc
index 2c08a2f1ef..5f091403a8 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-mailbox-collection-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-mailbox-collection-script.asciidoc
@@ -46,11 +46,13 @@ Detects PowerShell scripts that can be used to collect data from mailboxes. Adve
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell Mailbox Collection Script
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Mailbox Collection Script*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
@@ -58,7 +60,9 @@ Email mailboxes and their information can be valuable assets for attackers. Comp
 
 This rule identifies scripts that contains methods and classes that can be abused to collect emails from local and remote mailboxes.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -69,15 +73,21 @@ This rule identifies scripts that contains methods and classes that can be abuse
 - Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
   - Assess network data to determine if the host communicated with the exfiltration server.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.
 
-### Related rules
+
+*Related rules*
+
 
 - Exporting Exchange Mailbox via PowerShell - 6aace640-e631-4870-ba8e-5fdda09325db
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.
@@ -88,7 +98,27 @@ This rule identifies scripts that contains methods and classes that can be abuse
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-minidump-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-minidump-script.asciidoc
index e29161ecdc..9d3b868ca7 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-minidump-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-minidump-script.asciidoc
@@ -47,17 +47,21 @@ This rule detects PowerShell scripts capable of dumping process memory using Win
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell MiniDump Script
+*Triage and analysis*
+
+
+
+*Investigating PowerShell MiniDump Script*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
 Attackers can abuse Process Memory Dump capabilities to extract credentials from LSASS or to obtain other privileged information stored in the process memory.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -66,16 +70,22 @@ Attackers can abuse Process Memory Dump capabilities to extract credentials from
 - Evaluate whether the user needs to use PowerShell to complete tasks.
 - Check if the imported function was executed and which process it targeted.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Regular users do not have a business justification for using scripting utilities to dump process memory, making false positives unlikely.
 
-### Related rules
+
+*Related rules*
+
 
 - PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
 - Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -86,7 +96,27 @@ Attackers can abuse Process Memory Dump capabilities to extract credentials from
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
index be972d7609..855c3a8c1e 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
@@ -46,11 +46,13 @@ Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell PSReflect Script
+*Triage and analysis*
+
+
+
+*Investigating PowerShell PSReflect Script*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
@@ -61,9 +63,11 @@ Although this is an interesting project for every developer and admin out there,
 Detecting the core implementation of PSReflect means detecting most of the tooling that uses Windows API through PowerShell, enabling defenders to discover tools being dropped in the environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics. The script content that may be split into multiple script blocks (you can use the field `powershell.file.script_block_id` for filtering).
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -85,11 +89,15 @@ Detecting the core implementation of PSReflect means detecting most of the tooli
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Related rules
+
+*Related rules*
+
 
 - PowerShell Suspicious Discovery Related Windows API Functions - 61ac3638-40a3-44b2-855a-985636ca985e
 - PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889
@@ -99,7 +107,9 @@ Detecting the core implementation of PSReflect means detecting most of the tooli
 - PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a
 - PowerShell Suspicious Script with Screenshot Capabilities - 959a7353-1129-4aa7-9084-30746b256a70
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -115,7 +125,28 @@ Detecting the core implementation of PSReflect means detecting most of the tooli
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be configured (Enable).
+
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-block-logging-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-block-logging-disabled.asciidoc
index c3b823ade1..e98ca3debc 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-block-logging-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-block-logging-disabled.asciidoc
@@ -48,17 +48,21 @@ Identifies attempts to disable PowerShell Script Block Logging via registry modi
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell Script Block Logging Disabled
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Script Block Logging Disabled*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available in various environments and creating an attractive way for attackers to execute code.
 
 PowerShell Script Block Logging is a feature of PowerShell that records the content of all script blocks that it processes, giving defenders visibility of PowerShell scripts and sequences of executed commands.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -66,11 +70,15 @@ PowerShell Script Block Logging is a feature of PowerShell that records the cont
 - Check whether it makes sense for the user to use PowerShell to complete tasks.
 - Investigate if PowerShell scripts were run after logging was disabled.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Related rules
+
+*Related rules*
+
 
 - PowerShell Suspicious Discovery Related Windows API Functions - 61ac3638-40a3-44b2-855a-985636ca985e
 - PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889
@@ -80,7 +88,9 @@ PowerShell Script Block Logging is a feature of PowerShell that records the cont
 - PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a
 - PowerShell Suspicious Script with Screenshot Capabilities - 959a7353-1129-4aa7-9084-30746b256a70
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -90,7 +100,6 @@ PowerShell Script Block Logging is a feature of PowerShell that records the cont
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-archive-compression-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-archive-compression-capabilities.asciidoc
index 1c5b406939..4bd41ad120 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-archive-compression-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-archive-compression-capabilities.asciidoc
@@ -40,6 +40,26 @@ Identifies the use of Cmdlets and methods related to archive compression activit
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-discovery-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-discovery-capabilities.asciidoc
index 9dc0a01e10..178a496116 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-discovery-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-discovery-capabilities.asciidoc
@@ -32,7 +32,7 @@ Identifies the use of Cmdlets and methods related to discovery activities. Attac
 * Data Source: PowerShell Logs
 * Rule Type: BBR
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -41,6 +41,26 @@ Identifies the use of Cmdlets and methods related to discovery activities. Attac
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
 ==== Rule query
 
 
@@ -48,9 +68,6 @@ Identifies the use of Cmdlets and methods related to discovery activities. Attac
 ----------------------------------
 event.category:process and host.os.type:windows and
   powershell.file.script_block_text : (
-    (
-      ("Get-ItemProperty" or "Get-Item") and "-Path"
-    ) or
     (
       "Get-ADDefaultDomainPasswordPolicy" or
       "Get-ADDomain" or "Get-ComputerInfo" or
@@ -133,6 +150,14 @@ event.category:process and host.os.type:windows and
       )
     )
   ) and
+  not powershell.file.script_block_text : (
+    (
+      "__cmdletization_BindCommonParameters" and
+      "Microsoft.PowerShell.Core\Export-ModuleMember" and
+      "Microsoft.PowerShell.Cmdletization.Cim.CimCmdletAdapter"
+    ) or
+    "CmdletsToExport=@(\"Add-Content\","
+  ) and
   not user.id : ("S-1-5-18" or "S-1-5-19" or "S-1-5-20") and
   not file.path : (
         ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\*.psd1 or
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-encryption-decryption-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-encryption-decryption-capabilities.asciidoc
index 9c532cccc9..08362f7e82 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-encryption-decryption-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-encryption-decryption-capabilities.asciidoc
@@ -43,17 +43,21 @@ Identifies the use of Cmdlets and methods related to encryption/decryption of fi
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell Script with Encryption/Decryption Capabilities
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Script with Encryption/Decryption Capabilities*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available for use in various environments, creating an attractive way for attackers to execute code.
 
 PowerShell offers encryption and decryption functionalities that attackers can abuse for various purposes, such as concealing payloads, C2 communications, and encrypting data as part of ransomware operations.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -61,11 +65,15 @@ PowerShell offers encryption and decryption functionalities that attackers can a
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Evaluate whether the user needs to use PowerShell to complete tasks.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This is a dual-use mechanism, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the script doesn't contain malicious functions or potential for abuse, no other suspicious activity was identified, and there are justifications for the execution.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -75,7 +83,6 @@ PowerShell offers encryption and decryption functionalities that attackers can a
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-log-clear-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-log-clear-capabilities.asciidoc
index 713a108ee2..393a1f1156 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-log-clear-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-log-clear-capabilities.asciidoc
@@ -34,7 +34,7 @@ Identifies the use of Cmdlets and methods related to Windows event log deletion
 * Data Source: PowerShell Logs
 * Rule Type: BBR
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -43,6 +43,26 @@ Identifies the use of Cmdlets and methods related to Windows event log deletion
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
 ==== Rule query
 
 
@@ -57,6 +77,9 @@ event.category:process and host.os.type:windows and
   ) and
   not file.path : (
     ?\:\\\\*\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\Modules\\\\Microsoft.PowerShell.Management\\\\*.psd1
+  ) and
+  not powershell.file.script_block_text : (
+    "CmdletsToExport=@(\"Add-Content\""
   )
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-password-policy-discovery-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-password-policy-discovery-capabilities.asciidoc
index 8dcad372a3..103aa4cb88 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-password-policy-discovery-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-password-policy-discovery-capabilities.asciidoc
@@ -32,7 +32,7 @@ Identifies the use of Cmdlets and methods related to remote execution activities
 * Data Source: PowerShell Logs
 * Rule Type: BBR
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -41,6 +41,26 @@ Identifies the use of Cmdlets and methods related to remote execution activities
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
 ==== Rule query
 
 
@@ -78,6 +98,10 @@ event.category: "process" and host.os.type:windows and
 ) and not powershell.file.script_block_text : (
     "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
   )
+  and not 
+  (
+    powershell.file.script_block_text : ("43c15630-959c-49e4-a977-758c5cc93408" and "CmdletsToExport" and "ActiveDirectory.Types.ps1xml")
+  )
   and not user.id : "S-1-5-18"
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-remote-execution-capabilities-via-winrm.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-remote-execution-capabilities-via-winrm.asciidoc
index 1b16e5df29..bfda625e9c 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-remote-execution-capabilities-via-winrm.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-remote-execution-capabilities-via-winrm.asciidoc
@@ -36,7 +36,7 @@ Identifies the use of Cmdlets and methods related to remote execution activities
 * Data Source: PowerShell Logs
 * Rule Type: BBR
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -45,6 +45,26 @@ Identifies the use of Cmdlets and methods related to remote execution activities
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
 ==== Rule query
 
 
@@ -61,6 +81,10 @@ event.category:process and host.os.type:windows and
     ?\:\\\\Logicmonitor\\\\tmp* or
     ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\dbatools\\\\* or
     ?\:\\\\ExchangeServer\\\\bin*
+  ) and not
+  powershell.file.script_block_text : (
+    "Export-ModuleMember -Function @('Invoke-Expression''Invoke-Command')" and
+    "function Invoke-Command {"
   )
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-token-impersonation-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-token-impersonation-capabilities.asciidoc
index 6dccd75f92..10f1c271fa 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-token-impersonation-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-token-impersonation-capabilities.asciidoc
@@ -47,20 +47,24 @@ Detects scripts that contain PowerShell functions, structures, or Windows API fu
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell Script with Token Impersonation Capabilities
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Script with Token Impersonation Capabilities*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
 Adversaries can abuse PowerShell to perform token impersonation, which involves duplicating and impersonating another user's token to escalate privileges and bypass access controls. This rule identifies scripts containing PowerShell functions, structures, or Windows API functions related to token impersonation/theft.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -83,16 +87,22 @@ Adversaries can abuse PowerShell to perform token impersonation, which involves
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Regular users should not need to impersonate other users, which makes false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
 
-### Related Rules
+
+*Related Rules*
+
 
 - PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
 - Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -106,7 +116,26 @@ Adversaries can abuse PowerShell to perform token impersonation, which involves
 - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The 'PowerShell Script Block Logging' logging policy must be configured (Enable).
+
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-webcam-video-capture-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-webcam-video-capture-capabilities.asciidoc
index db8c017eb6..b83bfcf105 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-webcam-video-capture-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-webcam-video-capture-capabilities.asciidoc
@@ -41,6 +41,26 @@ Detects PowerShell scripts that can be used to record webcam video. Attackers ca
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-share-enumeration-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-share-enumeration-script.asciidoc
index 6031e15585..66b8e0cb1b 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-share-enumeration-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-share-enumeration-script.asciidoc
@@ -49,17 +49,21 @@ Detects scripts that contain PowerShell functions, structures, or Windows API fu
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell Share Enumeration Script
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Share Enumeration Script*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
 Attackers can use PowerShell to enumerate shares to search for sensitive data like documents, scripts, and other kinds of valuable data for encryption, exfiltration, and lateral movement.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -69,11 +73,15 @@ Attackers can use PowerShell to enumerate shares to search for sensitive data li
 - Check for additional PowerShell and command line logs that indicate that imported functions were run.
   - Evaluate which information was potentially mapped and accessed by the attacker.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -84,7 +92,28 @@ Attackers can use PowerShell to enumerate shares to search for sensitive data li
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be configured (Enable).
+
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-discovery-related-windows-api-functions.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-discovery-related-windows-api-functions.asciidoc
index 2ac106bb7a..3db9b4c8aa 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-discovery-related-windows-api-functions.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-discovery-related-windows-api-functions.asciidoc
@@ -48,17 +48,21 @@ This rule detects the use of discovery-related Windows API functions in PowerShe
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell Suspicious Discovery Related Windows API Functions
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Suspicious Discovery Related Windows API Functions*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
 Attackers can use PowerShell to interact with the Win32 API to bypass command line based detections, using libraries like PSReflect or Get-ProcAddress Cmdlet.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -67,15 +71,21 @@ Attackers can use PowerShell to interact with the Win32 API to bypass command li
 - Evaluate whether the user needs to use PowerShell to complete tasks.
 - Check for additional PowerShell and command-line logs that indicate that imported functions were run.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities themselves are not inherently malicious if occurring in isolation, as long as the script does not contain other capabilities, and there are no other alerts related to the user or host; such alerts can be dismissed. However, analysts should keep in mind that this is not a common way of getting information, making it suspicious.
 
-### Related rules
+
+*Related rules*
+
 
 - PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -85,7 +95,27 @@ Attackers can use PowerShell to interact with the Win32 API to bypass command li
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
index ff64e6e8f4..cb37c6e44b 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
@@ -43,20 +43,24 @@ Identifies the use of .NET functionality for decompression and base64 decoding c
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell Suspicious Payload Encoded and Compressed
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Suspicious Payload Encoded and Compressed*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
 Attackers can embed compressed and encoded payloads in scripts to load directly into the memory without touching the disk. This strategy can circumvent string and file-based security protections.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -78,17 +82,23 @@ Attackers can embed compressed and encoded payloads in scripts to load directly
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately outside engineering or IT business units. As long as the analyst did not identify malware or suspicious activity related to the user or host, this alert can be dismissed.
 
-### Related rules
+
+*Related rules*
+
 
 - PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
 - Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
 - Suspicious .NET Reflection via PowerShell - e26f042e-c590-4e82-8e05-41e81bd822ad
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -105,7 +115,27 @@ Attackers can embed compressed and encoded payloads in scripts to load directly
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-audio-capture-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-audio-capture-capabilities.asciidoc
index 1961d36df4..4a1cc3ede0 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-audio-capture-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-audio-capture-capabilities.asciidoc
@@ -45,17 +45,21 @@ Detects PowerShell scripts that can record audio, a common feature in popular po
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell Suspicious Script with Audio Capture Capabilities
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Suspicious Script with Audio Capture Capabilities*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
 Attackers can use PowerShell to interact with the Windows API with the intent of capturing audio from input devices connected to the victim's computer.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -66,16 +70,22 @@ Attackers can use PowerShell to interact with the Windows API with the intent of
 - Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
 - Assess network data to determine if the host communicated with the exfiltration server.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Regular users should not need scripts to capture audio, which makes false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
 
-### Related rules
+
+*Related rules*
+
 
 - PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
 - Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -87,7 +97,27 @@ Attackers can use PowerShell to interact with the Windows API with the intent of
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
index 93f1e200e5..4b81f3c0e7 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
@@ -46,17 +46,21 @@ Detects PowerShell scripts that can get the contents of the clipboard, which att
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell Suspicious Script with Clipboard Retrieval Capabilities
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Suspicious Script with Clipboard Retrieval Capabilities*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
 Attackers can abuse PowerShell capabilities to get the contents of the clipboard with the goal of stealing credentials and other valuable information, such as credit card data and confidential conversations.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -67,15 +71,21 @@ Attackers can abuse PowerShell capabilities to get the contents of the clipboard
 - Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
 - Assess network data to determine if the host communicated with the exfiltration server.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Regular users are unlikely to use scripting utilities to capture contents of the clipboard, making false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
 
-### Related rules
+
+*Related rules*
+
 
 - PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -87,7 +97,27 @@ Attackers can abuse PowerShell capabilities to get the contents of the clipboard
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-screenshot-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-screenshot-capabilities.asciidoc
index 934c4ceaa2..fd81b1989c 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-screenshot-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-screenshot-capabilities.asciidoc
@@ -45,17 +45,21 @@ Detects PowerShell scripts that can take screenshots, which is a common feature
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PowerShell Suspicious Script with Screenshot Capabilities
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Suspicious Script with Screenshot Capabilities*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, which makes it available for use in various environments and creates an attractive way for attackers to execute code.
 
 Attackers can abuse PowerShell capabilities and take screen captures of desktops to gather information over the course of an operation.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -66,15 +70,21 @@ Attackers can abuse PowerShell capabilities and take screen captures of desktops
 - Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
 - Assess network data to determine if the host communicated with the exfiltration server.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Regular users do not have a business justification for using scripting utilities to take screenshots, which makes false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
 
-### Related rules
+
+*Related rules*
+
 
 - PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -85,7 +95,27 @@ Attackers can abuse PowerShell capabilities and take screen captures of desktops
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-cap-chown-cap-fowner-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-cap-chown-cap-fowner-capabilities.asciidoc
index d7074b03a4..ab7e612c8e 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-cap-chown-cap-fowner-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-cap-chown-cap-fowner-capabilities.asciidoc
@@ -25,13 +25,14 @@ Identifies instances where a processes (granted CAP_CHOWN and/or CAP_FOWNER capa
 
 *Tags*: 
 
+* Data Source: Auditd Manager
 * Domain: Endpoint
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Privilege Escalation
 * Data Source: Elastic Defend
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -40,6 +41,41 @@ Identifies instances where a processes (granted CAP_CHOWN and/or CAP_FOWNER capa
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Auditd Manager.
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule the following additional audit rules are required to be added to the integration:
+  -- "-w /etc/ -p rwxa -k audit_recursive_etc"
+  -- "-w /root/ -p rwxa -k audit_root"
+
+
+
 ==== Rule query
 
 
@@ -49,14 +85,14 @@ sequence by host.id, process.pid with maxspan=1s
   [process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and
    process.name != null and process.thread.capabilities.effective : ("CAP_CHOWN", "CAP_FOWNER") and
    process.command_line : ("*sudoers*", "*passwd*", "*shadow*", "*/root/*") and user.id != "0"]
-  [file where event.dataset == "auditd_manager.auditd" and host.os.type == "linux" and
-   event.action == "changed-file-ownership-of" and event.type == "change" and event.outcome == "success" and
-   file.path in (
+  [file where host.os.type == "linux" and event.action == "changed-file-ownership-of" and event.type == "change" and
+   event.outcome == "success" and file.path in (
      "/etc/passwd",
      "/etc/shadow",
      "/etc/sudoers",
      "/root/.ssh/*"
-   ) and user.id != "0"]
+   ) and user.id != "0"
+  ]
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-cap-setuid-setgid-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-cap-setuid-setgid-capabilities.asciidoc
index d3b2742f49..f9f9bdb661 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-cap-setuid-setgid-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-cap-setuid-setgid-capabilities.asciidoc
@@ -38,6 +38,41 @@ Identifies instances where a process (granted CAP_SETUID and/or CAP_SETGID capab
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-gdb-cap-sys-ptrace.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-gdb-cap-sys-ptrace.asciidoc
index d4936fa642..c795283336 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-gdb-cap-sys-ptrace.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-gdb-cap-sys-ptrace.asciidoc
@@ -38,6 +38,41 @@ Identifies instances where GDB (granted the CAP_SYS_PTRACE capability) is execut
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
index db8ea324f7..041fe16036 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
@@ -51,20 +51,24 @@ Identifies a privilege escalation attempt via named pipe impersonation. An adver
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Privilege Escalation via Named Pipe Impersonation
+*Triage and analysis*
+
+
+
+*Investigating Privilege Escalation via Named Pipe Impersonation*
+
 
 A named pipe is a type of inter-process communication (IPC) mechanism used in operating systems like Windows, which allows two or more processes to communicate with each other by sending and receiving data through a well-known point.
 
 Attackers can abuse named pipes to elevate their privileges by impersonating the security context in which they execute code. Metasploit, for example, creates a service and a random pipe, and then uses the service to connect to the pipe and impersonate the service security context, which is SYSTEM.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -84,11 +88,15 @@ Attackers can abuse named pipes to elevate their privileges by impersonating the
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -104,7 +112,17 @@ Attackers can abuse named pipes to elevate their privileges by impersonating the
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-rogue-named-pipe-impersonation.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-rogue-named-pipe-impersonation.asciidoc
index 40f5d8450f..e2f5a48edc 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-rogue-named-pipe-impersonation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-rogue-named-pipe-impersonation.asciidoc
@@ -43,6 +43,20 @@ Identifies a privilege escalation attempt via rogue named pipe impersonation. An
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+Named Pipe Creation Events need to be enabled within the Sysmon configuration by including the following settings:
+`condition equal "contains" and keyword equal "pipe"`
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-root-crontab-file-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-root-crontab-file-modification.asciidoc
index 7c60c25b08..4b2cc42eb6 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-root-crontab-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-root-crontab-file-modification.asciidoc
@@ -41,6 +41,41 @@ Identifies modifications to the root crontab file. Adversaries may overwrite thi
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc b/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
index 8e7312530b..d107c87143 100644
--- a/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
@@ -45,20 +45,24 @@ Identifies multiple consecutive logon failures targeting an Admin account from t
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Privileged Account Brute Force
+*Triage and analysis*
+
+
+
+*Investigating Privileged Account Brute Force*
+
 
-Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to guess the password using a repetitive or iterative mechanism systematically. More details can be found [here](https://attack.mitre.org/techniques/T1110/001/).
+Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to guess the password using a repetitive or iterative mechanism systematically. More details can be found https://attack.mitre.org/techniques/T1110/001/[here].
 
 This rule identifies potential password guessing/brute force activity from a single address against an account that contains the `admin` pattern on its name, which is likely a highly privileged account.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the logon failure reason code and the targeted user name.
   - Prioritize the investigation if the account is critical or has administrative privileges over the domain.
@@ -79,14 +83,18 @@ This rule identifies potential password guessing/brute force activity from a sin
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the host which is the source of this activity.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Authentication misconfiguration or obsolete credentials.
 - Service account password expired.
 - Domain trust relationship issues.
 - Infrastructure or availability issues.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the source host to prevent further post-compromise behavior.
@@ -97,7 +105,17 @@ This rule identifies potential password guessing/brute force activity from a sin
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
index b1af5f89fb..39f4a12989 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
@@ -46,20 +46,24 @@ Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTM
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Process Activity via Compiled HTML File
+*Triage and analysis*
+
+
+
+*Investigating Process Activity via Compiled HTML File*
+
 
 CHM (Compiled HTML) files are a format for delivering online help files on Windows. CHM files are compressed compilations of various content, such as HTML documents, images, and scripting/web-related programming languages such as VBA, JScript, Java, and ActiveX.
 
 When users double-click CHM files, the HTML Help executable program (`hh.exe`) will execute them. `hh.exe` also can be used to execute code embedded in those files, PowerShell scripts, and executables. This makes it useful for attackers not only to proxy the execution of malicious payloads via a signed binary that could bypass security controls, but also to gain initial access to environments via social engineering methods.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -82,11 +86,15 @@ When users double-click CHM files, the HTML Help executable program (`hh.exe`) w
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -106,7 +114,17 @@ When users double-click CHM files, the HTML Help executable program (`hh.exe`) w
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-capability-enumeration.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-capability-enumeration.asciidoc
index f02ecd29ab..3fb0a853b5 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-capability-enumeration.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-capability-enumeration.asciidoc
@@ -38,6 +38,41 @@ Identifies recursive process capability enumeration of the entire filesystem thr
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-created-with-a-duplicated-token.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-created-with-a-duplicated-token.asciidoc
index f4fbce91b6..f87183a3c8 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-created-with-a-duplicated-token.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-created-with-a-duplicated-token.asciidoc
@@ -31,7 +31,7 @@ Identifies the creation of a process impersonating the token of another user log
 * Tactic: Privilege Escalation
 * Data Source: Elastic Defend
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -66,7 +66,12 @@ process where host.os.type == "windows" and event.action == "start" and
       process.command_line : ("*davclnt.dll,DavSetCookie*", "*?:\\Program Files*",
                               "*\\Windows\\System32\\winethc.dll*", "*\\Windows\\SYSTEM32\\EDGEHTML.dll*",
                               "*shell32.dll,SHCreateLocalServerRunDll*")) and
- not startswith~(process.Ext.effective_parent.name, process.parent.name)
+ not startswith~(process.Ext.effective_parent.name, process.parent.name) and 
+ not (process.name : "powershell.exe" and process.parent.name : "wmiprvse.exe" and process.Ext.effective_parent.executable : "?:\\Windows\\System32\\wsmprovhost.exe") and 
+ not (process.Ext.effective_parent.executable : "?:\\Windows\\System32\\RuntimeBroker.exe" and process.parent.executable : "?:\\Windows\\System32\\sihost.exe") and 
+ not (process.Ext.effective_parent.executable : "?:\\Windows\\System32\\sethc.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and 
+ not (process.Ext.effective_parent.executable : "?:\\Windows\\explorer.exe" and 
+      process.parent.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\msiexec.exe", "?:\\Windows\\twain_32\\*.exe"))
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-creation-via-secondary-logon.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-creation-via-secondary-logon.asciidoc
index 27ab953118..adce87f2c1 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-creation-via-secondary-logon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-creation-via-secondary-logon.asciidoc
@@ -41,6 +41,19 @@ Identifies process creation with alternate credentials. Adversaries may create a
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+Audit events 4624 and 4688 are needed to trigger this rule.
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc
index 625e28e4d2..beda64b061 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc
@@ -45,18 +45,22 @@ Identifies process execution from suspicious default Windows directories. This i
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Process Execution from an Unusual Directory
+*Triage and analysis*
+
+
+
+*Investigating Process Execution from an Unusual Directory*
+
 
 This rule identifies processes that are executed from suspicious default Windows directories. Adversaries may abuse this technique by planting malware in trusted paths, making it difficult for security analysts to discern if their activities are malicious or take advantage of exceptions that may apply to these paths.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes, examining their executable files for prevalence, location, and valid digital signatures.
 - Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
@@ -78,16 +82,22 @@ This rule identifies processes that are executed from suspicious default Windows
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of executable and signature conditions.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Unusual Windows Path Activity - 445a342e-03fb-42d0-8656-0367eb2dead5
 - Execution from Unusual Directory - Command Line - cff92c41-2225-4763-b4ce-6f71e5bda5e6
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -102,7 +112,17 @@ This rule identifies processes that are executed from suspicious default Windows
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-started-from-process-id-pid-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-started-from-process-id-pid-file.asciidoc
index dd588fad25..87e6eee13a 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-started-from-process-id-pid-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-started-from-process-id-pid-file.asciidoc
@@ -49,18 +49,54 @@ Identifies a new process starting from a process ID (PID), lock or reboot file w
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Process Started from Process ID (PID) File
+*Triage and analysis*
+
+
+
+*Investigating Process Started from Process ID (PID) File*
+
 Detection alerts from this rule indicate a process spawned from an executable masqueraded as a legitimate PID file which is very unusual and should not occur. Here are some possible avenues of investigation:
 - Examine parent and child process relationships of the new process to determine if other processes are running.
 - Examine the /var/run directory using Osquery to determine other potential PID files with unsually large file sizes, indicative of it being an executable: "SELECT f.size, f.uid, f.type, f.path from file f WHERE path like '/var/run/%%';"
 - Examine the reputation of the SHA256 hash from the PID file in a database like VirusTotal to identify additional pivots and artifacts for investigation.
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
index 73fe43a1d1..895ace0cce 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
@@ -44,18 +44,22 @@ Identifies a process termination event quickly followed by the deletion of its e
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Process Termination followed by Deletion
+*Triage and analysis*
+
+
+
+*Investigating Process Termination followed by Deletion*
+
 
 This rule identifies an unsigned process termination event quickly followed by the deletion of its executable file. Attackers can delete programs after their execution in an attempt to cover their tracks in a host.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -76,11 +80,15 @@ This rule identifies an unsigned process termination event quickly followed by t
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately, as programs that exhibit this behavior, such as installers and similar utilities, should be signed. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -94,7 +102,6 @@ This rule identifies an unsigned process termination event quickly followed by t
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc
index 69a69b43e7..1c30a1a5bd 100644
--- a/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc
@@ -42,6 +42,17 @@ Identifies execution from a directory masquerading as the Windows Program Files
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/prompt-for-credentials-with-osascript.asciidoc b/docs/detections/prebuilt-rules/rule-details/prompt-for-credentials-with-osascript.asciidoc
index c949d35951..81970c17a7 100644
--- a/docs/detections/prebuilt-rules/rule-details/prompt-for-credentials-with-osascript.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/prompt-for-credentials-with-osascript.asciidoc
@@ -41,6 +41,41 @@ Identifies the use of osascript to execute scripts via standard input that may p
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/proxychains-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/proxychains-activity.asciidoc
index 23e2b07dc9..e09fbe2314 100644
--- a/docs/detections/prebuilt-rules/rule-details/proxychains-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/proxychains-activity.asciidoc
@@ -44,21 +44,25 @@ This rule monitors for the execution of the ProxyChains utility. ProxyChains is
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating ProxyChains Activity
+*Triage and analysis*
+
+
+
+*Investigating ProxyChains Activity*
+
 
 Attackers can leverage `proxychains` to obfuscate their origin and bypass network defenses by routing their malicious traffic through multiple intermediary servers.
 
 This rule looks for processes spawned through `proxychains` by analyzing `proxychains` process execution.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify any signs of suspicious network activity or anomalies that may indicate network obfuscation. This could include unexpected traffic patterns or unusual network behavior.
   - Investigate listening ports and open sockets to look for potential protocol tunneling, reverse shells, or data exfiltration.
@@ -80,7 +84,9 @@ This rule looks for processes spawned through `proxychains` by analyzing `proxyc
           - Check the reputation of the domain or IP address.
         - File access, modification, and creation activities.
 
-### Related rules
+
+*Related rules*
+
 
 - Suspicious Utility Launched via ProxyChains - 6ace94ba-f02c-4d55-9f53-87d99b6f9af4
 - Potential Protocol Tunneling via Chisel Client - 3f12325a-4cc6-410b-8d4c-9fbbeb744cfd
@@ -88,13 +94,17 @@ This rule looks for processes spawned through `proxychains` by analyzing `proxyc
 - Potential Linux Tunneling and/or Port Forwarding - 6ee947e9-de7e-4281-a55d-09289bdf947e
 - Potential Protocol Tunneling via EarthWorm - 9f1c4ca3-44b5-481d-ba42-32dc215a2769
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator or developer who uses this utility for benign purposes, consider adding exceptions for specific user accounts or hosts. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -109,7 +119,6 @@ This rule looks for processes spawned through `proxychains` by analyzing `proxyc
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/psexec-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/psexec-network-connection.asciidoc
index 41d92290cf..dac57c4ede 100644
--- a/docs/detections/prebuilt-rules/rule-details/psexec-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/psexec-network-connection.asciidoc
@@ -45,17 +45,21 @@ Identifies use of the SysInternals tool PsExec.exe making a network connection.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating PsExec Network Connection
+*Triage and analysis*
+
+
+
+*Investigating PsExec Network Connection*
+
 
 PsExec is a remote administration tool that enables the execution of commands with both regular and SYSTEM privileges on Windows systems. Microsoft develops it as part of the Sysinternals Suite. Although commonly used by administrators, PsExec is frequently used by attackers to enable lateral movement and execute commands as SYSTEM to disable defenses and bypass security protections.
 
 This rule identifies PsExec execution by looking for the creation of `PsExec.exe`, the default name for the utility, followed by a network connection done by the process.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Check if the usage of this tool complies with the organization's administration policy.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -64,11 +68,15 @@ This rule identifies PsExec execution by looking for the creation of `PsExec.exe
 - Identify the target computer and its role in the IT environment.
 - Investigate what commands were run, and assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. As long as the analyst did not identify suspicious activity related to the user or involved hosts, and the tool is allowed by the organization's policy, such alerts can be dismissed.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
   - Prioritize cases involving critical servers and users.
@@ -79,7 +87,6 @@ This rule identifies PsExec execution by looking for the creation of `PsExec.exe
 - Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/python-script-execution-via-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/python-script-execution-via-command-line.asciidoc
index 5ecdfcaade..167b12117d 100644
--- a/docs/detections/prebuilt-rules/rule-details/python-script-execution-via-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/python-script-execution-via-command-line.asciidoc
@@ -41,6 +41,17 @@ Identifies when a Python script is executed using command line input and imports
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/rare-aws-error-code.asciidoc b/docs/detections/prebuilt-rules/rule-details/rare-aws-error-code.asciidoc
index 967e0e6785..fded439e4e 100644
--- a/docs/detections/prebuilt-rules/rule-details/rare-aws-error-code.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/rare-aws-error-code.asciidoc
@@ -42,11 +42,13 @@ A machine learning job detected an unusual error in a CloudTrail message. These
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Rare AWS Error Code
+*Triage and analysis*
+
+
+
+*Investigating Rare AWS Error Code*
+
 
 CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.
 
@@ -54,7 +56,9 @@ This rule uses a machine learning job to detect an unusual error in a CloudTrail
 
 Detection alerts from this rule indicate a rare and unusual error code that was associated with the response to an AWS API command or method call.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the history of the error. If the error only manifested recently, it might be related to recent changes in an automation module or script. You can find the error in the `aws.cloudtrail.error_code field` field.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -69,19 +73,25 @@ Detection alerts from this rule indicate a rare and unusual error code that was
 - Contact the account owner and confirm whether they are aware of this activity if suspicious.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
 - The adoption of new services or the addition of new functionality to scripts may generate false positives.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Unusual City For an AWS Command - 809b70d3-e2c3-455e-af1b-2626a5a1a276
 - Unusual Country For an AWS Command - dca28dee-c999-400f-b640-50a081cc0fd1
 - Unusual AWS Command for a User - ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1
 - Spike in AWS Error Messages - 78d3d8d9-b476-451d-a9e0-7a5addd70670
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -95,8 +105,12 @@ Detection alerts from this rule indicate a rare and unusual error code that was
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
diff --git a/docs/detections/prebuilt-rules/rule-details/rare-user-logon.asciidoc b/docs/detections/prebuilt-rules/rule-details/rare-user-logon.asciidoc
index cb491593ce..33ed485149 100644
--- a/docs/detections/prebuilt-rules/rule-details/rare-user-logon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/rare-user-logon.asciidoc
@@ -42,32 +42,39 @@ A machine learning job found an unusual user name in the authentication logs. An
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Rare User Logon
+*Triage and analysis*
+
+
+
+*Investigating Rare User Logon*
+
 
 This rule uses a machine learning job to detect an unusual user name in authentication logs, which could detect new accounts created for persistence.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Check if the user was newly created and if the company policies were followed.
   - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the involved users during the past 48 hours.
 - Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Accounts that are used for specific purposes — and therefore not normally active — may trigger the alert.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/rdp-enabled-via-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/rdp-enabled-via-registry.asciidoc
index a93db02014..5203719ccf 100644
--- a/docs/detections/prebuilt-rules/rule-details/rdp-enabled-via-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/rdp-enabled-via-registry.asciidoc
@@ -47,11 +47,13 @@ Identifies registry write modifications to enable Remote Desktop Protocol (RDP)
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating RDP Enabled via Registry
+*Triage and analysis*
+
+
+
+*Investigating RDP Enabled via Registry*
+
 
 Microsoft Remote Desktop Protocol (RDP) is a proprietary Microsoft protocol that enables remote connections to other computers, typically over TCP port 3389.
 
@@ -59,7 +61,9 @@ Attackers can use RDP to conduct their actions interactively. Ransomware operato
 
 This rule detects modification of the fDenyTSConnections registry key to the value `0`, which specifies that remote desktop connections are enabled. Attackers can abuse remote registry, use psexec, etc., to enable RDP and move laterally.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the user to check if they are aware of the operation.
@@ -70,11 +74,15 @@ This rule detects modification of the fDenyTSConnections registry key to the val
 - Check whether privileged accounts accessed the host shortly after the modification.
 - Review network events within a short timespan of this alert for incoming RDP connection attempts.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Check whether the user should be performing this kind of activity, whether they are aware of it, whether RDP should be open, and whether the action exposes the environment to unnecessary risks.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - If RDP is needed, make sure to secure it using firewall rules:
@@ -86,7 +94,17 @@ This rule detects modification of the fDenyTSConnections registry key to the val
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appcert-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appcert-dll.asciidoc
index 1795194677..c3765670f0 100644
--- a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appcert-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appcert-dll.asciidoc
@@ -43,6 +43,17 @@ Detects attempts to maintain persistence by creating registry keys using AppCert
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
index 6a5e97f0df..8a731592c3 100644
--- a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
@@ -47,11 +47,13 @@ AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every proces
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Registry Persistence via AppInit DLL
+*Triage and analysis*
+
+
+
+*Investigating Registry Persistence via AppInit DLL*
+
 
 AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every process that creates a user interface (loads `user32.dll`) on Microsoft Windows operating systems. The AppInit DLL mechanism is used to load custom code into user-mode processes, allowing for the customization of the user interface and the behavior of Windows-based applications.
 
@@ -60,9 +62,11 @@ Attackers who add those DLLs to the registry locations can execute code with ele
 This rule identifies modifications on the AppInit registry keys.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Review the source process and related DLL file tied to the Windows Registry entry.
@@ -84,11 +88,15 @@ This rule identifies modifications on the AppInit registry keys.
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -103,7 +111,17 @@ This rule identifies modifications on the AppInit registry keys.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc
index 0179b656f0..401dc407d1 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc
@@ -47,11 +47,13 @@ Identifies use of the network shell utility (netsh.exe) to enable inbound Remote
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Remote Desktop Enabled in Windows Firewall by Netsh
+*Triage and analysis*
+
+
+
+*Investigating Remote Desktop Enabled in Windows Firewall by Netsh*
+
 
 Microsoft Remote Desktop Protocol (RDP) is a proprietary Microsoft protocol that enables remote connections to other computers, typically over TCP port 3389.
 
@@ -59,7 +61,9 @@ Attackers can use RDP to conduct their actions interactively. Ransomware operato
 
 This rule detects the creation of a Windows Firewall inbound rule that would allow inbound RDP traffic using the `netsh.exe` utility.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the user to check if they are aware of the operation.
@@ -70,11 +74,15 @@ This rule detects the creation of a Windows Firewall inbound rule that would all
 - Check whether privileged accounts accessed the host shortly after the modification.
 - Review network events within a short timespan of this alert for incoming RDP connection attempts.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - The `netsh.exe` utility can be used legitimately. Check whether the user should be performing this kind of activity, whether the user is aware of it, whether RDP should be open, and whether the action exposes the environment to unnecessary risks.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - If RDP is needed, make sure to secure it:
@@ -86,7 +94,17 @@ This rule detects the creation of a Windows Firewall inbound rule that would all
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
index 782cd35c79..b745e65df7 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
@@ -45,18 +45,22 @@ Identifies the execution of a file that was created by the virtual system proces
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Remote Execution via File Shares
+*Triage and analysis*
+
+
+
+*Investigating Remote Execution via File Shares*
+
 
 Adversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These tools can include discovery utilities, credential dumpers, malware, etc.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Review adjacent login events (e.g., 4624) in the alert timeframe to identify the account used to perform this action.
@@ -76,11 +80,15 @@ Adversaries can use network shares to host tooling to support the compromise of
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity can happen legitimately. Consider adding exceptions if it is expected and noisy in your environment.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -95,7 +103,6 @@ Adversaries can use network shares to host tooling to support the compromise of
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-to-a-hidden-share.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-to-a-hidden-share.asciidoc
index e473e18c79..3bfce1a836 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-to-a-hidden-share.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-to-a-hidden-share.asciidoc
@@ -42,6 +42,17 @@ Identifies a remote file copy attempt to a hidden network share. This may indica
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
index d1d1984118..18761929dd 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
@@ -48,20 +48,24 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Remote File Copy via TeamViewer
+*Triage and analysis*
+
+
+
+*Investigating Remote File Copy via TeamViewer*
+
 
 Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse legitimate utilities to drop these files.
 
 TeamViewer is a remote access and remote control tool used by helpdesks and system administrators to perform various support activities. It is also frequently used by attackers and scammers to deploy malware interactively and other malicious activities. This rule looks for the TeamViewer process creating files with suspicious extensions.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Contact the user to gather information about who and why was conducting the remote access.
@@ -82,11 +86,15 @@ TeamViewer is a remote access and remote control tool used by helpdesks and syst
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Analysts can dismiss the alert if the company relies on TeamViewer to conduct remote access and the triage has not identified suspicious or malicious files.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -102,7 +110,17 @@ TeamViewer is a remote access and remote control tool used by helpdesks and syst
 
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
index f63de4f3a6..ca2c63822a 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
@@ -49,21 +49,25 @@ Identifies the desktopimgdownldr utility being used to download a remote file. A
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Remote File Download via Desktopimgdownldr Utility
+*Triage and analysis*
+
+
+
+*Investigating Remote File Download via Desktopimgdownldr Utility*
+
 
 Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse signed utilities to drop these files.
 
 The `Desktopimgdownldr.exe` utility is used to to configure lockscreen/desktop image, and can be abused with the `lockscreenurl` argument to download remote files and tools, this rule looks for this behavior.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses the {security-guide}/security/master/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -89,12 +93,16 @@ The `Desktopimgdownldr.exe` utility is used to to configure lockscreen/desktop i
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unusual but can be done by administrators. Benign true positives (B-TPs) can be added as exceptions if necessary.
 - Analysts can dismiss the alert if the downloaded file is a legitimate image.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -111,7 +119,17 @@ The `Desktopimgdownldr.exe` utility is used to to configure lockscreen/desktop i
 
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
index 0dacdfb8e4..b4d2521f28 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
@@ -50,21 +50,25 @@ Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Remote File Download via MpCmdRun
+*Triage and analysis*
+
+
+
+*Investigating Remote File Download via MpCmdRun*
+
 
 Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse signed utilities to drop these files.
 
 The `MpCmdRun.exe` is a command-line tool part of Windows Defender and is used to manage various Microsoft Windows Defender Antivirus settings and perform certain tasks. It can also be abused by attackers to download remote files, including malware and offensive tooling. This rule looks for the patterns used to perform downloads using the utility.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses the {security-guide}/security/master/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -89,11 +93,15 @@ The `MpCmdRun.exe` is a command-line tool part of Windows Defender and is used t
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -109,7 +117,17 @@ The `MpCmdRun.exe` is a command-line tool part of Windows Defender and is used t
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
index 0826d11221..c6c406a9cc 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
@@ -42,21 +42,25 @@ Identifies powershell.exe being used to download an executable file from an untr
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Remote File Download via PowerShell
+*Triage and analysis*
+
+
+
+*Investigating Remote File Download via PowerShell*
+
 
 Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse signed utilities to drop these files.
 
 PowerShell is one of system administrators' main tools for automation, report routines, and other tasks. This makes it available for use in various environments and creates an attractive way for attackers to execute code and perform actions. This rule correlates network and file events to detect downloads of executable and script files performed using PowerShell.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses the {security-guide}/security/master/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -81,11 +85,15 @@ PowerShell is one of system administrators' main tools for automation, report ro
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Administrators can use PowerShell legitimately to download executable and script files. Analysts can dismiss the alert if the Administrator is aware of the activity and the triage has not identified suspicious or malicious files.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -100,7 +108,6 @@ PowerShell is one of system administrators' main tools for automation, report ro
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
index b906c4992e..9d1b571fab 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
@@ -45,11 +45,13 @@ Identifies built-in Windows script interpreters (cscript.exe or wscript.exe) bei
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Remote File Download via Script Interpreter
+*Triage and analysis*
+
+
+
+*Investigating Remote File Download via Script Interpreter*
+
 
 The Windows Script Host (WSH) is a Windows automation technology, which is ideal for non-interactive scripting needs, such as logon scripting, administrative scripting, and machine automation.
 
@@ -58,9 +60,11 @@ Attackers commonly use WSH scripts as their initial access method, acting like d
 This rule looks for DLLs and executables downloaded using `cscript.exe` or `wscript.exe`.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Examine the host for derived artifacts that indicate suspicious activities:
@@ -78,11 +82,15 @@ This rule looks for DLLs and executables downloaded using `cscript.exe` or `wscr
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - The usage of these script engines by regular users is unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -97,7 +105,6 @@ This rule looks for DLLs and executables downloaded using `cscript.exe` or `wscr
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-scheduled-task-creation-via-rpc.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-scheduled-task-creation-via-rpc.asciidoc
index f89d927ea7..c1959fb5ea 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-scheduled-task-creation-via-rpc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-scheduled-task-creation-via-rpc.asciidoc
@@ -42,38 +42,47 @@ Identifies scheduled task creation from a remote source. This could be indicativ
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Remote Scheduled Task Creation
+*Triage and analysis*
+
+
+
+*Investigating Remote Scheduled Task Creation*
+
+
+https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler[Scheduled tasks] are a great mechanism for persistence and program execution. These features can be used remotely for a variety of legitimate reasons, but at the same time used by malware and adversaries. When investigating scheduled tasks that were set up remotely, one of the first steps should be to determine the original intent behind the configuration and to verify if the activity is tied to benign behavior such as software installation or any kind of network administrator work. One objective for these alerts is to understand the configured action within the scheduled task. This is captured within the registry event data for this rule and can be base64 decoded to view the value.
+
 
-[Scheduled tasks](https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler) are a great mechanism for persistence and program execution. These features can be used remotely for a variety of legitimate reasons, but at the same time used by malware and adversaries. When investigating scheduled tasks that were set up remotely, one of the first steps should be to determine the original intent behind the configuration and to verify if the activity is tied to benign behavior such as software installation or any kind of network administrator work. One objective for these alerts is to understand the configured action within the scheduled task. This is captured within the registry event data for this rule and can be base64 decoded to view the value.
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Review the TaskContent value to investigate the task configured action.
 - Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 - Further examination should include review of host-based artifacts and network logs from around when the scheduled task was created, on both the source and target machines.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - There is a high possibility of benign activity tied to the creation of remote scheduled tasks as it is a general feature within Windows and used for legitimate purposes for a wide range of activity. Any kind of context should be found to further understand the source of the activity and determine the intent based on the scheduled task's contents.
 
-### Related rules
+
+*Related rules*
+
 
 - Service Command Lateral Movement - d61cbcf8-1bc1-4cff-85ba-e7b21c5beedc
 - Remotely Started Services via RPC - aa9a274d-6b53-424d-ac5e-cb8ca4251650
 - Remote Scheduled Task Creation - 954ee7c8-5437-49ae-b2d6-2960883898e9
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
 - Remove scheduled task and any other related artifacts.
 - Review privileged account management and user account management settings. Consider implementing group policy object (GPO) policies to further restrict activity, or configuring settings that only allow administrators to create remote scheduled tasks.
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-scheduled-task-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-scheduled-task-creation.asciidoc
index 4ad40300ad..2cf923f0fa 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-scheduled-task-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-scheduled-task-creation.asciidoc
@@ -44,37 +44,46 @@ Identifies remote scheduled task creations on a target host. This could be indic
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Remote Scheduled Task Creation
+*Triage and analysis*
+
+
+
+*Investigating Remote Scheduled Task Creation*
+
+
+https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler[Scheduled tasks] are a great mechanism for persistence and program execution. These features can be used remotely for a variety of legitimate reasons, but at the same time used by malware and adversaries. When investigating scheduled tasks that were set up remotely, one of the first steps should be to determine the original intent behind the configuration and to verify if the activity is tied to benign behavior such as software installation or any kind of network administrator work. One objective for these alerts is to understand the configured action within the scheduled task. This is captured within the registry event data for this rule and can be base64 decoded to view the value.
+
 
-[Scheduled tasks](https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler) are a great mechanism for persistence and program execution. These features can be used remotely for a variety of legitimate reasons, but at the same time used by malware and adversaries. When investigating scheduled tasks that were set up remotely, one of the first steps should be to determine the original intent behind the configuration and to verify if the activity is tied to benign behavior such as software installation or any kind of network administrator work. One objective for these alerts is to understand the configured action within the scheduled task. This is captured within the registry event data for this rule and can be base64 decoded to view the value.
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Review the base64 encoded tasks actions registry value to investigate the task configured action.
 - Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 - Further examination should include review of host-based artifacts and network logs from around when the scheduled task was created, on both the source and target machines.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - There is a high possibility of benign activity tied to the creation of remote scheduled tasks as it is a general feature within Windows and used for legitimate purposes for a wide range of activity. Any kind of context should be found to further understand the source of the activity and determine the intent based on the scheduled task's contents.
 
-### Related rules
+
+*Related rules*
+
 
 - Service Command Lateral Movement - d61cbcf8-1bc1-4cff-85ba-e7b21c5beedc
 - Remotely Started Services via RPC - aa9a274d-6b53-424d-ac5e-cb8ca4251650
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
 - Remove scheduled task and any other related artifacts.
 - Review privileged account management and user account management settings. Consider implementing group policy object (GPO) policies to further restrict activity, or configuring settings that only allow administrators to create remote scheduled tasks.
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-ssh-login-enabled-via-systemsetup-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-ssh-login-enabled-via-systemsetup-command.asciidoc
index ed7103c171..1fe8305f98 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-ssh-login-enabled-via-systemsetup-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-ssh-login-enabled-via-systemsetup-command.asciidoc
@@ -42,6 +42,41 @@ Detects use of the systemsetup command to enable remote SSH Login.
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-system-discovery-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-system-discovery-commands.asciidoc
index 15072162d2..a9d96c6198 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-system-discovery-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-system-discovery-commands.asciidoc
@@ -47,28 +47,36 @@ Discovery of remote system information using built-in commands, which may be use
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Remote System Discovery Commands
+*Triage and analysis*
+
+
+
+*Investigating Remote System Discovery Commands*
+
 
 After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
 This rule looks for the execution of the `arp` or `nbstat` utilities to enumerate remote systems in the environment, which is useful for attackers to identify lateral movement targets.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -78,7 +86,18 @@ This rule looks for the execution of the `arp` or `nbstat` utilities to enumerat
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-xsl-script-execution-via-com.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-xsl-script-execution-via-com.asciidoc
index faafe4c463..7c7d44a069 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-xsl-script-execution-via-com.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-xsl-script-execution-via-com.asciidoc
@@ -28,10 +28,9 @@ Identifies the execution of a hosted XSL script using the Microsoft.XMLDOM COM i
 * Use Case: Threat Detection
 * Tactic: Initial Access
 * Tactic: Defense Evasion
-* Rule Type: BBR
 * Data Source: Elastic Defend
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc b/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
index df1cb08029..f626082bbc 100644
--- a/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
@@ -46,20 +46,24 @@ Identifies remote execution of Windows services over remote procedure call (RPC)
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Remotely Started Services via RPC
+*Triage and analysis*
+
+
+
+*Investigating Remotely Started Services via RPC*
+
 
 The Service Control Manager Remote Protocol is a client/server protocol used for configuring and controlling service programs running on a remote computer. A remote service management session begins with the client initiating the connection request to the server. If the server grants the request, the connection is established. The client can then make multiple requests to modify, query the configuration, or start and stop services on the server by using the same session until the session is terminated.
 
 This rule detects the remote creation or start of a service by correlating a `services.exe` network connection and the spawn of a child process.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Review login events (e.g., 4624) in the alert timeframe to identify the account used to perform this action. Use the `source.address` field to help identify the source system.
 - Review network events from the source system using the source port identified on the alert and try to identify the program used to initiate the action.
@@ -83,11 +87,15 @@ This rule detects the remote creation or start of a service by correlating a `se
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Remote management software like SCCM may trigger this rule. If noisy on your environment, consider adding exceptions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -102,7 +110,6 @@ This rule detects the remote creation or start of a service by correlating a `se
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
index f027095e04..e6d092f3ba 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
@@ -46,11 +46,13 @@ Identifies a suspicious AutoIt process execution. Malware written as an AutoIt s
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Renamed AutoIt Scripts Interpreter
+*Triage and analysis*
+
+
+
+*Investigating Renamed AutoIt Scripts Interpreter*
+
 
 The OriginalFileName attribute of a PE (Portable Executable) file is a metadata field that contains the original name of the executable file when compiled or linked. By using this attribute, analysts can identify renamed instances that attackers can use with the intent of evading detections, application allowlists, and other security protections.
 
@@ -59,9 +61,11 @@ AutoIt is a scripting language and tool for automating tasks on Microsoft Window
 This rule checks for renamed instances of AutoIt, which can indicate an attempt of evading detections, application allowlists, and other security protections.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -80,11 +84,15 @@ This rule checks for renamed instances of AutoIt, which can indicate an attempt
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -99,7 +107,17 @@ This rule checks for renamed instances of AutoIt, which can indicate an attempt
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
index c9458514d2..f906a89902 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
@@ -46,18 +46,22 @@ Identifies the execution of a process with a single character process name, diff
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Renamed Utility Executed with Short Program Name
+*Triage and analysis*
+
+
+
+*Investigating Renamed Utility Executed with Short Program Name*
+
 
 Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -78,11 +82,15 @@ Identifies the execution of a process with a single character process name, diff
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -96,7 +104,6 @@ Identifies the execution of a process with a single character process name, diff
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/root-network-connection-via-gdb-cap-sys-ptrace.asciidoc b/docs/detections/prebuilt-rules/rule-details/root-network-connection-via-gdb-cap-sys-ptrace.asciidoc
index f25e12ef4b..433bc0e82b 100644
--- a/docs/detections/prebuilt-rules/rule-details/root-network-connection-via-gdb-cap-sys-ptrace.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/root-network-connection-via-gdb-cap-sys-ptrace.asciidoc
@@ -40,6 +40,41 @@ Identifies instances where GDB (granted the CAP_SYS_PTRACE capability) is execut
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/rule-details/roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc
index 1f84e41bf6..d03056987a 100644
--- a/docs/detections/prebuilt-rules/rule-details/roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc
@@ -46,12 +46,11 @@ Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the int
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Threat intel
+
+*Threat intel*
+
 
 This activity has been observed in FIN7 campaigns.
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/scheduled-task-created-by-a-windows-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/scheduled-task-created-by-a-windows-script.asciidoc
index 1cfde4618e..5b4f41c2dd 100644
--- a/docs/detections/prebuilt-rules/rule-details/scheduled-task-created-by-a-windows-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/scheduled-task-created-by-a-windows-script.asciidoc
@@ -46,12 +46,11 @@ A scheduled task was created by a Windows script via cscript.exe, wscript.exe or
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
+
+*Triage and analysis*
+
 
 Decode the base64 encoded Tasks Actions registry value to investigate the task's configured action.
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/scheduled-task-execution-at-scale-via-gpo.asciidoc b/docs/detections/prebuilt-rules/rule-details/scheduled-task-execution-at-scale-via-gpo.asciidoc
index fd3efb8377..42bd67a541 100644
--- a/docs/detections/prebuilt-rules/rule-details/scheduled-task-execution-at-scale-via-gpo.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/scheduled-task-execution-at-scale-via-gpo.asciidoc
@@ -52,31 +52,41 @@ Detects the modification of Group Policy Object attributes to execute a schedule
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Scheduled Task Execution at Scale via GPO
+*Triage and analysis*
+
+
+
+*Investigating Scheduled Task Execution at Scale via GPO*
+
 
 Group Policy Objects (GPOs) can be used by attackers to execute scheduled tasks at scale to compromise objects controlled by a given GPO. This is done by changing the contents of the `<GPOPath>\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml` file.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - This attack abuses a legitimate mechanism of Active Directory, so it is important to determine whether the activity is legitimate and the administrator is authorized to perform this operation.
 - Retrieve the contents of the `ScheduledTasks.xml` file, and check the `<Command>` and `<Arguments>` XML tags for any potentially malicious commands or binaries.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Scope which objects may be compromised by retrieving information about which objects are controlled by the GPO.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Verify if the execution is allowed and done under change management, and if the execution is legitimate.
 
-### Related rules
+
+*Related rules*
+
 
 - Group Policy Abuse for Privilege Addition - b9554892-5e0e-424b-83a0-5aef95aa43bf
 - Startup/Logon Script added to Group Policy Object - 16fac1a1-21ee-4ca6-b720-458e3855d046
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - The investigation and containment must be performed in every computer controlled by the GPO, where necessary.
@@ -86,7 +96,39 @@ Group Policy Objects (GPOs) can be used by attackers to execute scheduled tasks
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'Audit Detailed File Share' audit policy must be configured (Success Failure).
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+Object Access >
+Audit Detailed File Share (Success,Failure)
+```
+
+The 'Audit Directory Service Changes' audit policy must be configured (Success Failure).
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success,Failure)
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/scheduled-tasks-at-command-enabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/scheduled-tasks-at-command-enabled.asciidoc
index 7d08304080..3294c8a568 100644
--- a/docs/detections/prebuilt-rules/rule-details/scheduled-tasks-at-command-enabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/scheduled-tasks-at-command-enabled.asciidoc
@@ -45,6 +45,17 @@ Identifies attempts to enable the Windows scheduled tasks AT command via the reg
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/screensaver-plist-file-modified-by-unexpected-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/screensaver-plist-file-modified-by-unexpected-process.asciidoc
index 1859770477..6cca5cfdf0 100644
--- a/docs/detections/prebuilt-rules/rule-details/screensaver-plist-file-modified-by-unexpected-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/screensaver-plist-file-modified-by-unexpected-process.asciidoc
@@ -44,16 +44,50 @@ Identifies when a screensaver plist file is modified by an unexpected process. A
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
+
+*Triage and analysis*
+
 
 - Analyze the plist file modification event to identify whether the change was expected or not
 - Investigate the process that modified the plist file for malicious code or other suspicious behavior
 - Identify if any suspicious or known malicious screensaver (.saver) files were recently written to or modified on the host
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc b/docs/detections/prebuilt-rules/rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc
index 691a95cee3..af66918b67 100644
--- a/docs/detections/prebuilt-rules/rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc
@@ -46,6 +46,17 @@ Windows Credential Manager allows you to create, view, or delete saved credentia
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/security-software-discovery-using-wmic.asciidoc b/docs/detections/prebuilt-rules/rule-details/security-software-discovery-using-wmic.asciidoc
index 98163f544c..f8f6e5dc0e 100644
--- a/docs/detections/prebuilt-rules/rule-details/security-software-discovery-using-wmic.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/security-software-discovery-using-wmic.asciidoc
@@ -47,28 +47,36 @@ Identifies the use of Windows Management Instrumentation Command (WMIC) to disco
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Security Software Discovery using WMIC
+*Triage and analysis*
+
+
+
+*Investigating Security Software Discovery using WMIC*
+
 
 After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
 This rule looks for the execution of the `wmic` utility with arguments compatible to the enumeration of the security software installed on the host. Attackers can use this information to decide whether or not to infect a system, disable protections, use bypasses, etc.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -78,7 +86,18 @@ This rule looks for the execution of the `wmic` utility with arguments compatibl
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/security-software-discovery-via-grep.asciidoc b/docs/detections/prebuilt-rules/rule-details/security-software-discovery-via-grep.asciidoc
index a611299157..d800b9bd42 100644
--- a/docs/detections/prebuilt-rules/rule-details/security-software-discovery-via-grep.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/security-software-discovery-via-grep.asciidoc
@@ -44,17 +44,21 @@ Identifies the use of the grep command to discover known third-party macOS and L
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Security Software Discovery via Grep
+*Triage and analysis*
+
+
+
+*Investigating Security Software Discovery via Grep*
+
 
 After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
 This rule looks for the execution of the `grep` utility with arguments compatible to the enumeration of the security software installed on the host. Attackers can use this information to decide whether or not to infect a system, disable protections, use bypasses, etc.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -63,11 +67,15 @@ This rule looks for the execution of the `grep` utility with arguments compatibl
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
 - Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -77,7 +85,18 @@ This rule looks for the execution of the `grep` utility with arguments compatibl
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sedebugprivilege-enabled-by-a-suspicious-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/sedebugprivilege-enabled-by-a-suspicious-process.asciidoc
index 61aa190986..3627730ff7 100644
--- a/docs/detections/prebuilt-rules/rule-details/sedebugprivilege-enabled-by-a-suspicious-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sedebugprivilege-enabled-by-a-suspicious-process.asciidoc
@@ -42,6 +42,26 @@ Identifies the creation of a process running as SYSTEM and impersonating a Windo
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+Windows Event 4703 logs Token Privileges changes and need to be configured (Enable).
+
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+Detailed Tracking >
+Token Right Adjusted Events (Success)
+```
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/segfault-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/segfault-detected.asciidoc
index 1eb35385ed..a26b42c116 100644
--- a/docs/detections/prebuilt-rules/rule-details/segfault-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/segfault-detected.asciidoc
@@ -38,6 +38,42 @@ Monitors kernel logs for segfault messages. A segfault, or segmentation fault, i
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from one of the following integrations:
+- Filebeat
+
+
+*Filebeat Setup*
+
+
+Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing.
+
+
+*The following steps should be executed in order to add the Filebeat for the Linux System:*
+
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html[helper guide].
+- To run Filebeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html[helper guide].
+- To run Filebeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html[helper guide].
+- For quick start information for Filebeat refer to the https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html[helper guide].
+- For complete Setup and Run Filebeat information refer to the https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html[helper guide].
+
+
+*Rule Specific Setup Note*
+
+
+- This rule requires the Filebeat System Module to be enabled.
+- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions.
+- To run the system module of Filebeat on Linux follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html[helper guide].
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sensitive-files-compression.asciidoc b/docs/detections/prebuilt-rules/rule-details/sensitive-files-compression.asciidoc
index 75fedf6dcb..6c338c0938 100644
--- a/docs/detections/prebuilt-rules/rule-details/sensitive-files-compression.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sensitive-files-compression.asciidoc
@@ -44,6 +44,59 @@ Identifies the use of a compression utility to collect known files containing se
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user.asciidoc
index 332fa564e5..22e4d1dcfd 100644
--- a/docs/detections/prebuilt-rules/rule-details/sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sensitive-privilege-seenabledelegationprivilege-assigned-to-a-user.asciidoc
@@ -52,11 +52,13 @@ Identifies the assignment of the SeEnableDelegationPrivilege sensitive "user rig
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Sensitive Privilege SeEnableDelegationPrivilege assigned to a User
+*Triage and analysis*
+
+
+
+*Investigating Sensitive Privilege SeEnableDelegationPrivilege assigned to a User*
+
 
 Kerberos delegation is an Active Directory feature that allows user and computer accounts to impersonate other accounts, act on their behalf, and use their privileges. Delegation (constrained and unconstrained) can be configured for user and computer objects.
 
@@ -66,21 +68,29 @@ SeEnableDelegationPrivilege is a user right that is controlled within the Local
 
 It is critical to control the assignment of this privilege. A user with this privilege and write access to a computer can control delegation settings, perform the attacks described above, and harvest TGTs from any user that connects to the system.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate how the privilege was assigned to the user and who assigned it.
 - Investigate other potentially malicious activity that was performed by the user that assigned the privileges using the `user.id` and `winlog.activity_id` fields as a filter during the past 48 hours.
 - Investigate other alerts associated with the users/host during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - The SeEnableDelegationPrivilege privilege should not be assigned to users. If this rule is triggered in your environment legitimately, the security team should notify the administrators about the risks of using it.
 
-### Related rules
+
+*Related rules*
+
 
 - KRBTGT Delegation Backdoor - e052c845-48d0-4f46-8a13-7d0aba05df82
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Remove the privilege from the account.
@@ -89,7 +99,24 @@ It is critical to control the assignment of this privilege. A user with this pri
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'Audit Authorization Policy Change' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Windows Settings >
+Security Settings >
+Advanced Audit Policy Configuration >
+Audit Policies >
+Policy Change >
+Audit Authorization Policy Change (Success,Failure)
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
index 8372f2b102..3aaa875a7e 100644
--- a/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
@@ -49,20 +49,24 @@ Identifies Service Control (sc.exe) spawning from script interpreter processes t
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Service Control Spawned via Script Interpreter
+*Triage and analysis*
+
+
+
+*Investigating Service Control Spawned via Script Interpreter*
+
 
 Windows services are background processes that run with SYSTEM privileges and provide specific functionality or support to other applications and system components.
 
 The `sc.exe` command line utility is used to manage and control Windows services on a local or remote computer. Attackers may use `sc.exe` to create, modify, and start services to elevate their privileges from administrator to SYSTEM.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Examine the command line, registry changes events, and Windows events related to service activities (for example, 4697 and/or 7045) for suspicious characteristics.
@@ -76,11 +80,15 @@ The `sc.exe` command line utility is used to manage and control Windows services
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is not inherently malicious if it occurs in isolation. As long as the analyst did not identify suspicious activity related to the user, host, and service, such alerts can be dismissed.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -90,7 +98,6 @@ The `sc.exe` command line utility is used to manage and control Windows services
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/service-disabled-via-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/service-disabled-via-registry-modification.asciidoc
index ed03d38306..25cd3932e8 100644
--- a/docs/detections/prebuilt-rules/rule-details/service-disabled-via-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/service-disabled-via-registry-modification.asciidoc
@@ -32,7 +32,7 @@ Identifies attempts to modify services start settings using processes other than
 * Data Source: Elastic Defend
 * Rule Type: BBR
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -55,6 +55,7 @@ registry where host.os.type == "windows" and event.type == "change" and
     (
       process.name : "services.exe" and user.id : "S-1-5-18"
     )
+  and not registry.path : "HKLM\\SYSTEM\\ControlSet001\\Services\\MrxSmb10\\Start"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/service-path-modification-via-sc-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/service-path-modification-via-sc-exe.asciidoc
index 3a9886f298..810822fb44 100644
--- a/docs/detections/prebuilt-rules/rule-details/service-path-modification-via-sc-exe.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/service-path-modification-via-sc-exe.asciidoc
@@ -32,7 +32,7 @@ Identifies attempts to modify a service path setting using sc.exe. Attackers may
 * Data Source: Elastic Defend
 * Rule Type: BBR
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -46,8 +46,8 @@ Identifies attempts to modify a service path setting using sc.exe. Attackers may
 
 [source, js]
 ----------------------------------
-process where event.type == "start" and
-  process.name : "sc.exe" and process.args : "*binPath*"
+process where event.type == "start" and process.name : "sc.exe" and
+  process.args : "*config*" and process.args : "*binPath*"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/setcap-setuid-setgid-capability-set.asciidoc b/docs/detections/prebuilt-rules/rule-details/setcap-setuid-setgid-capability-set.asciidoc
index bb9b025d94..b7d7e36974 100644
--- a/docs/detections/prebuilt-rules/rule-details/setcap-setuid-setgid-capability-set.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/setcap-setuid-setgid-capability-set.asciidoc
@@ -41,11 +41,13 @@ This rule monitors for the addition of the cap_setuid+ep or cap_setgid+ep capabi
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Setcap setuid/setgid Capability Set
+*Triage and analysis*
+
+
+
+*Investigating Setcap setuid/setgid Capability Set*
+
 
 Setuid (Set User ID) and setgid (Set Group ID) are Unix-like OS features that enable processes to run with elevated privileges, based on the file owner or group.
 
@@ -54,10 +56,12 @@ Threat actors can exploit these attributes to achieve persistence by creating ma
 This rule monitors for the addition of the cap_setuid+ep or cap_setgid+ep capabilities via setcap.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible Investigation Steps*
 
-#### Possible Investigation Steps
 
 - Investigate the file that was targeted by the addition of the setuid/setgid capability through OSQuery.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
@@ -83,13 +87,17 @@ This rule monitors for the addition of the cap_setuid+ep or cap_setgid+ep capabi
 - Investigate whether the user is currently logged in and active.
     - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator that performed these actions for administrative purposes, consider adding exceptions for this specific administrator user account. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -103,7 +111,41 @@ This rule monitors for the addition of the cap_setuid+ep or cap_setgid+ep capabi
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/shared-object-created-or-changed-by-previously-unknown-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/shared-object-created-or-changed-by-previously-unknown-process.asciidoc
index 4a9ed54bbc..590cad05b8 100644
--- a/docs/detections/prebuilt-rules/rule-details/shared-object-created-or-changed-by-previously-unknown-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/shared-object-created-or-changed-by-previously-unknown-process.asciidoc
@@ -45,11 +45,13 @@ This rule monitors the creation of shared object files by previously unknown pro
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Shared Object Created or Changed by Previously Unknown Process
+*Triage and analysis*
+
+
+
+*Investigating Shared Object Created or Changed by Previously Unknown Process*
+
 
 A shared object file is a compiled library file (typically with a .so extension) that can be dynamically linked to executable programs at runtime, allowing for code reuse and efficient memory usage. The creation of a shared object file involves compiling code into a dynamically linked library that can be loaded by other programs at runtime.
 
@@ -58,10 +60,12 @@ Malicious actors can leverage shared object files to execute unauthorized code,
 This rule monitors the creation of shared object files by previously unknown processes through the usage of the new terms rule type.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible Investigation Steps*
 
-#### Possible Investigation Steps
 
 - Investigate the shared object that was created or modified through OSQuery.
   - !{osquery{"label":"Osquery - Retrieve File Listing Information","query":"SELECT * FROM file WHERE path = {{file.path}}\n"}}
@@ -89,13 +93,17 @@ This rule monitors the creation of shared object files by previously unknown pro
 - Investigate whether the user is currently logged in and active.
     - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator that performed these actions for administrative purposes, consider adding exceptions for this specific administrator user account. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -109,7 +117,41 @@ This rule monitors the creation of shared object files by previously unknown pro
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sharepoint-malware-file-upload.asciidoc b/docs/detections/prebuilt-rules/rule-details/sharepoint-malware-file-upload.asciidoc
index fddf0b5c4b..8f24b44d40 100644
--- a/docs/detections/prebuilt-rules/rule-details/sharepoint-malware-file-upload.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sharepoint-malware-file-upload.asciidoc
@@ -42,10 +42,12 @@ Identifies the occurence of files uploaded to SharePoint being detected as Malwa
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/shell-execution-via-apple-scripting.asciidoc b/docs/detections/prebuilt-rules/rule-details/shell-execution-via-apple-scripting.asciidoc
index f9a1e48a38..d555b1b5df 100644
--- a/docs/detections/prebuilt-rules/rule-details/shell-execution-via-apple-scripting.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/shell-execution-via-apple-scripting.asciidoc
@@ -41,6 +41,41 @@ Identifies the execution of the shell process (sh) via scripting (JXA or AppleSc
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/signed-proxy-execution-via-ms-work-folders.asciidoc b/docs/detections/prebuilt-rules/rule-details/signed-proxy-execution-via-ms-work-folders.asciidoc
index 52538acb78..7057cdc762 100644
--- a/docs/detections/prebuilt-rules/rule-details/signed-proxy-execution-via-ms-work-folders.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/signed-proxy-execution-via-ms-work-folders.asciidoc
@@ -50,17 +50,21 @@ Identifies the use of Windows Work Folders to execute a potentially masqueraded
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Signed Proxy Execution via MS Work Folders
+*Triage and analysis*
+
+
+
+*Investigating Signed Proxy Execution via MS Work Folders*
+
 
 Work Folders is a role service for file servers running Windows Server that provides a consistent way for users to access their work files from their PCs and devices. This allows users to store work files and access them from anywhere. When called, Work Folders will automatically execute any Portable Executable (PE) named control.exe as an argument before accessing the synced share.
 
 Using Work Folders to execute a masqueraded control.exe could allow an adversary to bypass application controls and increase privileges.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
     - Examine the location of the WorkFolders.exe binary to determine if it was copied to the location of the control.exe binary. It resides in the System32 directory by default.
@@ -70,11 +74,15 @@ Using Work Folders to execute a masqueraded control.exe could allow an adversary
 - Review how control.exe was originally delivered on the host, such as emailed, downloaded from the web, or written to
 disk from a separate binary.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Windows Work Folders are used legitimately by end users and administrators for file sharing and syncing but not in the instance where a suspicious control.exe is passed as an argument.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -84,7 +92,17 @@ disk from a separate binary.
 - Confirm with the user whether this was expected or not, and reset their password.
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/softwareupdate-preferences-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/softwareupdate-preferences-modification.asciidoc
index cab0bea6b7..9eb6c2c299 100644
--- a/docs/detections/prebuilt-rules/rule-details/softwareupdate-preferences-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/softwareupdate-preferences-modification.asciidoc
@@ -40,6 +40,41 @@ Identifies changes to the SoftwareUpdate preferences using the built-in defaults
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/solarwinds-process-disabling-services-via-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/solarwinds-process-disabling-services-via-registry.asciidoc
index e1c63c49d5..a03c745f80 100644
--- a/docs/detections/prebuilt-rules/rule-details/solarwinds-process-disabling-services-via-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/solarwinds-process-disabling-services-via-registry.asciidoc
@@ -45,6 +45,17 @@ Identifies a SolarWinds binary modifying the start type of a service to be disab
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-aws-error-messages.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-aws-error-messages.asciidoc
index ade88a91ce..74407e3825 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-aws-error-messages.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-aws-error-messages.asciidoc
@@ -42,17 +42,21 @@ A machine learning job detected a significant spike in the rate of a particular
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Spike in AWS Error Messages
+*Triage and analysis*
+
+
+
+*Investigating Spike in AWS Error Messages*
+
 
 CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.
 
 This rule uses a machine learning job to detect a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the history of the error. If the error only manifested recently, it might be related to recent changes in an automation module or script. You can find the error in the `aws.cloudtrail.error_code field` field.
 - Investigate other alerts associated with the user account during the past 48 hours.
@@ -67,19 +71,25 @@ This rule uses a machine learning job to detect a significant spike in the rate
 - Contact the account owner and confirm whether they are aware of this activity if suspicious.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
 - The adoption of new services or the addition of new functionality to scripts may generate false positives.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Unusual City For an AWS Command - 809b70d3-e2c3-455e-af1b-2626a5a1a276
 - Unusual Country For an AWS Command - dca28dee-c999-400f-b640-50a081cc0fd1
 - Unusual AWS Command for a User - ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1
 - Rare AWS Error Code - 19de8096-e2b0-4bd8-80c9-34a820813fff
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -93,8 +103,12 @@ This rule uses a machine learning job to detect a significant spike in the rate
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device-via-airdrop.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device-via-airdrop.asciidoc
index 34a9652d9b..5e47b2f905 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device-via-airdrop.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device-via-airdrop.asciidoc
@@ -39,6 +39,41 @@ A machine learning job has detected high bytes of data written to an external de
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Data Exfiltration Detection integration assets to be installed, as well as network and file events collected by integrations such as Elastic Defend and Network Packet Capture (for network events only).  
+
+
+*Data Exfiltration Detection Setup*
+
+The Data Exfiltration Detection integration detects data exfiltration activity by identifying abnormalities in network and file events. Anomalies are detected using Elastic's Anomaly Detection feature. 
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Data Exfiltration Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- File events collected by the Elastic Defend integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+
+
+*The following steps should be executed to install assets associated with the Data Exfiltration Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Data Exfiltration Detection and select the integration to see more details about it.
+- Under Settings, click Install Data Exfiltration Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Data Exfiltration Detection, you'll need to enable the corresponding Anomaly Detection jobs. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your file events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/ded/kibana/ml_module/ded-ml.json[this] configuration file, you will see a card for Data Exfiltration Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device.asciidoc
index 7fa5f7b2ea..91ce2cb9f9 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device.asciidoc
@@ -39,6 +39,41 @@ A machine learning job has detected high bytes of data written to an external de
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Data Exfiltration Detection integration assets to be installed, as well as network and file events collected by integrations such as Elastic Defend and Network Packet Capture (for network events only).  
+
+
+*Data Exfiltration Detection Setup*
+
+The Data Exfiltration Detection integration detects data exfiltration activity by identifying abnormalities in network and file events. Anomalies are detected using Elastic's Anomaly Detection feature. 
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Data Exfiltration Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- File events collected by the Elastic Defend integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+
+
+*The following steps should be executed to install assets associated with the Data Exfiltration Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Data Exfiltration Detection and select the integration to see more details about it.
+- Under Settings, click Install Data Exfiltration Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Data Exfiltration Detection, you'll need to enable the corresponding Anomaly Detection jobs. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your file events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/ded/kibana/ml_module/ded-ml.json[this] configuration file, you will see a card for Data Exfiltration Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-failed-logon-events.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-failed-logon-events.asciidoc
index ec0c7feb4a..a486334a42 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-failed-logon-events.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-failed-logon-events.asciidoc
@@ -42,15 +42,19 @@ A machine learning job found an unusually large spike in authentication failure
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Spike in Failed Logon Events
+*Triage and analysis*
+
+
+
+*Investigating Spike in Failed Logon Events*
+
 
 This rule uses a machine learning job to detect a substantial spike in failed authentication events. This could indicate attempts to enumerate users, password spraying, brute force, etc.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the users involved and if the activity targets a specific user or a set of users.
 - Check if the authentication comes from different sources.
@@ -62,12 +66,16 @@ This rule uses a machine learning job to detect a substantial spike in failed au
 - If this activity is suspicious, contact the account owner and confirm whether they are aware of it.
 - Investigate whether there are successful authentication events from the involved sources. This could indicate a successful brute force or password spraying attack.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If the account is used in automation tasks, it is possible that they are using expired credentials, causing a spike in authentication failures.
 - Authentication failures can be related to permission issues.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
@@ -75,7 +83,6 @@ This rule uses a machine learning job to detect a substantial spike in failed au
   - If the asset needs to be exposed to the internet, restrict access to remote login services to specific IPs.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-network-traffic-to-a-country.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-network-traffic-to-a-country.asciidoc
index 1cd1d90ced..3f3c06f315 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-network-traffic-to-a-country.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-network-traffic-to-a-country.asciidoc
@@ -39,17 +39,21 @@ A machine learning job detected an unusually large spike in network activity to
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Spike in Network Traffic To a Country
+*Triage and analysis*
+
+
+
+*Investigating Spike in Network Traffic To a Country*
+
 
 Monitoring network traffic for anomalies is a good methodology for uncovering various potentially suspicious activities. For example, data exfiltration or infected machines may communicate with a command-and-control (C2) server in another country your company doesn't have business with.
 
 This rule uses a machine learning job to detect a significant spike in the network traffic to a country, which can indicate reconnaissance or enumeration activities, an infected machine being used as a bot in a DDoS attack, or potentially data exfiltration.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the specifics of the involved assets, such as role, criticality, and associated users.
 - Investigate other alerts associated with the involved assets during the past 48 hours.
@@ -58,11 +62,15 @@ This rule uses a machine learning job to detect a significant spike in the netwo
 - Consider the time of day. If the user is a human (not a program or script), did the activity occurs during working hours?
 - If this activity is suspicious, contact the account owner and confirm whether they are aware of it.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Understand the context of the connections by contacting the asset owners. If this activity is related to a new business process or newly implemented (approved) technology, consider adding exceptions — preferably with a combination of user and source conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -78,4 +86,3 @@ This rule uses a machine learning job to detect a significant spike in the netwo
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-number-of-connections-made-from-a-source-ip.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-number-of-connections-made-from-a-source-ip.asciidoc
index ba4ccd20c9..1576d1bd83 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-number-of-connections-made-from-a-source-ip.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-number-of-connections-made-from-a-source-ip.asciidoc
@@ -40,6 +40,42 @@ A machine learning job has detected a high count of destination IPs establishing
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration.  
+
+
+*Lateral Movement Detection Setup*
+
+The Lateral Movement Detection integration detects lateral movement activity by identifying abnormalities in file and Windows RDP events. Anomalies are detected using Elastic's Anomaly Detection feature.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Lateral Movement Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows RDP process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+
+
+*The following steps should be executed to install assets associated with the Lateral Movement Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Lateral Movement Detection and select the integration to see more details about it.
+- Under Settings, click Install Lateral Movement Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Lateral Movement Detection, you'll need to enable the corresponding Anomaly Detection jobs.
+- Before enabling the Anomaly Detection jobs, confirm that the Pivot Transform asset is installed and actively gathering data in the destination index `ml-rdp-lmd`.
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your transformed RDP process data i.e.`ml-rdp-lmd`.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/lmd/kibana/ml_module/lmd-ml.json[this] configuration file, you will see a card for Lateral Movement Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-number-of-connections-made-to-a-destination-ip.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-number-of-connections-made-to-a-destination-ip.asciidoc
index cce626fb99..784af5c618 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-number-of-connections-made-to-a-destination-ip.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-number-of-connections-made-to-a-destination-ip.asciidoc
@@ -40,6 +40,42 @@ A machine learning job has detected a high count of source IPs establishing an R
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration.  
+
+
+*Lateral Movement Detection Setup*
+
+The Lateral Movement Detection integration detects lateral movement activity by identifying abnormalities in file and Windows RDP events. Anomalies are detected using Elastic's Anomaly Detection feature.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Lateral Movement Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows RDP process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+
+
+*The following steps should be executed to install assets associated with the Lateral Movement Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Lateral Movement Detection and select the integration to see more details about it.
+- Under Settings, click Install Lateral Movement Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Lateral Movement Detection, you'll need to enable the corresponding Anomaly Detection jobs.
+- Before enabling the Anomaly Detection jobs, confirm that the Pivot Transform asset is installed and actively gathering data in the destination index `ml-rdp-lmd`.
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your transformed RDP process data i.e.`ml-rdp-lmd`.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/lmd/kibana/ml_module/lmd-ml.json[this] configuration file, you will see a card for Lateral Movement Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-number-of-processes-in-an-rdp-session.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-number-of-processes-in-an-rdp-session.asciidoc
index a9b050c27c..5525d2f4fb 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-number-of-processes-in-an-rdp-session.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-number-of-processes-in-an-rdp-session.asciidoc
@@ -40,6 +40,42 @@ A machine learning job has detected unusually high number of processes started i
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration.  
+
+
+*Lateral Movement Detection Setup*
+
+The Lateral Movement Detection integration detects lateral movement activity by identifying abnormalities in file and Windows RDP events. Anomalies are detected using Elastic's Anomaly Detection feature.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Lateral Movement Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows RDP process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+
+
+*The following steps should be executed to install assets associated with the Lateral Movement Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Lateral Movement Detection and select the integration to see more details about it.
+- Under Settings, click Install Lateral Movement Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Lateral Movement Detection, you'll need to enable the corresponding Anomaly Detection jobs.
+- Before enabling the Anomaly Detection jobs, confirm that the Pivot Transform asset is installed and actively gathering data in the destination index `ml-rdp-lmd`.
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your transformed RDP process data i.e.`ml-rdp-lmd`.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/lmd/kibana/ml_module/lmd-ml.json[this] configuration file, you will see a card for Lateral Movement Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-remote-file-transfers.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-remote-file-transfers.asciidoc
index 7403064b00..74d2d024c3 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-remote-file-transfers.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-remote-file-transfers.asciidoc
@@ -40,6 +40,41 @@ A machine learning job has detected an abnormal volume of remote files shared on
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration.  
+
+
+*Lateral Movement Detection Setup*
+
+The Lateral Movement Detection integration detects lateral movement activity by identifying abnormalities in file and Windows RDP events. Anomalies are detected using Elastic's Anomaly Detection feature.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Lateral Movement Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- File events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+
+
+*The following steps should be executed to install assets associated with the Lateral Movement Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Lateral Movement Detection and select the integration to see more details about it.
+- Under Settings, click Install Lateral Movement Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Lateral Movement Detection, you'll need to enable the corresponding Anomaly Detection jobs.
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your file events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/lmd/kibana/ml_module/lmd-ml.json[this] configuration file, you will see a card for Lateral Movement Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-successful-logon-events-from-a-source-ip.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-successful-logon-events-from-a-source-ip.asciidoc
index 46928cbf88..50ab860ea3 100644
--- a/docs/detections/prebuilt-rules/rule-details/spike-in-successful-logon-events-from-a-source-ip.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-successful-logon-events-from-a-source-ip.asciidoc
@@ -43,15 +43,19 @@ A machine learning job found an unusually large spike in successful authenticati
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Spike in Successful Logon Events from a Source IP
+*Triage and analysis*
+
+
+
+*Investigating Spike in Successful Logon Events from a Source IP*
+
 
 This rule uses a machine learning job to detect a substantial spike in successful authentication events. This could indicate post-exploitation activities that aim to test which hosts, services, and other resources the attacker can access with the compromised credentials.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the specifics of the involved assets, such as role, criticality, and associated users.
 - Check if the authentication comes from different sources.
@@ -60,17 +64,20 @@ This rule uses a machine learning job to detect a substantial spike in successfu
 - Check whether the involved credentials are used in automation or scheduled tasks.
 - If this activity is suspicious, contact the account owner and confirm whether they are aware of it.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Understand the context of the authentications by contacting the asset owners. If this activity is related to a new business process or newly implemented (approved) technology, consider adding exceptions — preferably with a combination of user and source conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
index b1ebe743fc..afe9d79494 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
@@ -43,20 +43,24 @@ Identifies files written or modified in the startup folder by unsigned processes
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Startup Folder Persistence via Unsigned Process
+*Triage and analysis*
+
+
+
+*Investigating Startup Folder Persistence via Unsigned Process*
+
 
 The Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account logon, without user interaction, providing an excellent way for attackers to maintain persistence.
 
 This rule looks for unsigned processes writing to the Startup folder locations.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -77,16 +81,22 @@ This rule looks for unsigned processes writing to the Startup folder locations.
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - There is a high possibility of benign legitimate programs being added to Startup folders. This activity could be based on new software installations, patches, or any kind of network administrator related activity. Before undertaking further investigation, verify that this activity is not benign.
 
-### Related rules
+
+*Related rules*
+
 
 - Suspicious Startup Shell Folder Modification - c8b150f0-0164-475b-a75e-74b47800a9ff
 - Persistent Scripts in the Startup Directory - f7c4dc5a-a58d-491d-9f14-9b66507121c0
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -101,7 +111,6 @@ This rule looks for unsigned processes writing to the Startup folder locations.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-logon-script-added-to-group-policy-object.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-logon-script-added-to-group-policy-object.asciidoc
index 4d570a324c..4445acc8f7 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-logon-script-added-to-group-policy-object.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-logon-script-added-to-group-policy-object.asciidoc
@@ -49,33 +49,43 @@ Detects the modification of Group Policy Objects (GPO) to add a startup/logon sc
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Startup/Logon Script added to Group Policy Object
+*Triage and analysis*
+
+
+
+*Investigating Startup/Logon Script added to Group Policy Object*
+
 
 Group Policy Objects (GPOs) can be used by attackers to instruct arbitrarily large groups of clients to execute specified commands at startup, logon, shutdown, and logoff. This is done by creating or modifying the `scripts.ini` or `psscripts.ini` files. The scripts are stored in the following paths:
   - `<GPOPath>\Machine\Scripts\`
   - `<GPOPath>\User\Scripts\`
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - This attack abuses a legitimate mechanism of Active Directory, so it is important to determine whether the activity is legitimate and the administrator is authorized to perform this operation.
 - Retrieve the contents of the `ScheduledTasks.xml` file, and check the `<Command>` and `<Arguments>` XML tags for any potentially malicious commands or binaries.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Scope which objects may be compromised by retrieving information about which objects are controlled by the GPO.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Verify if the execution is legitimately authorized and executed under a change management process.
 
-### Related rules
+
+*Related rules*
+
 
 - Group Policy Abuse for Privilege Addition - b9554892-5e0e-424b-83a0-5aef95aa43bf
 - Scheduled Task Execution at Scale via GPO - 15a8ba77-1c13-4274-88fe-6bd14133861e
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - The investigation and containment must be performed in every computer controlled by the GPO, where necessary.
@@ -85,7 +95,39 @@ Group Policy Objects (GPOs) can be used by attackers to instruct arbitrarily lar
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'Audit Detailed File Share' audit policy must be configured (Success Failure).
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+Object Access >
+Audit Detailed File Share (Success,Failure)
+```
+
+The 'Audit Directory Service Changes' audit policy must be configured (Success Failure).
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success,Failure)
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
index 1cc989593e..bdbb9589db 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
@@ -43,18 +43,22 @@ Identifies run key or startup key registry modifications. In order to survive re
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Startup or Run Key Registry Modification
+*Triage and analysis*
+
+
+
+*Investigating Startup or Run Key Registry Modification*
+
 
 Adversaries may achieve persistence by referencing a program with a registry run key. Adding an entry to the run keys in the registry will cause the program referenced to be executed when a user logs in. These programs will executed under the context of the user and will have the account's permissions. This rule looks for this behavior by monitoring a range of registry run keys.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -76,18 +80,24 @@ Adversaries may achieve persistence by referencing a program with a registry run
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - There is a high possibility of benign legitimate programs being added to registry run keys. This activity could be based on new software installations, patches, or any kind of network administrator related activity. Before undertaking further investigation, verify that this activity is not benign.
 
-### Related rules
+
+*Related rules*
+
 
 - Suspicious Startup Shell Folder Modification - c8b150f0-0164-475b-a75e-74b47800a9ff
 - Persistent Scripts in the Startup Directory - f7c4dc5a-a58d-491d-9f14-9b66507121c0
 - Startup Folder Persistence via Unsigned Process - 2fba96c0-ade5-4bce-b92f-a5df2509da3f
 - Startup Persistence by a Suspicious Process - 440e2db4-bc7f-4c96-a068-65b78da59bde
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -102,7 +112,6 @@ Adversaries may achieve persistence by referencing a program with a registry run
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
index ee7ac26219..794fe0e74c 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
@@ -48,20 +48,24 @@ Identifies files written to or modified in the startup folder by commonly abused
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Startup Persistence by a Suspicious Process
+*Triage and analysis*
+
+
+
+*Investigating Startup Persistence by a Suspicious Process*
+
 
 The Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account logon, without user interaction, providing an excellent way for attackers to maintain persistence.
 
 This rule monitors for commonly abused processes writing to the Startup folder locations.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -82,16 +86,22 @@ This rule monitors for commonly abused processes writing to the Startup folder l
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Administrators may add programs to this mechanism via command-line shells. Before the further investigation, verify that this activity is not benign.
 
-### Related rules
+
+*Related rules*
+
 
 - Suspicious Startup Shell Folder Modification - c8b150f0-0164-475b-a75e-74b47800a9ff
 - Persistent Scripts in the Startup Directory - f7c4dc5a-a58d-491d-9f14-9b66507121c0
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -107,7 +117,17 @@ This rule monitors for commonly abused processes writing to the Startup folder l
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/statistical-model-detected-c2-beaconing-activity-with-high-confidence.asciidoc b/docs/detections/prebuilt-rules/rule-details/statistical-model-detected-c2-beaconing-activity-with-high-confidence.asciidoc
index 0d3bd04380..1fe2e344ff 100644
--- a/docs/detections/prebuilt-rules/rule-details/statistical-model-detected-c2-beaconing-activity-with-high-confidence.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/statistical-model-detected-c2-beaconing-activity-with-high-confidence.asciidoc
@@ -40,6 +40,33 @@ A statistical model has identified command-and-control (C2) beaconing activity w
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Network Beaconing Identification integration assets to be installed, as well as network logs collected by the Elastic Defend or Network Packet Capture integrations.
+
+
+*Network Beaconing Identification Setup*
+
+The Network Beaconing Identification integration consists of a statistical framework to identify C2 beaconing activity in network logs.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Network Beaconing Identification.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Network events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] or https://docs.elastic.co/integrations/network_traffic[Network Packet Capture] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To add the Network Packet Capture integration to an Elastic Agent policy, refer to https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the Network Beaconing Identification integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Network Beaconing Identification and select the integration to see more details about it.
+- Under Settings, click "Install Network Beaconing Identification assets" and follow the prompts to install the assets.
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/statistical-model-detected-c2-beaconing-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/statistical-model-detected-c2-beaconing-activity.asciidoc
index 4e8f1c4e69..a108e30869 100644
--- a/docs/detections/prebuilt-rules/rule-details/statistical-model-detected-c2-beaconing-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/statistical-model-detected-c2-beaconing-activity.asciidoc
@@ -40,6 +40,33 @@ A statistical model has identified command-and-control (C2) beaconing activity.
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Network Beaconing Identification integration assets to be installed, as well as network logs collected by the Elastic Defend or Network Packet Capture integrations.
+
+
+*Network Beaconing Identification Setup*
+
+The Network Beaconing Identification integration consists of a statistical framework to identify C2 beaconing activity in network logs.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Network Beaconing Identification.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Network events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] or https://docs.elastic.co/integrations/network_traffic[Network Packet Capture] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To add the Network Packet Capture integration to an Elastic Agent policy, refer to https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the Network Beaconing Identification integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Network Beaconing Identification and select the integration to see more details about it.
+- Under Settings, click "Install Network Beaconing Identification assets" and follow the prompts to install the assets.
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/stolen-credentials-used-to-login-to-okta-account-after-mfa-reset.asciidoc b/docs/detections/prebuilt-rules/rule-details/stolen-credentials-used-to-login-to-okta-account-after-mfa-reset.asciidoc
index 912c9ce620..93049b3cc9 100644
--- a/docs/detections/prebuilt-rules/rule-details/stolen-credentials-used-to-login-to-okta-account-after-mfa-reset.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/stolen-credentials-used-to-login-to-okta-account-after-mfa-reset.asciidoc
@@ -51,27 +51,35 @@ Detects a sequence of suspicious activities on Windows hosts indicative of crede
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Stolen Credentials Used to Login to Okta Account After MFA Reset
+*Triage and analysis*
+
+
+
+*Investigating Stolen Credentials Used to Login to Okta Account After MFA Reset*
+
 
 This rule detects a sequence of suspicious activities on Windows hosts indicative of credential compromise, followed by efforts to undermine multi-factor authentication (MFA) and single sign-on (SSO) mechanisms for an Okta user account.
 
 Typically, adversaries initially extract credentials from targeted endpoints through various means. Subsequently, leveraging social engineering, they may seek to reset the MFA credentials associated with an Okta account, especially in scenarios where Active Directory (AD) services are integrated with Okta. Successfully resetting MFA allows the unauthorized use of stolen credentials to gain access to the compromised Okta account. The attacker can then register their own device for MFA, paving the way for unfettered access to the user's Okta account and any associated SaaS applications. This is particularly alarming if the compromised account has administrative rights, as it could lead to widespread access to organizational resources and configurations.
 
-#### Possible investigation steps:
+
+*Possible investigation steps:*
+
 - Identify the user account associated with the Okta login attempt by examining the `user.name` field.
 - Identify the endpoint for the Credential Access alert for this user by examining the `host.name` and `host.id` fields from the alert document.
 - Cross-examine the Okta user and endpoint user to confirm that they are the same person.
 - Reach out to the user to confirm if they have intentionally reset their MFA credentials recently or asked for help in doing so.
 - If the user is unaware of the MFA reset, incident response may be required immediately to prevent further compromise.
 
-### False positive analysis:
+
+*False positive analysis:*
+
 - A Windows administrator may have triggered a low-fidelity credential access alert during a legitimate administrative action. Following this, the administrator may have reset the MFA credentials for themselves and then logged into the Okta console for AD directory services integration management.
 
-### Response and remediation:
+
+*Response and remediation:*
+
 - If confirmed that the user did not intentionally have their MFA factor reset, deactivate the user account.
 - After deactivation, reset the user's password and MFA factor to regain control of the account.
     - Ensure that all user sessions are stopped during this process.
@@ -80,8 +88,14 @@ Typically, adversaries initially extract credentials from targeted endpoints thr
 - Review Okta system logs to identify any other suspicious activity associated with the user account, such as creation of a backup account.
 - With the device ID captured from the MFA factor reset, search across all Okta logs for any other activity associated with the device ID.
 
-## Setup
-----------------------------------
+
+*Setup*
+
+
+==== Setup
+
+
+The Okta and Elastic Defend fleet integration structured data is required to be compatible with this rule. Directory services integration in Okta with AD synced is also required for this rule to be effective as it relies on triaging `user.name` from Okta and Elastic Defend events.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sublime-plugin-or-application-script-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/sublime-plugin-or-application-script-modification.asciidoc
index 972f258539..7703fdfe07 100644
--- a/docs/detections/prebuilt-rules/rule-details/sublime-plugin-or-application-script-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sublime-plugin-or-application-script-modification.asciidoc
@@ -40,6 +40,41 @@ Adversaries may create or modify the Sublime application plugins or scripts to e
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sudo-command-enumeration-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/sudo-command-enumeration-detected.asciidoc
index 877e3bd91f..6454e93b14 100644
--- a/docs/detections/prebuilt-rules/rule-details/sudo-command-enumeration-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sudo-command-enumeration-detected.asciidoc
@@ -38,6 +38,41 @@ This rule monitors for the usage of the sudo -l command, which is used to list t
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suid-sguid-enumeration-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/suid-sguid-enumeration-detected.asciidoc
index 910b647d52..51f356bc16 100644
--- a/docs/detections/prebuilt-rules/rule-details/suid-sguid-enumeration-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suid-sguid-enumeration-detected.asciidoc
@@ -39,6 +39,41 @@ This rule monitors for the usage of the "find" command in conjunction with SUID
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
index 0584e66168..dc3fcd36b0 100644
--- a/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
@@ -44,22 +44,26 @@ The malware known as SUNBURST targets the SolarWind's Orion business software fo
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating SUNBURST Command and Control Activity
+*Triage and analysis*
+
+
+
+*Investigating SUNBURST Command and Control Activity*
+
 
 SUNBURST is a trojanized version of a digitally signed SolarWinds Orion plugin called SolarWinds.Orion.Core.BusinessLayer.dll. The plugin contains a backdoor that communicates via HTTP to third-party servers. After an initial dormant period of up to two weeks, SUNBURST may retrieve and execute commands that instruct the backdoor to transfer files, execute files, profile the system, reboot the system, and disable system services. The malware's network traffic attempts to blend in with legitimate SolarWinds activity by imitating the Orion Improvement Program (OIP) protocol, and the malware stores persistent state data within legitimate plugin configuration files. The backdoor uses multiple obfuscated blocklists to identify processes, services, and drivers associated with forensic and anti-virus tools.
 
-More details on SUNBURST can be found on the [Mandiant Report](https://www.mandiant.com/resources/sunburst-additional-technical-details).
+More details on SUNBURST can be found on the https://www.mandiant.com/resources/sunburst-additional-technical-details[Mandiant Report].
 
 This rule identifies suspicious network connections that attempt to blend in with legitimate SolarWinds activity by imitating the Orion Improvement Program (OIP) protocol behavior.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Examine the host for derived artifacts that indicate suspicious activities:
@@ -77,11 +81,15 @@ This rule identifies suspicious network connections that attempt to blend in wit
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the environment at risk.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -96,7 +104,6 @@ This rule identifies suspicious network connections that attempt to blend in wit
 - Upgrade SolarWinds systems to the latest version to eradicate the chance of reinfection by abusing the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-activity-reported-by-okta-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-activity-reported-by-okta-user.asciidoc
index 1c94d5f5a7..53e29aa944 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-activity-reported-by-okta-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-activity-reported-by-okta-user.asciidoc
@@ -44,10 +44,12 @@ Detects when a user reports suspicious activity for their Okta account. These ev
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
index eb2d3daf2d..f6b940580a 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
@@ -48,20 +48,24 @@ Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusu
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Antimalware Scan Interface DLL
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Antimalware Scan Interface DLL*
+
 
 The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product on a machine. AMSI integrates with multiple Windows components, ranging from User Account Control (UAC) to VBA macros and PowerShell.
 
 Attackers might copy a rogue AMSI DLL to an unusual location to prevent the process from loading the legitimate module, achieving a bypass to execute malicious code.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify the process that created the DLL and which account was used.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -80,11 +84,15 @@ Attackers might copy a rogue AMSI DLL to an unusual location to prevent the proc
       - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team as these modifications expose the host to malware infections.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -98,7 +106,6 @@ Attackers might copy a rogue AMSI DLL to an unusual location to prevent the proc
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-apt-package-manager-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-apt-package-manager-execution.asciidoc
index 9da5041935..ffaccf27df 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-apt-package-manager-execution.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-apt-package-manager-execution.asciidoc
@@ -40,6 +40,41 @@ Detects suspicious process events executed by the APT package manager, potential
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-apt-package-manager-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-apt-package-manager-network-connection.asciidoc
index 7bd95485db..799db7b642 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-apt-package-manager-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-apt-package-manager-network-connection.asciidoc
@@ -40,6 +40,41 @@ Detects suspicious network events executed by the APT package manager, potential
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-automator-workflows-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-automator-workflows-execution.asciidoc
index eccefc2cc6..f932dfc984 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-automator-workflows-execution.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-automator-workflows-execution.asciidoc
@@ -40,6 +40,41 @@ Identifies the execution of the Automator Workflows process followed by a networ
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-browser-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-browser-child-process.asciidoc
index e3a5ba608e..7558e2eb6e 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-browser-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-browser-child-process.asciidoc
@@ -42,6 +42,41 @@ Identifies the execution of a suspicious browser child process. Adversaries may
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-calendar-file-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-calendar-file-modification.asciidoc
index d72f20f851..1fa87da2c5 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-calendar-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-calendar-file-modification.asciidoc
@@ -42,6 +42,41 @@ Identifies suspicious modifications of the calendar file by an unusual process.
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
index 7b22278e45..259ececba6 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
@@ -53,20 +53,24 @@ Identifies suspicious commands being used with certutil.exe. CertUtil is a nativ
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious CertUtil Commands
+*Triage and analysis*
+
+
+
+*Investigating Suspicious CertUtil Commands*
+
 
 `certutil.exe` is a command line utility program that is included with Microsoft Windows operating systems. It is used to manage and manipulate digital certificates and certificate services on computers running Windows.
 
 Attackers can abuse `certutil.exe` utility to download and/or deobfuscate malware, offensive security tools, and certificates from external sources to take the next steps in a compromised environment. This rule identifies command line arguments used to accomplish these behaviors.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -87,11 +91,15 @@ Attackers can abuse `certutil.exe` utility to download and/or deobfuscate malwar
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -105,7 +113,6 @@ Attackers can abuse `certutil.exe` utility to download and/or deobfuscate malwar
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc
index a56d913eef..0bb1d1a3f7 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-child-process-of-adobe-acrobat-reader-update-service.asciidoc
@@ -41,6 +41,41 @@ Detects attempts to exploit privilege escalation vulnerabilities related to the
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-cmd-execution-via-wmi.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-cmd-execution-via-wmi.asciidoc
index 95ae1e2b60..3215c25637 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-cmd-execution-via-wmi.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-cmd-execution-via-wmi.asciidoc
@@ -43,6 +43,17 @@ Identifies suspicious command execution (cmd) via Windows Management Instrumenta
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-communication-app-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-communication-app-child-process.asciidoc
index 0cf85f0b0d..a486c3515b 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-communication-app-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-communication-app-child-process.asciidoc
@@ -31,7 +31,7 @@ Identifies suspicious child processes of communications apps, which can indicate
 * Rule Type: BBR
 * Data Source: Elastic Defend
 
-*Version*: 2
+*Version*: 3
 
 *Rule authors*: 
 
@@ -55,11 +55,13 @@ process where host.os.type == "windows" and event.type == "start" and
             "?:\\Program Files\\*",
             "?:\\Program Files (x86)\\*",
             "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
-            "?:\\Users\\*\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe",
+            "?:\\Users\\*\\AppData\\Local\\Island\\Island\\Application\\Island.exe",
+            "?:\\Users\\*\\AppData\\Roaming\\Zoom\\bin*\\Zoom.exe",
             "?:\\Windows\\System32\\rundll32.exe",
             "?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
             "?:\\Windows\\System32\\notepad.exe",
-            "?:\\Windows\\System32\\WerFault.exe"
+            "?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe"
           ) and process.code_signature.trusted == true  
         ) or
         (
@@ -102,7 +104,11 @@ process where host.os.type == "windows" and event.type == "start" and
           process.executable : (
             "?:\\Program Files\\*",
             "?:\\Program Files (x86)\\*",
-            "?:\\Windows\\System32\\WerFault.exe"
+            "?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Windows\\BrowserCore\\BrowserCore.exe",
+            "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+            "?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe"
           ) and process.code_signature.trusted == true  
         ) or
         (
@@ -124,9 +130,11 @@ process where host.os.type == "windows" and event.type == "start" and
           process.executable : (
             "?:\\Program Files\\*",
             "?:\\Program Files (x86)\\*",
+            "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
             "?:\\Windows\\System32\\reg.exe",
             "?:\\Windows\\SysWOW64\\reg.exe",
-            "?:\\Windows\\System32\\WerFault.exe"
+            "?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe"
           ) and process.code_signature.trusted == true  
         ) or
         (
@@ -135,9 +143,16 @@ process where host.os.type == "windows" and event.type == "start" and
           ) and process.code_signature.trusted == true
         ) or
         (
-          process.name : "cmd.exe" and process.command_line : (
-            "C:\\WINDOWS\\system32\\cmd.exe /d /s /c \"chcp\"",
-            "C:\\WINDOWS\\system32\\cmd.exe /q /d /s /c \"C:\\Program^ Files\\NVIDIA^ Corporation\\NVSMI\\nvidia-smi.exe\""
+          process.name : "cmd.exe" and 
+          (
+            process.command_line : (
+              "C:\\WINDOWS\\system32\\cmd.exe /d /s /c \"chcp\"",
+              "C:\\WINDOWS\\system32\\cmd.exe /q /d /s /c \"C:\\Program^ Files\\NVIDIA^ Corporation\\NVSMI\\nvidia-smi.exe\""
+            ) or
+            process.args : (
+              "C:\\WINDOWS/System32/nvidia-smi.exe",
+              "C:\\WINDOWS\\System32\\nvidia-smi.exe"
+            )
           )
         )
       )
@@ -176,6 +191,8 @@ process where host.os.type == "windows" and event.type == "start" and
             "?:\\Program Files\\*",
             "?:\\Program Files (x86)\\*",
             "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+            "?:\\Users\\*\\AppData\\Local\\Island\\Island\\Application\\Island.exe",
+            "?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
             "?:\\Windows\\System32\\WerFault.exe"
           ) and process.code_signature.trusted == true  
         ) or
@@ -195,16 +212,25 @@ process where host.os.type == "windows" and event.type == "start" and
             "?:\\Program Files\\*",
             "?:\\Program Files (x86)\\*",
             "?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Windows\\system32\\wermgr.exe",
             "?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe",
             "?:\\Users\\*\\AppData\\Local\\Temp\\NewOutlookInstall\\NewOutlookInstaller.exe",
             "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+            "?:\\Users\\*\\AppData\\Local\\Island\\Island\\Application\\Island.exe",
+            "?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
             "?:\\Users\\*\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe",
             "?:\\Windows\\System32\\IME\\SHARED\\IMEWDBLD.EXE",
             "?:\\Windows\\System32\\spool\\drivers\\x64\\*",
             "?:\\Windows\\System32\\prevhost.exe",
             "?:\\Windows\\System32\\dwwin.exe",
+            "?:\\Windows\\System32\\mspaint.exe",
+            "?:\\Windows\\SysWOW64\\mspaint.exe",
             "?:\\Windows\\System32\\notepad.exe",
-            "?:\\Windows\\explorer.exe"
+            "?:\\Windows\\SysWOW64\\notepad.exe",
+            "?:\\Windows\\System32\\smartscreen.exe",
+            "?:\\Windows\\explorer.exe",
+            "?:\\Windows\\splwow64.exe"
           ) and process.code_signature.trusted == true  
         )
       )
@@ -217,7 +243,8 @@ process where host.os.type == "windows" and event.type == "start" and
           process.executable : (
             "?:\\Program Files\\*",
             "?:\\Program Files (x86)\\*",
-            "?:\\Windows\\System32\\WerFault.exe"
+            "?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\splwow64.exe"
           ) and process.code_signature.trusted == true  
         ) or
         (
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-content-extracted-or-decompressed-via-funzip.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-content-extracted-or-decompressed-via-funzip.asciidoc
index 56f202b268..ebe622a4f5 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-content-extracted-or-decompressed-via-funzip.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-content-extracted-or-decompressed-via-funzip.asciidoc
@@ -42,6 +42,41 @@ Identifies when suspicious content is extracted from a file and subsequently dec
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-crontab-creation-or-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-crontab-creation-or-modification.asciidoc
index b48c3e056a..03a6be15a7 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-crontab-creation-or-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-crontab-creation-or-modification.asciidoc
@@ -41,6 +41,41 @@ Identifies attempts to create or modify a crontab via a process that is not cron
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-data-encryption-via-openssl-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-data-encryption-via-openssl-utility.asciidoc
index 506adfa79a..e85f78f97d 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-data-encryption-via-openssl-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-data-encryption-via-openssl-utility.asciidoc
@@ -32,7 +32,7 @@ Identifies when the openssl command-line utility is used to encrypt multiple fil
 * Tactic: Impact
 * Data Source: Elastic Defend
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -41,6 +41,41 @@ Identifies when the openssl command-line utility is used to encrypt multiple fil
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
index 8838e15e5e..f24fbd97a6 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
@@ -55,15 +55,19 @@ Identifies the loading of a non Microsoft signed DLL that is missing on a defaul
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious DLL Loaded for Persistence or Privilege Escalation
+*Triage and analysis*
+
+
+
+*Investigating Suspicious DLL Loaded for Persistence or Privilege Escalation*
+
 
 Attackers can execute malicious code by abusing missing modules that processes try to load, enabling them to escalate privileges or gain persistence. This rule identifies the loading of a non-Microsoft-signed DLL that is missing on a default Windows installation or one that can be loaded from a different location by a native Windows process.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Examine the DLL signature and identify the process that created it.
   - Investigate any abnormal behaviors by the process such as network connections, registry or file modifications, and any spawned child processes.
@@ -78,11 +82,15 @@ Attackers can execute malicious code by abusing missing modules that processes t
   - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -98,7 +106,17 @@ Attackers can execute malicious code by abusing missing modules that processes t
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-dynamic-linker-discovery-via-od.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-dynamic-linker-discovery-via-od.asciidoc
index ba81288948..338abb09b8 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-dynamic-linker-discovery-via-od.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-dynamic-linker-discovery-via-od.asciidoc
@@ -42,6 +42,41 @@ Monitors for dynamic linker discovery via the od utility. od (octal dump) is a c
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-emond-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-emond-child-process.asciidoc
index d3548d5a56..265dff3a70 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-emond-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-emond-child-process.asciidoc
@@ -40,6 +40,41 @@ Identifies the execution of a suspicious child process of the Event Monitor Daem
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc
index 0bcbbe93d1..e6b2be4ad8 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc
@@ -42,6 +42,17 @@ A suspicious Endpoint Security parent process was detected. This may indicate a
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-a-mounted-device.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-a-mounted-device.asciidoc
index b4335045c1..0c192efe5e 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-a-mounted-device.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-a-mounted-device.asciidoc
@@ -44,6 +44,17 @@ Identifies when a script interpreter or signed binary is launched via a non-stan
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-inet-cache.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-inet-cache.asciidoc
new file mode 100644
index 0000000000..f9b05f668a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-inet-cache.asciidoc
@@ -0,0 +1,82 @@
+[[suspicious-execution-from-inet-cache]]
+=== Suspicious Execution from INET Cache
+
+Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious content via WININET during initial access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Command and Control
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and  
+ process.parent.name : ("explorer.exe", "winrar.exe", "7zFM.exe", "Bandizip.exe") and
+  (process.args : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" or
+   process.executable : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-scheduled-task.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-scheduled-task.asciidoc
index 627a6e72be..ce3e6ed92c 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-scheduled-task.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-scheduled-task.asciidoc
@@ -41,6 +41,17 @@ Identifies execution of a suspicious program via scheduled tasks by looking at p
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-explorer-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-explorer-child-process.asciidoc
index dba3babf23..ab7101d079 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-explorer-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-explorer-child-process.asciidoc
@@ -44,6 +44,17 @@ Identifies a suspicious Windows explorer child process. Explorer.exe can be abus
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-file-changes-activity-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-file-changes-activity-detected.asciidoc
index d595423c9f..274d2acab7 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-file-changes-activity-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-file-changes-activity-detected.asciidoc
@@ -38,6 +38,41 @@ This rule identifies a sequence of 100 file extension rename events within a set
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-file-creation-in-etc-for-persistence.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-file-creation-in-etc-for-persistence.asciidoc
index fcfe8c1e6c..483440cee5 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-file-creation-in-etc-for-persistence.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-file-creation-in-etc-for-persistence.asciidoc
@@ -48,11 +48,13 @@ Detects the manual creation of files in specific etc directories, via user root,
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious File Creation in /etc for Persistence
+*Triage and analysis*
+
+
+
+*Investigating Suspicious File Creation in /etc for Persistence*
+
 
 The /etc/ directory in Linux is used to store system-wide configuration files and scripts.
 
@@ -61,10 +63,12 @@ By creating or modifying specific system-wide configuration files, attackers can
 This rule monitors for the creation of the most common system-wide configuration files and scripts abused by attackers for persistence. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible Investigation Steps*
 
-#### Possible Investigation Steps
 
 - Investigate the file that was created or modified.
 - Investigate whether any other files in any of the commonly abused directories have been altered through OSQuery.
@@ -93,13 +97,17 @@ This rule monitors for the creation of the most common system-wide configuration
 - Investigate whether the user is currently logged in and active.
     - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator that performed these actions for administrative purposes, consider adding exceptions for this specific administrator user account. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Cron Job Created or Changed by Previously Unknown Process - ff10d4d8-fea7-422d-afb1-e5a2702369a9
 - Potential Persistence Through Run Control Detected - 0f4d35e4-925e-4959-ab24-911be207ee6f
@@ -107,7 +115,9 @@ This rule monitors for the creation of the most common system-wide configuration
 - New Systemd Timer Created - 7fb500fa-8e24-4bd1-9480-2a819352602c
 - New Systemd Service Created by Previously Unknown Process - 17b0a495-4d9f-414c-8ad0-92f018b8e001
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -122,7 +132,41 @@ This rule monitors for the creation of the most common system-wide configuration
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-file-creation-via-kworker.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-file-creation-via-kworker.asciidoc
index 23a5350474..3bacb9ca00 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-file-creation-via-kworker.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-file-creation-via-kworker.asciidoc
@@ -42,11 +42,13 @@ This rule monitors for a file creation event originating from a kworker parent p
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious File Creation via Kworker
+*Triage and analysis*
+
+
+
+*Investigating Suspicious File Creation via Kworker*
+
 
 Kworker, or kernel worker, processes are part of the kernel's workqueue mechanism. They are responsible for executing work that has been scheduled to be done in kernel space, which might include tasks like handling interrupts, background activities, and other kernel-related tasks.
 
@@ -55,10 +57,12 @@ Attackers may attempt to evade detection by masquerading as a kernel worker proc
 This rule monitors for suspicious file creation events through the kworker process. This is not common, and could indicate malicious behaviour.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible Investigation Steps*
 
-#### Possible Investigation Steps
 
 - Investigate the file that was created or modified through OSQuery.
   - !{osquery{"label":"Osquery - Retrieve File Listing Information","query":"SELECT * FROM file WHERE path = {{file.path}}\n"}}
@@ -86,18 +90,24 @@ This rule monitors for suspicious file creation events through the kworker proce
 - Investigate whether the user is currently logged in and active.
     - !{osquery{"label":"Osquery - Investigate the Account Authentication Status","query":"SELECT * FROM logged_in_users WHERE user = {{user.name}}"}}
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator that performed these actions for administrative purposes, consider adding exceptions for this specific administrator user account. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Suspicious Kworker UID Elevation - 7dfaaa17-425c-4fe7-bd36-83705fde7c2b
 - Network Activity Detected via Kworker - 25d917c4-aa3c-4111-974c-286c0312ff95
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -111,7 +121,45 @@ This rule monitors for suspicious file creation events through the kworker proce
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Elastic Defend and select the integration to see more details about it.
+- Click Add Elastic Defend.
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click Save and Continue.
+- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-hidden-child-process-of-launchd.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-hidden-child-process-of-launchd.asciidoc
index 1bafabc4c4..31e3580f17 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-hidden-child-process-of-launchd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-hidden-child-process-of-launchd.asciidoc
@@ -43,6 +43,41 @@ Identifies the execution of a launchd child process with a hidden file. An adver
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-html-file-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-html-file-creation.asciidoc
index 78ffc7aab8..83de153c8e 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-html-file-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-html-file-creation.asciidoc
@@ -38,6 +38,17 @@ Identifies the execution of a browser process to open an HTML file with high ent
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd-dll-from-ms-office.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd-dll-from-ms-office.asciidoc
index 9d87652824..a3f17cdfba 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd-dll-from-ms-office.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd-dll-from-ms-office.asciidoc
@@ -49,11 +49,13 @@ Identifies a suspicious image load (taskschd.dll) from Microsoft Office processe
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Image Load (taskschd.dll) from MS Office
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Image Load (taskschd.dll) from MS Office*
+
 
 Microsoft Office, a widely used suite of productivity applications, is frequently targeted by attackers due to its popularity in corporate environments. These attackers exploit its extensive capabilities, like macro scripts in Word and Excel, to gain initial access to systems. They often use Office documents as delivery mechanisms for malware or phishing attempts, taking advantage of their trusted status in professional settings.
 
@@ -62,9 +64,11 @@ Microsoft Office, a widely used suite of productivity applications, is frequentl
 This rule looks for an MS Office process loading `taskschd.dll`, which may indicate an adversary abusing COM to configure a scheduled task. This can happen as part of a phishing attack, when a malicious office document registers the scheduled task to download the malware "stage 2" or to establish persistent access.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Analyze the host's scheduled tasks and explore the related Windows events to determine if tasks were created or deleted (Event IDs 4698 and 4699).
 - Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and spawned child processes.
@@ -88,15 +92,21 @@ This rule looks for an MS Office process loading `taskschd.dll`, which may indic
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Suspicious WMI Image Load from MS Office - 891cb88e-441a-4c3e-be2d-120d99fe7b0d
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -116,7 +126,17 @@ This rule looks for an MS Office process loading `taskschd.dll`, which may indic
     - Consider improvements to the security awareness program.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-java-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-java-child-process.asciidoc
index 1dc90d4f7f..577475e9dd 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-java-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-java-child-process.asciidoc
@@ -51,15 +51,19 @@ Identifies suspicious child processes of the Java interpreter process. This may
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Java Child Process
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Java Child Process*
+
 
 This rule identifies a suspicious child process of the Java interpreter process. It may indicate an attempt to execute a malicious JAR file or an exploitation attempt via a Java specific vulnerability.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -68,11 +72,15 @@ This rule identifies a suspicious child process of the Java interpreter process.
 - Examine the command line to determine if the command executed is potentially harmful or malicious.
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of process and command line conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -83,7 +91,18 @@ This rule identifies a suspicious child process of the Java interpreter process.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-kworker-uid-elevation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-kworker-uid-elevation.asciidoc
index 0d2d2f3271..2a23933929 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-kworker-uid-elevation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-kworker-uid-elevation.asciidoc
@@ -39,6 +39,42 @@ Monitors for the elevation of regular user permissions to root permissions throu
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Elastic Defend and select the integration to see more details about it.
+- Click Add Elastic Defend.
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click Save and Continue.
+- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-access-via-malseclogon.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-access-via-malseclogon.asciidoc
index e9389a938e..c5a7fcde9c 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-access-via-malseclogon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-access-via-malseclogon.asciidoc
@@ -41,6 +41,17 @@ Identifies suspicious access to LSASS handle from a call trace pointing to seclo
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-process-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-process-access.asciidoc
index 54a4868935..7501c82cda 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-process-access.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-lsass-process-access.asciidoc
@@ -41,6 +41,16 @@ Identifies access attempts to LSASS handle, this may indicate an attempt to dump
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-macos-ms-office-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-macos-ms-office-child-process.asciidoc
index e603574594..142c55a9a6 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-macos-ms-office-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-macos-ms-office-child-process.asciidoc
@@ -40,6 +40,41 @@ Identifies suspicious child processes of frequently targeted Microsoft Office ap
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-mail-access-by-clientappid.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-mail-access-by-clientappid.asciidoc
index e851c0b6ff..4cc05defb1 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-mail-access-by-clientappid.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-mail-access-by-clientappid.asciidoc
@@ -43,10 +43,12 @@ Identifies when a Microsoft 365 Mailbox is accessed by a ClientAppId that was ob
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc
index 70aa6d1f68..139c896737 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc
@@ -45,6 +45,17 @@ Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-mining-process-creation-event.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-mining-process-creation-event.asciidoc
index adcdf37539..d42dedc037 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-mining-process-creation-event.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-mining-process-creation-event.asciidoc
@@ -40,6 +40,41 @@ Identifies service creation events of common mining services, possibly indicatin
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-modprobe-file-event.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-modprobe-file-event.asciidoc
index 8f14e269cb..bdd62f718d 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-modprobe-file-event.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-modprobe-file-event.asciidoc
@@ -24,12 +24,13 @@ Detects file events involving kernel modules in modprobe configuration files, wh
 
 *Tags*: 
 
+* Data Source: Auditd Manager
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Discovery
 * Rule Type: BBR
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
@@ -38,6 +39,31 @@ Detects file events involving kernel modules in modprobe configuration files, wh
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.
+
+```
+Kibana -->
+Management -->
+Integrations -->
+Auditd Manager -->
+Add Auditd Manager
+```
+
+`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+
+For this detection rule to trigger, the following additional audit rules are required to be added to the integration:
+```
+-w /etc/modprobe.conf -p wa -k modprobe
+-w /etc/modprobe.d -p wa -k modprobe
+```
+
+Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-module-loaded-by-lsass.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-module-loaded-by-lsass.asciidoc
index eba47d9a62..ad45edfc70 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-module-loaded-by-lsass.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-module-loaded-by-lsass.asciidoc
@@ -41,6 +41,17 @@ Identifies LSASS loading an unsigned or untrusted DLL. Windows Security Support
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-ms-office-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-ms-office-child-process.asciidoc
index 52bee19697..95c08e2e79 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-ms-office-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-ms-office-child-process.asciidoc
@@ -51,17 +51,21 @@ Identifies suspicious child processes of frequently targeted Microsoft Office ap
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious MS Office Child Process
+*Triage and analysis*
+
+
+
+*Investigating Suspicious MS Office Child Process*
+
 
 Microsoft Office (MS Office) is a suite of applications designed to help with productivity and completing common tasks on a computer. You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create presentations and posters. As it is some of the most-used software across companies, MS Office is frequently targeted for initial access. It also has a wide variety of capabilities that attackers can take advantage of.
 
 This rule looks for suspicious processes spawned by MS Office programs. This is generally the result of the execution of malicious documents.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -76,11 +80,15 @@ This rule looks for suspicious processes spawned by MS Office programs. This is
   - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -101,7 +109,17 @@ This rule looks for suspicious processes spawned by MS Office programs. This is
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-ms-outlook-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-ms-outlook-child-process.asciidoc
index 7f2c5a8117..4f220a14c8 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-ms-outlook-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-ms-outlook-child-process.asciidoc
@@ -49,17 +49,21 @@ Identifies suspicious child processes of Microsoft Outlook. These child processe
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious MS Outlook Child Process
+*Triage and analysis*
+
+
+
+*Investigating Suspicious MS Outlook Child Process*
+
 
 Microsoft Outlook is an email client that provides contact, email calendar, and task management features. Outlook is widely used, either standalone or as part of the Office suite.
 
 This rule looks for suspicious processes spawned by MS Outlook, which can be the result of the execution of malicious documents and/or exploitation for initial access.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -74,11 +78,15 @@ This rule looks for suspicious processes spawned by MS Outlook, which can be the
   - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -99,7 +107,17 @@ This rule looks for suspicious processes spawned by MS Outlook, which can be the
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-net-code-compilation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-net-code-compilation.asciidoc
index 7255454538..016eddc51b 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-net-code-compilation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-net-code-compilation.asciidoc
@@ -43,6 +43,17 @@ Identifies executions of .NET compilers with suspicious parent processes, which
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
index 5359e35bbe..ed36f133e1 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
@@ -46,20 +46,24 @@ Detects the use of Reflection.Assembly to load PEs and DLLs in memory in PowerSh
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious .NET Reflection via PowerShell
+*Triage and analysis*
+
+
+
+*Investigating Suspicious .NET Reflection via PowerShell*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
 Attackers can use .NET reflection to load PEs and DLLs in memory. These payloads are commonly embedded in the script, which can circumvent file-based security protections.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -81,17 +85,23 @@ Attackers can use .NET reflection to load PEs and DLLs in memory. These payloads
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately outside engineering or IT business units. As long as the analyst did not identify malware or suspicious activity related to the user or host, this alert can be dismissed.
 
-### Related rules
+
+*Related rules*
+
 
 - PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
 - Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
 - PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -108,7 +118,27 @@ Attackers can use .NET reflection to load PEs and DLLs in memory. These payloads
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-network-activity-to-the-internet-by-previously-unknown-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-network-activity-to-the-internet-by-previously-unknown-executable.asciidoc
index 4a32c11d54..ddc2df3cfe 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-network-activity-to-the-internet-by-previously-unknown-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-network-activity-to-the-internet-by-previously-unknown-executable.asciidoc
@@ -46,21 +46,25 @@ This rule monitors for network connectivity to the internet from a previously un
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Network Activity to the Internet by Previously Unknown Executable
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Network Activity to the Internet by Previously Unknown Executable*
+
 
 After being installed, malware will often call out to its command and control server to receive further instructions by its operators.
 
 This rule leverages the new terms rule type to detect previously unknown processes, initiating network connections to external IP-addresses. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify any signs of suspicious network activity or anomalies that may indicate malicious behavior. This could include unexpected traffic patterns or unusual network behavior.
   - Investigate listening ports and open sockets to look for potential malicious processes, reverse shells or data exfiltration.
@@ -82,16 +86,22 @@ This rule leverages the new terms rule type to detect previously unknown process
           - Check the reputation of the domain or IP address.
         - File access, modification, and creation activities.
 
-### Related rules
+
+*Related rules*
+
 
 - Network Activity Detected via cat - afd04601-12fc-4149-9b78-9c3f8fe45d39
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -106,7 +116,90 @@ This rule leverages the new terms rule type to detect previously unknown process
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+- Filebeat
+- Packetbeat
+
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Filebeat Setup*
+
+Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing.
+
+
+*The following steps should be executed in order to add the Filebeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html[helper guide].
+- To run Filebeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html[helper guide].
+- To run Filebeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html[helper guide].
+- For quick start information for Filebeat refer to the https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html[helper guide].
+- For complete “Setup and Run Filebeat” information refer to the https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html[helper guide].
+
+
+*Packetbeat Setup*
+
+Packetbeat is a real-time network packet analyzer that you can use for application monitoring, performance analytics, and threat detection. Packetbeat works by capturing the network traffic between your application servers, decoding the application layer protocols (HTTP, MySQL, Redis, and so on), correlating the requests with the responses, and recording the interesting fields for each transaction.
+
+
+*The following steps should be executed in order to add the Packetbeat on a  Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/packetbeat/current/setup-repositories.html[helper guide].
+- To run Packetbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/packetbeat/current/running-on-docker.html[helper guide].
+- For quick start information for Packetbeat refer to the https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-installation-configuration.html[helper guide].
+- For complete “Setup and Run Packetbeat” information refer to the https://www.elastic.co/guide/en/beats/packetbeat/current/setting-up-and-running.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-network-connection-via-sudo-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-network-connection-via-sudo-binary.asciidoc
index 373c52d5ed..b552167c33 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-network-connection-via-sudo-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-network-connection-via-sudo-binary.asciidoc
@@ -38,6 +38,41 @@ Detects network connections initiated by the "sudo" binary. This behavior is unc
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-network-connection-via-systemd.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-network-connection-via-systemd.asciidoc
index f0a4d23f42..016567ff40 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-network-connection-via-systemd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-network-connection-via-systemd.asciidoc
@@ -40,6 +40,41 @@ Detects suspicious network events executed by systemd, potentially indicating pe
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-passwd-file-event-action.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-passwd-file-event-action.asciidoc
index a4a2ee4adf..aef058048e 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-passwd-file-event-action.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-passwd-file-event-action.asciidoc
@@ -24,13 +24,14 @@ Monitors for the generation of a passwd password entry via openssl, followed by
 
 *Tags*: 
 
+* Data Source: Auditd Manager
 * Domain: Endpoint
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Privilege Escalation
 * Data Source: Elastic Defend
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -39,6 +40,68 @@ Monitors for the generation of a passwd password entry via openssl, followed by
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend and Auditd Manager.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule the following additional audit rules are required to be added to the integration:
+  -- "-w /etc/passwd -p wa -k etcpasswd"
+
+
+
 ==== Rule query
 
 
@@ -47,8 +110,8 @@ Monitors for the generation of a passwd password entry via openssl, followed by
 sequence by host.id, process.parent.pid with maxspan=1m
   [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
    process.name == "openssl" and process.args == "passwd" and user.id != "0"]
-  [file where event.dataset == "auditd_manager.auditd" and host.os.type == "linux" and file.path == "/etc/passwd" and
-  process.parent.pid != 1 and not auditd.data.a2 == "80000" and event.outcome == "success" and user.id != "0"]
+  [file where host.os.type == "linux" and file.path == "/etc/passwd" and process.parent.pid != 1 and
+   not auditd.data.a2 == "80000" and event.outcome == "success" and user.id != "0"]
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-pdf-reader-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-pdf-reader-child-process.asciidoc
index 9aa474ef57..d43831deb8 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-pdf-reader-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-pdf-reader-child-process.asciidoc
@@ -47,17 +47,21 @@ Identifies suspicious child processes of PDF reader applications. These child pr
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious PDF Reader Child Process
+*Triage and analysis*
+
+
+
+*Investigating Suspicious PDF Reader Child Process*
+
 
 PDF is a common file type used in corporate environments and most machines have software to handle these files. This creates a vector where attackers can exploit the engines and technology behind this class of software for initial access or privilege escalation.
 
 This rule looks for commonly abused built-in utilities spawned by a PDF reader process, which is likely a malicious behavior.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -73,11 +77,15 @@ This rule looks for commonly abused built-in utilities spawned by a PDF reader p
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -98,7 +106,17 @@ This rule looks for commonly abused built-in utilities spawned by a PDF reader p
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
index bd4fb4efe0..f2af3fc308 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
@@ -46,20 +46,24 @@ Detects the presence of a portable executable (PE) in a PowerShell script by loo
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Portable Executable Encoded in Powershell Script
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Portable Executable Encoded in Powershell Script*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
 Attackers can abuse PowerShell in-memory capabilities to inject executables into memory without touching the disk, bypassing file-based security protections. These executables are generally base64 encoded.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
 - Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -80,17 +84,23 @@ Attackers can abuse PowerShell in-memory capabilities to inject executables into
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Related rules
+
+*Related rules*
+
 
 - Suspicious .NET Reflection via PowerShell - e26f042e-c590-4e82-8e05-41e81bd822ad
 - PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a
 - PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -107,7 +117,27 @@ Attackers can abuse PowerShell in-memory capabilities to inject executables into
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-engine-imageload.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-engine-imageload.asciidoc
index c0653c1d00..bee8ba8624 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-engine-imageload.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-engine-imageload.asciidoc
@@ -42,17 +42,21 @@ Identifies the PowerShell engine being invoked by unexpected processes. Rather t
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious PowerShell Engine ImageLoad
+*Triage and analysis*
+
+
+
+*Investigating Suspicious PowerShell Engine ImageLoad*
+
 
 PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
 
 Attackers can use PowerShell without having to execute `PowerShell.exe` directly. This technique, often called "PowerShell without PowerShell," works by using the underlying System.Management.Automation namespace and can bypass application allowlisting and PowerShell security features.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
@@ -68,11 +72,15 @@ Attackers can use PowerShell without having to execute `PowerShell.exe` directly
   - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity can happen legitimately. Some vendors have their own PowerShell implementations that are shipped with some products. These benign true positives (B-TPs) can be added as exceptions if necessary after analysis.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -87,7 +95,6 @@ Attackers can use PowerShell without having to execute `PowerShell.exe` directly
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-file-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-file-deletion.asciidoc
index c1d45552de..2a66fbed1e 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-file-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-file-deletion.asciidoc
@@ -45,6 +45,17 @@ Detects deletion of print driver files by an unusual process. This may indicate
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
index c88bc57c78..5a5394268f 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
@@ -49,20 +49,24 @@ Detects attempts to exploit privilege escalation vulnerabilities related to the
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Print Spooler SPL File Created
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Print Spooler SPL File Created*
+
 
 Print Spooler is a Windows service enabled by default in all Windows clients and servers. The service manages print jobs by loading printer drivers, receiving files to be printed, queuing them, scheduling, etc.
 
 The Print Spooler service has some known vulnerabilities that attackers can abuse to escalate privileges to SYSTEM, like CVE-2020-1048 and CVE-2020-1337. This rule looks for unusual processes writing SPL files to the location `?:\Windows\System32\spool\PRINTERS\`, which is an essential step in exploiting these vulnerabilities.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
@@ -84,11 +88,15 @@ The Print Spooler service has some known vulnerabilities that attackers can abus
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of process executable and file conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -105,7 +113,17 @@ The Print Spooler service has some known vulnerabilities that attackers can abus
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-printspooler-service-executable-file-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-printspooler-service-executable-file-creation.asciidoc
index cd4e7a22c7..32ffa13b2f 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-printspooler-service-executable-file-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-printspooler-service-executable-file-creation.asciidoc
@@ -46,6 +46,17 @@ Detects attempts to exploit privilege escalation vulnerabilities related to the
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-proc-maps-discovery.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-proc-maps-discovery.asciidoc
index b7270facf0..7920a3724b 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-proc-maps-discovery.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-proc-maps-discovery.asciidoc
@@ -40,6 +40,41 @@ Monitors for /proc/*/maps file reads. The /proc/*/maps file in Linux provides a
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-proc-pseudo-file-system-enumeration.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-proc-pseudo-file-system-enumeration.asciidoc
index 524c901bf6..c6855ffd86 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-proc-pseudo-file-system-enumeration.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-proc-pseudo-file-system-enumeration.asciidoc
@@ -24,12 +24,13 @@ This rule monitors for a rapid enumeration of 25 different proc cmd, stat, and e
 
 *Tags*: 
 
+* Data Source: Auditd Manager
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Discovery
 * Rule Type: BBR
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -38,6 +39,30 @@ This rule monitors for a rapid enumeration of 25 different proc cmd, stat, and e
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.
+
+```
+Kibana -->
+Management -->
+Integrations -->
+Auditd Manager -->
+Add Auditd Manager
+```
+
+`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+
+For this detection rule to trigger, the following additional audit rules are required to be added to the integration:
+```
+-w /proc/ -p r -k audit_proc
+```
+
+Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
index 44560125be..8e5984a8ee 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
@@ -47,22 +47,26 @@ Identifies suspicious process access events from an unknown memory region. Endpo
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Process Access via Direct System Call
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Process Access via Direct System Call*
+
 
 Endpoint security solutions usually hook userland Windows APIs in order to decide if the code that is being executed is malicious or not. It's possible to bypass hooked functions by writing malicious functions that call syscalls directly.
 
-More context and technical details can be found in this [research blog](https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/).
+More context and technical details can be found in this https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/[research blog].
 
 This rule identifies suspicious process access events from an unknown memory region. Attackers can use direct system calls to bypass security solutions that rely on hooks.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -83,11 +87,15 @@ This rule identifies suspicious process access events from an unknown memory reg
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This detection may be triggered by certain applications that install root certificates for the purpose of inspecting SSL traffic. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -104,7 +112,17 @@ This rule identifies suspicious process access events from an unknown memory reg
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-creation-calltrace.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-creation-calltrace.asciidoc
index 0f824af5a1..92b9ce83e3 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-creation-calltrace.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-creation-calltrace.asciidoc
@@ -43,15 +43,19 @@ Identifies when a process is created and immediately accessed from an unknown me
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Process Creation CallTrace
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Process Creation CallTrace*
+
 
 Attackers may inject code into child processes' memory to hide their actual activity, evade detection mechanisms, and decrease discoverability during forensics. This rule looks for a spawned process by Microsoft Office, scripting, and command line applications, followed by a process access event for an unknown memory region by the parent process, which can indicate a code injection attempt.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
@@ -59,11 +63,15 @@ Attackers may inject code into child processes' memory to hide their actual acti
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
 - Create a memory dump of the child process for analysis.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -73,7 +81,6 @@ Attackers may inject code into child processes' memory to hide their actual acti
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc
index 505f1efcb1..fb0b410a10 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc
@@ -47,17 +47,21 @@ Identifies suspicious psexec activity which is executing from the psexec service
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Process Execution via Renamed PsExec Executable
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Process Execution via Renamed PsExec Executable*
+
 
 PsExec is a remote administration tool that enables the execution of commands with both regular and SYSTEM privileges on Windows systems. It operates by executing a service component `Psexecsvc` on a remote system, which then runs a specified process and returns the results to the local system. Microsoft develops PsExec as part of the Sysinternals Suite. Although commonly used by administrators, PsExec is frequently used by attackers to enable lateral movement and execute commands as SYSTEM to disable defenses and bypass security protections.
 
 This rule identifies instances where the PsExec service component is executed using a custom name. This behavior can indicate an attempt to bypass security controls or detections that look for the default PsExec service component name.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Check if the usage of this tool complies with the organization's administration policy.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -65,11 +69,15 @@ This rule identifies instances where the PsExec service component is executed us
 - Identify the target computer and its role in the IT environment.
 - Investigate what commands were run, and assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. As long as the analyst did not identify suspicious activity related to the user or involved hosts, and the tool is allowed by the organization's policy, such alerts can be dismissed.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
   - Prioritize cases involving critical servers and users.
@@ -81,7 +89,17 @@ This rule identifies instances where the PsExec service component is executed us
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
index d092956595..74567b2de8 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
@@ -46,11 +46,13 @@ Message of the day (MOTD) is the message that is presented to the user when a us
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Process Spawned from MOTD Detected
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Process Spawned from MOTD Detected*
+
 
 The message-of-the-day (MOTD) is used to display a customizable system-wide message or information to users upon login in Linux.
 
@@ -59,10 +61,12 @@ Attackers can abuse message-of-the-day (motd) files to run scripts, commands or
 This rule identifies the execution of potentially malicious processes from a MOTD script, which is not likely to occur as default benign behavior. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible Investigation Steps*
 
-#### Possible Investigation Steps
 
 - Investigate the file that was created or modified from which the suspicious process was executed.
   - !{osquery{"label":"Osquery - Retrieve File Information","query":"SELECT * FROM file WHERE path = {{file.path}}"}}
@@ -83,15 +87,21 @@ This rule identifies the execution of potentially malicious processes from a MOT
         - Cron jobs, services, and other persistence mechanisms.
             - !{osquery{"label":"Osquery - Retrieve Crontab Information","query":"SELECT * FROM crontab"}}
 
-### Related Rules
+
+*Related Rules*
+
 
 - Potential Persistence Through MOTD File Creation Detected - 96d11d31-9a79-480f-8401-da28b194608f
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -107,7 +117,41 @@ This rule identifies the execution of potentially malicious processes from a MOT
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-rdp-activex-client-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-rdp-activex-client-loaded.asciidoc
index 7503714dcc..8ab9785c9e 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-rdp-activex-client-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-rdp-activex-client-loaded.asciidoc
@@ -44,6 +44,17 @@ Identifies suspicious Image Loading of the Remote Desktop Services ActiveX Clien
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-remote-registry-access-via-sebackupprivilege.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-remote-registry-access-via-sebackupprivilege.asciidoc
index 9f4aa346cb..b5ce7459af 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-remote-registry-access-via-sebackupprivilege.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-remote-registry-access-via-sebackupprivilege.asciidoc
@@ -50,17 +50,21 @@ Identifies remote access to the registry using an account with Backup Operators
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Remote Registry Access via SeBackupPrivilege
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Remote Registry Access via SeBackupPrivilege*
+
 
 SeBackupPrivilege is a privilege that allows file content retrieval, designed to enable users to create backup copies of the system. Since it is impossible to make a backup of something you cannot read, this privilege comes at the cost of providing the user with full read access to the file system. This privilege must bypass any access control list (ACL) placed in the system.
 
 This rule identifies remote access to the registry using an account with Backup Operators group membership. This may indicate an attempt to exfiltrate credentials by dumping the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate the activities done by the subject user the login session. The field `winlog.event_data.SubjectLogonId` can be used to get this data.
@@ -69,11 +73,15 @@ This rule identifies remote access to the registry using an account with Backup
 - Investigate abnormal behaviors observed by the subject user such as network connections, registry or file modifications, and processes created.
 - Investigate if the registry file was retrieved or exfiltrated.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is expected and noisy in your environment, benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Limit or disable the involved user account to prevent further post-compromise behavior.
@@ -83,7 +91,37 @@ This rule identifies remote access to the registry using an account with Backup
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'Audit Detailed File Share' audit policy is required be configured (Success) on Domain Controllers and Sensitive Windows Servers.
+Steps to implement the logging policy with with Advanced Audit Configuration:
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+Object Access >
+Audit Detailed File Share (Success)
+```
+
+The 'Special Logon' audit policy must be configured (Success).
+Steps to implement the logging policy with with Advanced Audit Configuration:
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+Logon/Logoff >
+Special Logon (Success)
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-files.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-files.asciidoc
index 9624bf3002..ec1b7b93b0 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-files.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-files.asciidoc
@@ -40,6 +40,41 @@ Identifies instances where VMware-related files, such as those with extensions l
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-index-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-index-html-file.asciidoc
index 68e3340d6c..e6ea3e1680 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-index-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-index-html-file.asciidoc
@@ -40,6 +40,41 @@ Identifies instances where the "index.html" file within the "/usr/lib/vmware/*"
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
index 16522d71cf..7d5ebfb03b 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
@@ -43,19 +43,23 @@ Identifies the creation of a new Windows service with suspicious Service command
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Service was Installed in the System
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Service was Installed in the System*
+
 
 Attackers may create new services to execute system shells and other command execution utilities to elevate their privileges from administrator to SYSTEM. They can also configure services to execute these utilities with persistence payloads.
 
 This rule looks for suspicious services being created with suspicious traits compatible with the above behavior.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-#### Possible investigation steps
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify how the service was created or modified. Look for registry changes events or Windows events related to service activities (for example, 4697 and/or 7045).
@@ -72,11 +76,15 @@ This rule looks for suspicious services being created with suspicious traits com
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Certain services such as PSEXECSVC may happen legitimately. The security team should address any potential benign true positive (B-TP) by excluding the relevant FP by pattern.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -86,7 +94,6 @@ This rule looks for suspicious services being created with suspicious traits com
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-solarwinds-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-solarwinds-child-process.asciidoc
index 75afc75ca2..4b4d739a86 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-solarwinds-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-solarwinds-child-process.asciidoc
@@ -45,6 +45,17 @@ A suspicious SolarWinds child process was detected, which may indicate an attemp
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
index aa0f392c76..248edd6c6a 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
@@ -45,18 +45,22 @@ Identifies suspicious startup shell folder modifications to change the default S
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Startup Shell Folder Modification
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Startup Shell Folder Modification*
+
 
 Techniques used within malware and by adversaries often leverage the Windows registry to store malicious programs for persistence. Startup shell folders are often targeted as they are not as prevalent as normal Startup folder paths so this behavior may evade existing AV/EDR solutions. These programs may also run with higher privileges which can be ideal for an attacker.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Review the source process and related file tied to the Windows Registry entry.
@@ -77,16 +81,22 @@ Techniques used within malware and by adversaries often leverage the Windows reg
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - There is a high possibility of benign legitimate programs being added to shell folders. This activity could be based on new software installations, patches, or other network administrator activity. Before undertaking further investigation, it should be verified that this activity is not benign.
 
-### Related rules
+
+*Related rules*
+
 
 - Startup or Run Key Registry Modification - 97fc44d3-8dae-4019-ae83-298c3015600f
 - Persistent Scripts in the Startup Directory - f7c4dc5a-a58d-491d-9f14-9b66507121c0
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -99,7 +109,6 @@ Techniques used within malware and by adversaries often leverage the Windows reg
 - Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-symbolic-link-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-symbolic-link-created.asciidoc
index dadbedcc9a..4441a68337 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-symbolic-link-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-symbolic-link-created.asciidoc
@@ -41,6 +41,41 @@ Identifies the creation of a symbolic link to a suspicious file or location. A s
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-sysctl-file-event.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-sysctl-file-event.asciidoc
index 3476839c41..5ae9238bc6 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-sysctl-file-event.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-sysctl-file-event.asciidoc
@@ -24,12 +24,13 @@ Monitors file events on sysctl configuration files (e.g., /etc/sysctl.conf, /etc
 
 *Tags*: 
 
+* Data Source: Auditd Manager
 * OS: Linux
 * Use Case: Threat Detection
 * Tactic: Discovery
 * Rule Type: BBR
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
@@ -38,6 +39,32 @@ Monitors file events on sysctl configuration files (e.g., /etc/sysctl.conf, /etc
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.
+
+```
+Kibana -->
+Management -->
+Integrations -->
+Auditd Manager -->
+Add Auditd Manager
+```
+
+`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+
+For this detection rule to trigger, the following additional audit rules are required to be added to the integration:
+
+```
+-w /etc/sysctl.conf -p wa -k sysctl
+-w /etc/sysctl.d -p wa -k sysctl
+```
+
+Add the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-system-commands-executed-by-previously-unknown-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-system-commands-executed-by-previously-unknown-executable.asciidoc
index 5f14e26088..760cd5a817 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-system-commands-executed-by-previously-unknown-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-system-commands-executed-by-previously-unknown-executable.asciidoc
@@ -40,6 +40,41 @@ This rule monitors for the execution of several commonly used system commands ex
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-termination-of-esxi-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-termination-of-esxi-process.asciidoc
index cd9db9eb0d..9ffdda06cc 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-termination-of-esxi-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-termination-of-esxi-process.asciidoc
@@ -40,6 +40,41 @@ Identifies instances where VMware processes, such as "vmware-vmx" or "vmx," are
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-utility-launched-via-proxychains.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-utility-launched-via-proxychains.asciidoc
index 097bcdbcab..019216ae4f 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-utility-launched-via-proxychains.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-utility-launched-via-proxychains.asciidoc
@@ -8,6 +8,9 @@ This rule monitors for the execution of suspicious linux tools through ProxyChai
 *Rule indices*: 
 
 * logs-endpoint.events.*
+* endgame-*
+* auditbeat-*
+* logs-auditd_manager.auditd-*
 
 *Severity*: low
 
@@ -30,8 +33,10 @@ This rule monitors for the execution of suspicious linux tools through ProxyChai
 * Use Case: Threat Detection
 * Tactic: Command and Control
 * Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Auditd Manager
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -43,21 +48,25 @@ This rule monitors for the execution of suspicious linux tools through ProxyChai
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Utility Launched via ProxyChains
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Utility Launched via ProxyChains*
+
 
 Attackers can leverage `proxychains` to obfuscate their origin and bypass network defenses by routing their malicious traffic through multiple intermediary servers.
 
 This rule looks for a list of suspicious processes spawned through `proxychains` by analyzing process command line arguments. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Identify any signs of suspicious network activity or anomalies that may indicate network obfuscation. This could include unexpected traffic patterns or unusual network behavior.
   - Investigate listening ports and open sockets to look for potential protocol tunneling, reverse shells, or data exfiltration.
@@ -79,7 +88,9 @@ This rule looks for a list of suspicious processes spawned through `proxychains`
           - Check the reputation of the domain or IP address.
         - File access, modification, and creation activities.
 
-### Related rules
+
+*Related rules*
+
 
 - ProxyChains Activity - 4b868f1f-15ff-4ba3-8c11-d5a7a6356d37
 - Potential Protocol Tunneling via Chisel Client - 3f12325a-4cc6-410b-8d4c-9fbbeb744cfd
@@ -87,13 +98,17 @@ This rule looks for a list of suspicious processes spawned through `proxychains`
 - Potential Linux Tunneling and/or Port Forwarding - 6ee947e9-de7e-4281-a55d-09289bdf947e
 - Potential Protocol Tunneling via EarthWorm - 9f1c4ca3-44b5-481d-ba42-32dc215a2769
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - If this activity is related to a system administrator or developer who uses this utility for benign purposes, consider adding exceptions for specific user accounts or hosts. 
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -108,18 +123,51 @@ This rule looks for a list of suspicious processes spawned through `proxychains`
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
+
+==== Setup
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
 
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and 
-process.name == "proxychains" and process.args : (
+process where host.os.type == "linux" and event.action in ("exec", "exec_event", "executed") and
+event.type == "start" and process.name == "proxychains" and process.args : (
   "ssh", "sshd", "sshuttle", "socat", "iodine", "iodined", "dnscat", "hans", "hans-ubuntu", "ptunnel-ng",
   "ssf", "3proxy", "ngrok", "gost", "pivotnacci", "chisel*", "nmap", "ping", "python*", "php*", "perl", "ruby",
-  "lua*", "openssl", "nc", "netcat", "ncat", "telnet", "awk", "java", "telnet", "ftp", "curl", "wget")
+  "lua*", "openssl", "nc", "netcat", "ncat", "telnet", "awk", "java", "telnet", "ftp", "curl", "wget"
+)
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc
index 910d68b205..d6add0abef 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc
@@ -49,6 +49,17 @@ A suspicious WerFault child process was detected, which may indicate an attempt
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-host.asciidoc
index b5794bf02a..47aca4cc0b 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-host.asciidoc
@@ -39,6 +39,75 @@ A machine learning job combination has detected a set of one or more suspicious
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
+*Anomaly Detection Setup*
+
+Before you can enable this rule, you'll need to enable the corresponding Anomaly Detection job. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-parent-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-parent-process.asciidoc
index a4e165a3ec..6181a679d8 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-parent-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-parent-process.asciidoc
@@ -41,6 +41,75 @@ A machine learning job combination has detected a set of one or more suspicious
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
+*Anomaly Detection Setup*
+
+Before you can enable this rule, you'll need to enable the corresponding Anomaly Detection job. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-user.asciidoc
index 3c044a9136..2e09edca9d 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-user.asciidoc
@@ -41,6 +41,75 @@ A machine learning job combination has detected a set of one or more suspicious
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
+*Anomaly Detection Setup*
+
+Before you can enable this rule, you'll need to enable the corresponding Anomaly Detection job. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-wmi-image-load-from-ms-office.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-wmi-image-load-from-ms-office.asciidoc
index 71321bcd6f..1633377aeb 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-wmi-image-load-from-ms-office.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-wmi-image-load-from-ms-office.asciidoc
@@ -44,6 +44,17 @@ Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processe
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
index 5305137091..b085de8361 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
@@ -47,20 +47,24 @@ A suspicious Zoom child process was detected, which may indicate an attempt to r
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Suspicious Zoom Child Process
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Zoom Child Process*
+
 
 By examining the specific traits of Windows binaries -- such as process trees, command lines, network connections, registry modifications, and so on -- it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading, and deserve further investigation.
 
 This rule identifies a potential malicious process masquerading as `Zoom.exe` or exploiting a vulnerability in the application causing it to execute code.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -82,11 +86,15 @@ This rule identifies a potential malicious process masquerading as `Zoom.exe` or
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -100,7 +108,6 @@ This rule identifies a potential malicious process masquerading as `Zoom.exe` or
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc b/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
index fc3feb380e..00bcee0c62 100644
--- a/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
@@ -47,20 +47,24 @@ Identifies a suspicious parent child process relationship with cmd.exe descendin
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Svchost spawning Cmd
+*Triage and analysis*
+
+
+
+*Investigating Svchost spawning Cmd*
+
 
 The Service Host process (SvcHost) is a system process that can host one, or multiple, Windows services in the Windows NT family of operating systems. Note that `Svchost.exe` is reserved for use by the operating system and should not be used by non-Windows services.
 
 This rule looks for the creation of the `cmd.exe` process with `svchost.exe` as its parent process. This is an unusual behavior that can indicate the masquerading of a malicious process as `svchost.exe` or exploitation for privilege escalation.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -81,11 +85,15 @@ This rule looks for the creation of the `cmd.exe` process with `svchost.exe` as
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -100,7 +108,17 @@ This rule looks for the creation of the `cmd.exe` process with `svchost.exe` as
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/symbolic-link-to-shadow-copy-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/symbolic-link-to-shadow-copy-created.asciidoc
index ac9051e1db..56cf3f51b3 100644
--- a/docs/detections/prebuilt-rules/rule-details/symbolic-link-to-shadow-copy-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/symbolic-link-to-shadow-copy-created.asciidoc
@@ -52,15 +52,19 @@ Identifies the creation of symbolic links to a shadow copy. Symbolic links can b
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Symbolic Link to Shadow Copy Created
+*Triage and analysis*
+
+
+
+*Investigating Symbolic Link to Shadow Copy Created*
+
 
 Shadow copies are backups or snapshots of an endpoint's files or volumes while they are in use. Adversaries may attempt to discover and create symbolic links to these shadow copies in order to copy sensitive information offline. If Active Directory (AD) is in use, often the ntds.dit file is a target as it contains password hashes, but an offline copy is needed to extract these hashes and potentially conduct lateral movement.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -72,15 +76,21 @@ Shadow copies are backups or snapshots of an endpoint's files or volumes while t
 - Investigate recent deletions of volume shadow copies.
 - Identify other files potentially copied from volume shadow copy paths directly.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This rule should cause very few false positives. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Related rules
+
+*Related rules*
+
 
 - NTDS or SAM Database File Copied - 3bc6deaa-fbd4-433a-ae21-3e892f95624f
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
@@ -93,7 +103,35 @@ Shadow copies are backups or snapshots of an endpoint's files or volumes while t
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+Ensure advanced audit policies for Windows are enabled, specifically:
+Object Access policies https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656[Event ID 4656] (Handle to an Object was Requested)
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+System Audit Policies >
+Object Access >
+Audit File System (Success,Failure)
+Audit Handle Manipulation (Success,Failure)
+```
+
+This event will only trigger if symbolic links are created from a new process spawning cmd.exe or powershell.exe with the correct arguments.
+Direct access to a shell and calling symbolic link creation tools will not generate an event matching this rule.
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/system-binary-copied-and-or-moved-to-suspicious-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-binary-copied-and-or-moved-to-suspicious-directory.asciidoc
index 6577022bf6..c51e8c9570 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-binary-copied-and-or-moved-to-suspicious-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-binary-copied-and-or-moved-to-suspicious-directory.asciidoc
@@ -29,7 +29,7 @@ This rule monitors for the copying or moving of a system binary to a suspicious
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -38,6 +38,41 @@ This rule monitors for the copying or moving of a system binary to a suspicious
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
@@ -69,7 +104,7 @@ sequence by host.id, process.entity_id with maxspan=1s
   ) and not process.parent.name in ("dracut-install", "apticron", "generate-from-dir", "platform-python")]
   [file where host.os.type == "linux" and event.action == "creation" and file.path : (
     "/dev/shm/*", "/run/shm/*", "/tmp/*", "/var/tmp/*", "/run/*", "/var/run/*", "/var/www/*", "/proc/*/fd/*"
-  ) and not file.path : ("/tmp/rear*", "/var/tmp/dracut*")]
+  ) and not file.path : ("/tmp/rear*", "/var/tmp/rear*", "/var/tmp/dracut*", "/var/tmp/mkinitramfs*")]
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/system-information-discovery-via-windows-command-shell.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-information-discovery-via-windows-command-shell.asciidoc
index 780a71b63b..d4e47f6d39 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-information-discovery-via-windows-command-shell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-information-discovery-via-windows-command-shell.asciidoc
@@ -46,27 +46,35 @@ Identifies the execution of discovery commands to enumerate system information,
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating System Information Discovery via Windows Command Shell
+*Triage and analysis*
+
+
+
+*Investigating System Information Discovery via Windows Command Shell*
+
 
 After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
 This rule identifies commands to enumerate system information, files, and folders using the Windows Command Shell.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -76,7 +84,18 @@ This rule identifies commands to enumerate system information, files, and folder
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc
index f3b5d02f3d..cf8f56d5b6 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc
@@ -43,6 +43,62 @@ Identifies the deletion of sensitive Linux system logs. This may indicate an att
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+*Custom Ingest Pipeline*
+
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html[guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
index 52a3cb5e66..ceeea7cccb 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
@@ -48,20 +48,24 @@ Windows services typically run as SYSTEM and can be used as a privilege escalati
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating System Shells via Services
+*Triage and analysis*
+
+
+
+*Investigating System Shells via Services*
+
 
 Attackers may configure existing services or create new ones to execute system shells to elevate their privileges from administrator to SYSTEM. They can also configure services to execute these shells with persistence payloads.
 
 This rule looks for system shells being spawned by `services.exe`, which is compatible with the above behavior.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify how the service was created or modified. Look for registry changes events or Windows events related to service activities (for example, 4697 and/or 7045).
@@ -76,11 +80,15 @@ This rule looks for system shells being spawned by `services.exe`, which is comp
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 - Check for commands executed under the spawned shell.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -90,7 +98,6 @@ This rule looks for system shells being spawned by `services.exe`, which is comp
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/system-time-discovery.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-time-discovery.asciidoc
index 441194b522..6f20471044 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-time-discovery.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-time-discovery.asciidoc
@@ -34,7 +34,7 @@ Detects the usage of commonly used system time discovery techniques, which attac
 * Data Source: Elastic Endgame
 * Rule Type: BBR
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -50,8 +50,10 @@ Detects the usage of commonly used system time discovery techniques, which attac
 ----------------------------------
 process where host.os.type == "windows" and event.type == "start" and
 (
- ((process.name: "net.exe" or (process.name : "net1.exe" and not process.parent.name : "net.exe")) and 
-   process.args : "time") or 
+ (
+    (process.name: "net.exe" or (process.name : "net1.exe" and not process.parent.name : "net.exe")) and 
+    process.args : "time" and not process.args : "/set"
+ ) or 
  (process.name: "w32tm.exe" and process.args: "/tz") or 
  (process.name: "tzutil.exe" and process.args: "/g")
 ) and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20")
diff --git a/docs/detections/prebuilt-rules/rule-details/systemkey-access-via-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/systemkey-access-via-command-line.asciidoc
index 3c4b2622fa..52ecaba3f0 100644
--- a/docs/detections/prebuilt-rules/rule-details/systemkey-access-via-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/systemkey-access-via-command-line.asciidoc
@@ -40,6 +40,41 @@ Keychains are the built-in way for macOS to keep track of users' passwords and c
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/tainted-kernel-module-load.asciidoc b/docs/detections/prebuilt-rules/rule-details/tainted-kernel-module-load.asciidoc
index 032dcb1e9e..46c2575dfe 100644
--- a/docs/detections/prebuilt-rules/rule-details/tainted-kernel-module-load.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/tainted-kernel-module-load.asciidoc
@@ -39,6 +39,37 @@ This rule monitors the syslog log file for messages related to instances of a ta
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Filebeat
+
+
+*Filebeat Setup*
+
+Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing.
+
+
+*The following steps should be executed in order to add the Filebeat for the Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html[helper guide].
+- To run Filebeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html[helper guide].
+- To run Filebeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html[helper guide].
+- For quick start information for Filebeat refer to the https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html[helper guide].
+- For complete Setup and Run Filebeat information refer to the https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html[helper guide].
+
+
+*Rule Specific Setup Note*
+
+- This rule requires the Filebeat System Module to be enabled.
+- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions.
+- To run the system module of Filebeat on Linux follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/tainted-out-of-tree-kernel-module-load.asciidoc b/docs/detections/prebuilt-rules/rule-details/tainted-out-of-tree-kernel-module-load.asciidoc
index cefeb102b8..e00a6ef16c 100644
--- a/docs/detections/prebuilt-rules/rule-details/tainted-out-of-tree-kernel-module-load.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/tainted-out-of-tree-kernel-module-load.asciidoc
@@ -39,6 +39,39 @@ This rule monitors the syslog log file for messages related to instances of a ou
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from one of the following integrations:
+- Filebeat
+
+
+*Filebeat Setup*
+
+Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing.
+
+
+*The following steps should be executed in order to add the Filebeat for the Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html[helper guide].
+- To run Filebeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html[helper guide].
+- To run Filebeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html[helper guide].
+- For quick start information for Filebeat refer to the https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html[helper guide].
+- For complete Setup and Run Filebeat information refer to the https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html[helper guide].
+
+
+*Rule Specific Setup Note*
+
+- This rule requires the Filebeat System Module to be enabled.
+- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions.
+- To run the system module of Filebeat on Linux follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html[helper guide].
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/tampering-of-bash-command-line-history.asciidoc b/docs/detections/prebuilt-rules/rule-details/tampering-of-bash-command-line-history.asciidoc
index dc80ede4f9..48e7f0f75a 100644
--- a/docs/detections/prebuilt-rules/rule-details/tampering-of-bash-command-line-history.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/tampering-of-bash-command-line-history.asciidoc
@@ -40,6 +40,17 @@ Adversaries may attempt to clear or disable the Bash command-line history in an
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc
index 8fe690c214..b1bfb676cf 100644
--- a/docs/detections/prebuilt-rules/rule-details/tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/tcc-bypass-via-mounted-apfs-snapshot-access.asciidoc
@@ -41,6 +41,41 @@ Identifies the use of the mount_apfs command to mount the entire file system thr
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/third-party-backup-files-deleted-via-unexpected-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/third-party-backup-files-deleted-via-unexpected-process.asciidoc
index 41b2b2473c..bcdfaa6255 100644
--- a/docs/detections/prebuilt-rules/rule-details/third-party-backup-files-deleted-via-unexpected-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/third-party-backup-files-deleted-via-unexpected-process.asciidoc
@@ -48,11 +48,13 @@ Identifies the deletion of backup files, saved using third-party software, by a
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Third-party Backup Files Deleted via Unexpected Process
+*Triage and analysis*
+
+
+
+*Investigating Third-party Backup Files Deleted via Unexpected Process*
+
 
 Backups are a significant obstacle for any ransomware operation. They allow the victim to resume business by performing data recovery, making them a valuable target.
 
@@ -60,7 +62,9 @@ Attackers can delete backups from the host and gain access to backup servers to
 
 This rule identifies file deletions performed by a process that does not belong to the backup suite and aims to delete Veritas or Veeam backups.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -68,18 +72,24 @@ This rule identifies file deletions performed by a process that does not belong
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Check if any files on the host machine have been encrypted.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This rule can be triggered by the manual removal of backup files and by removal using other third-party tools that are not from the backup suite. Exceptions can be added for specific accounts and executables, preferably tied together.
 
-### Related rules
+
+*Related rules*
+
 
 - Deleting Backup Catalogs with Wbadmin - 581add16-df76-42bb-af8e-c979bfb39a59
 - Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921
 - Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4
 - Volume Shadow Copy Deletion via WMIC - dc9c1f74-dac3-48e3-b47f-eb79db358f57
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
@@ -90,7 +100,17 @@ This rule identifies file deletions performed by a process that does not belong
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
index 4f9549bedf..cb4fb17fee 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
@@ -47,11 +47,13 @@ This rule is triggered when a hash indicator from the Threat Intel Filebeat modu
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and Analysis
 
-### Investigating Threat Intel Hash Indicator Match
+*Triage and Analysis*
+
+
+
+*Investigating Threat Intel Hash Indicator Match*
+
 
 Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index.
 
@@ -60,9 +62,11 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a hash indicator from the Threat Intel Filebeat module or an indicator ingested from a threat intelligence integration matches against an event that contains file hashes, such as antivirus alerts, file operation events, etc.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Gain context about the field that matched the local observation. This information can be found in the `threat.indicator.matched.field` field.
 - Investigate the hash , which can be found in the `threat.indicator.matched.atomic` field:
@@ -85,11 +89,15 @@ This rule is triggered when a hash indicator from the Threat Intel Filebeat modu
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
 - Using the data collected through the analysis, scope users targeted and other machines infected in the environment.
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - Adversaries often use legitimate tools as network administrators, such as `PsExec` or `AdFind`. These tools are often included in indicator lists, which creates the potential for false positives.
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -104,7 +112,18 @@ This rule is triggered when a hash indicator from the Threat Intel Filebeat modu
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule needs threat intelligence indicators to work.
+Threat intelligence indicators can be collected using an https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration],
+the https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module],
+or a https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
+
+More information can be found https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html[here].
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
index 1a23ad67ae..19eec72bfd 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
@@ -48,11 +48,13 @@ This rule is triggered when an IP address indicator from the Threat Intel Filebe
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and Analysis
 
-### Investigating Threat Intel IP Address Indicator Match
+*Triage and Analysis*
+
+
+
+*Investigating Threat Intel IP Address Indicator Match*
+
 
 Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index.
 
@@ -61,9 +63,11 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against a network event.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Gain context about the field that matched the local observation so you can understand the nature of the connection. This information can be found in the `threat.indicator.matched.field` field.
 - Investigate the IP address, which can be found in the `threat.indicator.matched.atomic` field:
@@ -85,13 +89,17 @@ This rule is triggered when an IP address indicator from the Threat Intel Filebe
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
 - Using the data collected through the analysis, scope users targeted and other machines infected in the environment.
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - When a match is found, it's important to consider the indicator's initial release date. Threat intelligence is useful for augmenting existing security processes but can quickly become outdated. In other words, some threat intelligence only represents a specific set of activity observed at a specific time. For example, an IP address may have hosted malware observed in a Dridex campaign months ago, but it's possible that IP has been remediated and no longer represents any threat.
 - False positives might occur after large and publicly written campaigns if curious employees interact with attacker infrastructure.
 - Some feeds may include internal or known benign addresses by mistake (e.g., 8.8.8.8, google.com, 127.0.0.1, etc.). Make sure you understand how blocking a specific domain or address might impact the organization or normal system functioning.
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -106,7 +114,18 @@ This rule is triggered when an IP address indicator from the Threat Intel Filebe
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule needs threat intelligence indicators to work.
+Threat intelligence indicators can be collected using an https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration],
+the https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module],
+or a https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
+
+More information can be found https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html[here].
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
index 09b55a22c4..d7136e3d21 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
@@ -48,11 +48,13 @@ This rule is triggered when a URL indicator from the Threat Intel Filebeat modul
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and Analysis
 
-### Investigating Threat Intel URL Indicator Match
+*Triage and Analysis*
+
+
+
+*Investigating Threat Intel URL Indicator Match*
+
 
 Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index.
 
@@ -61,9 +63,11 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a URL indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains URL data, like DNS events, network logs, etc.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the URL, which can be found in the `threat.indicator.matched.atomic` field:
   - Identify the type of malicious activity related to the URL (phishing, malware, etc.).
@@ -88,12 +92,16 @@ This rule is triggered when a URL indicator from the Threat Intel Filebeat modul
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
 - Using the data collected through the analysis, scope users targeted and other machines infected in the environment.
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - False positives might occur after large and publicly written campaigns if curious employees interact with attacker infrastructure.
 - Some feeds may include internal or known benign addresses by mistake (e.g., 8.8.8.8, google.com, 127.0.0.1, etc.). Make sure you understand how blocking a specific domain or address might impact the organization or normal system functioning.
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -109,7 +117,18 @@ This rule is triggered when a URL indicator from the Threat Intel Filebeat modul
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule needs threat intelligence indicators to work.
+Threat intelligence indicators can be collected using an https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration],
+the https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module],
+or a https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
+
+More information can be found https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html[here].
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
index f128cfdc7d..49d54e1929 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
@@ -47,11 +47,13 @@ This rule is triggered when a Windows registry indicator from the Threat Intel F
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and Analysis
 
-### Investigating Threat Intel Windows Registry Indicator Match
+*Triage and Analysis*
+
+
+
+*Investigating Threat Intel Windows Registry Indicator Match*
+
 
 Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index.
 
@@ -60,9 +62,11 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains registry data.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Check related threat reports to gain context about the registry indicator of compromise (IoC) and to understand if it's a system-native mechanism abused for persistence, to store data, to disable security mechanisms, etc. Use this information to define the appropriate triage and respond steps.
 - Identify the process responsible for the registry operation and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
@@ -80,11 +84,15 @@ This rule is triggered when a Windows registry indicator from the Threat Intel F
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
 - Using the data collected through the analysis, scope users targeted and other machines infected in the environment.
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - Adversaries can leverage dual-use registry mechanisms that are commonly used by normal applications. These registry keys can be added into indicator lists creating the potential for false positives.
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -99,7 +107,18 @@ This rule is triggered when a Windows registry indicator from the Threat Intel F
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule needs threat intelligence indicators to work.
+Threat intelligence indicators can be collected using an https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration],
+the https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module],
+or a https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
+
+More information can be found https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html[here].
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/timestomping-using-touch-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/timestomping-using-touch-command.asciidoc
index 1084901ea4..d624fb9685 100644
--- a/docs/detections/prebuilt-rules/rule-details/timestomping-using-touch-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/timestomping-using-touch-command.asciidoc
@@ -40,6 +40,17 @@ Timestomping is an anti-forensics technique which is used to modify the timestam
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc
index 5146009c3f..40f8c67d93 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc
@@ -46,6 +46,17 @@ Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc
index e59d0490c0..1071dbbe8f 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc
@@ -46,6 +46,17 @@ Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. A
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
index ad1d1c5525..42b816dc48 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
@@ -50,22 +50,26 @@ Identifies an attempt to bypass User Account Control (UAC) by masquerading as a
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating UAC Bypass Attempt via Windows Directory Masquerading
+*Triage and analysis*
+
+
+
+*Investigating UAC Bypass Attempt via Windows Directory Masquerading*
+
 
 Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.
 
-For more information about the UAC and how it works, check the [official Microsoft docs page](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works).
+For more information about the UAC and how it works, check the https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works[official Microsoft docs page].
 
 This rule identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -86,11 +90,15 @@ This rule identifies an attempt to bypass User Account Control (UAC) by masquera
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -106,7 +114,17 @@ This rule identifies an attempt to bypass User Account Control (UAC) by masquera
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc
index f59b4006fe..ea30362974 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc
@@ -46,6 +46,17 @@ Identifies attempts to bypass User Account Control (UAC) by abusing an elevated
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc
index 695a7cfaf6..12ceec9809 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc
@@ -45,6 +45,17 @@ Identifies User Account Control (UAC) bypass via hijacking DiskCleanup Scheduled
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-icmluautil-elevated-com-interface.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-icmluautil-elevated-com-interface.asciidoc
index 1b7a089145..46711e390f 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-icmluautil-elevated-com-interface.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-icmluautil-elevated-com-interface.asciidoc
@@ -44,6 +44,17 @@ Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevate
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
index 3894575b12..b2b9c2168d 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
@@ -49,22 +49,26 @@ Identifies attempts to bypass User Account Control (UAC) by hijacking the Micros
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating UAC Bypass via Windows Firewall Snap-In Hijack
+*Triage and analysis*
+
+
+
+*Investigating UAC Bypass via Windows Firewall Snap-In Hijack*
+
 
 Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.
 
-For more information about the UAC and how it works, check the [official Microsoft docs page](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works).
+For more information about the UAC and how it works, check the https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works[official Microsoft docs page].
 
 This rule identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -85,11 +89,15 @@ This rule identifies attempts to bypass User Account Control (UAC) by hijacking
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -105,7 +113,17 @@ This rule identifies attempts to bypass User Account Control (UAC) by hijacking
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uid-elevation-from-previously-unknown-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/uid-elevation-from-previously-unknown-executable.asciidoc
index 255c21e288..2c76988d44 100644
--- a/docs/detections/prebuilt-rules/rule-details/uid-elevation-from-previously-unknown-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uid-elevation-from-previously-unknown-executable.asciidoc
@@ -39,6 +39,44 @@ Monitors for the elevation of regular user permissions to root permissions throu
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Elastic Defend and select the integration to see more details about it.
+- Click Add Elastic Defend.
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click Save and Continue.
+- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unauthorized-access-to-an-okta-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/unauthorized-access-to-an-okta-application.asciidoc
index cac33af7ed..7d4b2ff7ee 100644
--- a/docs/detections/prebuilt-rules/rule-details/unauthorized-access-to-an-okta-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unauthorized-access-to-an-okta-application.asciidoc
@@ -45,10 +45,12 @@ Identifies unauthorized access attempts to Okta applications.
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unexpected-child-process-of-macos-screensaver-engine.asciidoc b/docs/detections/prebuilt-rules/rule-details/unexpected-child-process-of-macos-screensaver-engine.asciidoc
index 0ccbd393d9..73ca082076 100644
--- a/docs/detections/prebuilt-rules/rule-details/unexpected-child-process-of-macos-screensaver-engine.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unexpected-child-process-of-macos-screensaver-engine.asciidoc
@@ -44,9 +44,9 @@ Identifies when a child process is spawned by the screensaver engine process, wh
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
+
+*Triage and analysis*
+
 
 - Analyze the descendant processes of the ScreenSaverEngine process for malicious code and suspicious behavior such
 as a download of a payload from a server.
@@ -54,7 +54,41 @@ as a download of a payload from a server.
 identify whether the file is malicious or not.
 
 
-----------------------------------
+
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc b/docs/detections/prebuilt-rules/rule-details/unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc
index 9a835f92f9..46fff93b8d 100644
--- a/docs/detections/prebuilt-rules/rule-details/unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc
@@ -38,6 +38,17 @@ Identifies a Windows trusted program running from locations often abused by adve
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
index 6eaa986b59..8b8a79764f 100644
--- a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
@@ -45,11 +45,13 @@ Identifies attempt to load an untrusted driver. Adversaries may modify code sign
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Untrusted Driver Loaded
+*Triage and analysis*
+
+
+
+*Investigating Untrusted Driver Loaded*
+
 
 Microsoft created the Windows Driver Signature Enforcement (DSE) security feature to prevent drivers with invalid signatures from loading and executing into the kernel (ring 0). DSE aims to protect systems by blocking attackers from loading malicious drivers on targets. 
 
@@ -58,9 +60,11 @@ This protection is essential for maintaining system security. However, attackers
 This rule identifies an attempt to load an untrusted driver, which effectively means that DSE was disabled or bypassed. This can indicate that the system was compromised.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Examine the driver loaded to identify potentially suspicious characteristics. The following actions can help you gain context:
   - Identify the path that the driver was loaded from. If you're using Elastic Defend, path information can be found in the `dll.path` field.
@@ -77,17 +81,23 @@ This rule identifies an attempt to load an untrusted driver, which effectively m
 - Identify the driver's `Device Name` and `Service Name`.
 - Check for alerts from the rules specified in the `Related Rules` section.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
 
-### Related Rules
+
+*Related Rules*
+
 
 - First Time Seen Driver Loaded - df0fd41e-5590-4965-ad5e-cd079ec22fa9
 - Code Signing Policy Modification Through Registry - da7733b1-fe08-487e-b536-0a04c6d8b0cd
 - Code Signing Policy Modification Through Built-in tools - b43570de-a908-4f7f-8bdb-b2df6ffd8c80
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -106,7 +116,6 @@ This rule identifies an attempt to load an untrusted driver, which effectively m
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-aws-command-for-a-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-aws-command-for-a-user.asciidoc
index c024ec36a1..888e7fae81 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-aws-command-for-a-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-aws-command-for-a-user.asciidoc
@@ -42,11 +42,13 @@ A machine learning job detected an AWS API command that, while not inherently su
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual AWS Command for a User
+*Triage and analysis*
+
+
+
+*Investigating Unusual AWS Command for a User*
+
 
 CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.
 
@@ -54,7 +56,9 @@ This rule uses a machine learning job to detect an AWS API command that while no
 
 Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the calling IAM user.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account involved and the action performed. Verify whether it should perform this kind of action.
     - Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.
@@ -70,18 +74,24 @@ Detection alerts from this rule indicate an AWS API command or method call that
 - Contact the account owner and confirm whether they are aware of this activity if suspicious.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Unusual City For an AWS Command - 809b70d3-e2c3-455e-af1b-2626a5a1a276
 - Unusual Country For an AWS Command - dca28dee-c999-400f-b640-50a081cc0fd1
 - Rare AWS Error Code - 19de8096-e2b0-4bd8-80c9-34a820813fff
 - Spike in AWS Error Messages - 78d3d8d9-b476-451d-a9e0-7a5addd70670
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -95,8 +105,12 @@ Detection alerts from this rule indicate an AWS API command or method call that
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc
index 9088b0d94c..b8798f51ef 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc
@@ -42,6 +42,17 @@ Identifies a suspicious child process of the Windows virtual system process, whi
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc
index bfdaa0b1ab..2843080da7 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc
@@ -52,17 +52,21 @@ Identifies an unexpected process spawning from dns.exe, the process responsible
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual Child Process of dns.exe
+*Triage and analysis*
+
+
+
+*Investigating Unusual Child Process of dns.exe*
+
 
 SIGRed (CVE-2020-1350) is a wormable, critical vulnerability in the Windows DNS server that affects Windows Server versions 2003 to 2019 and can be triggered by a malicious DNS response. Because the service is running in elevated privileges (SYSTEM), an attacker that successfully exploits it is granted Domain Administrator rights. This can effectively compromise the entire corporate infrastructure.
 
 This rule looks for unusual children of the `dns.exe` process, which can indicate the exploitation of the SIGRed or a similar remote code execution vulnerability in the DNS server.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes.
   - Any suspicious or abnormal child process spawned from dns.exe should be carefully reviewed and investigated. It's impossible to predict what an adversary may deploy as the follow-on process after the exploit, but built-in discovery/enumeration utilities should be top of mind (`whoami.exe`, `netstat.exe`, `systeminfo.exe`, `tasklist.exe`).
@@ -73,11 +77,15 @@ This rule looks for unusual children of the `dns.exe` process, which can indicat
 - Check whether the server is vulnerable to CVE-2020-1350.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -91,7 +99,17 @@ This rule looks for unusual children of the `dns.exe` process, which can indicat
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-child-processes-of-rundll32.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-child-processes-of-rundll32.asciidoc
index 34596e9b55..de514978e0 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-child-processes-of-rundll32.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-child-processes-of-rundll32.asciidoc
@@ -43,20 +43,24 @@ Identifies child processes of unusual instances of RunDLL32 where the command li
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual Child Processes of RunDLL32
+*Triage and analysis*
+
+
+
+*Investigating Unusual Child Processes of RunDLL32*
+
 
 By examining the specific traits of Windows binaries -- such as process trees, command lines, network connections, registry modifications, and so on -- it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading and deserve further investigation.
 
 RunDLL32 is a legitimate Windows utility used to load and execute functions within dynamic-link libraries (DLLs). However, adversaries may abuse RunDLL32 to execute malicious code, bypassing security measures and evading detection. This rule identifies potential abuse by looking for an unusual process creation with no arguments followed by the creation of a child process.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -78,15 +82,21 @@ RunDLL32 is a legitimate Windows utility used to load and execute functions with
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Unusual Network Connection via RunDLL32 - 52aaab7b-b51c-441a-89ce-4387b3aea886
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -101,7 +111,6 @@ RunDLL32 is a legitimate Windows utility used to load and execute functions with
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-city-for-an-aws-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-city-for-an-aws-command.asciidoc
index e0b30db27b..905e0fa53c 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-city-for-an-aws-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-city-for-an-aws-command.asciidoc
@@ -42,11 +42,13 @@ A machine learning job detected AWS command activity that, while not inherently
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual City For an AWS Command
+*Triage and analysis*
+
+
+
+*Investigating Unusual City For an AWS Command*
+
 
 CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.
 
@@ -54,7 +56,9 @@ This rule uses a machine learning job to detect an AWS API command that while no
 
 Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account involved and the action performed. Verify whether it should perform this kind of action.
     - Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.
@@ -70,19 +74,25 @@ Detection alerts from this rule indicate an AWS API command or method call that
 - Contact the account owner and confirm whether they are aware of this activity if suspicious.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - False positives can occur if activity is coming from new employees based in a city with no previous history in AWS.
 - Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Unusual Country For an AWS Command - dca28dee-c999-400f-b640-50a081cc0fd1
 - Unusual AWS Command for a User - ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1
 - Rare AWS Error Code - 19de8096-e2b0-4bd8-80c9-34a820813fff
 - Spike in AWS Error Messages - 78d3d8d9-b476-451d-a9e0-7a5addd70670
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -96,8 +106,12 @@ Detection alerts from this rule indicate an AWS API command or method call that
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-country-for-an-aws-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-country-for-an-aws-command.asciidoc
index bd103be201..7012cce44d 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-country-for-an-aws-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-country-for-an-aws-command.asciidoc
@@ -42,11 +42,13 @@ A machine learning job detected AWS command activity that, while not inherently
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual Country For an AWS Command
+*Triage and analysis*
+
+
+
+*Investigating Unusual Country For an AWS Command*
+
 
 CloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.
 
@@ -54,7 +56,9 @@ This rule uses a machine learning job to detect an AWS API command that while no
 
 Detection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account involved and the action performed. Verify whether it should perform this kind of action.
     - Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.
@@ -70,19 +74,25 @@ Detection alerts from this rule indicate an AWS API command or method call that
 - Contact the account owner and confirm whether they are aware of this activity if suspicious.
 - If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - False positives can occur if activity is coming from new employees based in a country with no previous history in AWS.
 - Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Unusual City For an AWS Command - 809b70d3-e2c3-455e-af1b-2626a5a1a276
 - Unusual AWS Command for a User - ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1
 - Rare AWS Error Code - 19de8096-e2b0-4bd8-80c9-34a820813fff
 - Spike in AWS Error Messages - 78d3d8d9-b476-451d-a9e0-7a5addd70670
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Disable or limit the account during the investigation and response.
@@ -96,8 +106,12 @@ Detection alerts from this rule indicate an AWS API command or method call that
 - Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
 - Consider enabling multi-factor authentication for users.
 - Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
-- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.
+- Implement security best practices https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/[outlined] by AWS.
 - Take the actions needed to return affected systems, data, or services to their normal operational levels.
 - Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
-----------------------------------
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
index a87a6ad71e..58fd01f716 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
@@ -47,20 +47,24 @@ Identifies an unexpected executable file being created or modified by a Windows
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual Executable File Creation by a System Critical Process
+*Triage and analysis*
+
+
+
+*Investigating Unusual Executable File Creation by a System Critical Process*
+
 
 Windows internal/system processes have some characteristics that can be used to spot suspicious activities. One of these characteristics is file operations.
 
 This rule looks for the creation of executable files done by system-critical processes. This can indicate the exploitation of a vulnerability or a malicious process masquerading as a system-critical process.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -81,11 +85,15 @@ This rule looks for the creation of executable files done by system-critical pro
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -100,7 +108,17 @@ This rule looks for the creation of executable files done by system-critical pro
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
index c90ae1b321..d158a1e2a5 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
@@ -44,11 +44,13 @@ Identifies suspicious creation of Alternate Data Streams on highly targeted file
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual File Creation - Alternate Data Stream
+*Triage and analysis*
+
+
+
+*Investigating Unusual File Creation - Alternate Data Stream*
+
 
 Alternate Data Streams (ADS) are file attributes only found on the NTFS file system. In this file system, files are built up from a couple of attributes; one of them is $Data, also known as the data attribute.
 
@@ -57,9 +59,11 @@ The regular data stream, also referred to as the unnamed data stream since the n
 Attackers can abuse these alternate data streams to hide malicious files, string payloads, etc. This rule detects the creation of alternate data streams on highly targeted file types.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Retrieve the contents of the alternate data stream, and analyze it for potential maliciousness. Analysts can use the following PowerShell cmdlet to accomplish this:
   - `Get-Content C:\Path\To\file.exe -stream SampleAlternateDataStreamName`
@@ -83,11 +87,15 @@ Attackers can abuse these alternate data streams to hide malicious files, string
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of process executable and file conditions.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -103,7 +111,17 @@ Attackers can abuse these alternate data streams to hide malicious files, string
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns-exe.asciidoc
index abf8cedfab..437e53d805 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns-exe.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns-exe.asciidoc
@@ -50,17 +50,29 @@ Identifies an unexpected file being modified by dns.exe, the process responsible
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual File Write
+*Triage and analysis*
+
+
+
+*Investigating Unusual File Write*
+
 Detection alerts from this rule indicate potential unusual/abnormal file writes from the DNS Server service process (`dns.exe`) after exploitation from CVE-2020-1350 (SigRed) has occurred. Here are some possible avenues of investigation:
 - Post-exploitation, adversaries may write additional files or payloads to the system as additional discovery/exploitation/persistence mechanisms.
 - Any suspicious or abnormal files written from `dns.exe` should be reviewed and investigated with care.
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-hour-for-a-user-to-logon.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-hour-for-a-user-to-logon.asciidoc
index 439db0656d..50d11e77a5 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-hour-for-a-user-to-logon.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-hour-for-a-user-to-logon.asciidoc
@@ -42,32 +42,39 @@ A machine learning job detected a user logging in at a time of day that is unusu
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual Hour for a User to Logon
+*Triage and analysis*
+
+
+
+*Investigating Unusual Hour for a User to Logon*
+
 
 This rule uses a machine learning job to detect a user logging in at a time of day that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different time zones. It can also indicate unauthorized user activity, as it often occurs during non-business hours.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate any abnormal account behavior, such as command executions, file creations or modifications, network connections, data access, and logon events.
 - Investigate other alerts associated with the involved users during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Users may need to log in during non-business hours to perform work-related tasks. Examine whether the company policies authorize this or if the activity is done under change management.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-activity.asciidoc
index a22e7b08ca..9a141caad8 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-linux-network-activity.asciidoc
@@ -41,15 +41,16 @@ Identifies Linux processes that do not usually use the network but have unexpect
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual Network Activity
+*Triage and analysis*
+
+
+
+*Investigating Unusual Network Activity*
+
 Detection alerts from this rule indicate the presence of network activity from a Linux process for which network activity is rare and unusual.  Here are some possible avenues of investigation:
 - Consider the IP addresses and ports. Are these used by normal but infrequent network workflows? Are they expected or unexpected?
 - If the destination IP address is remote or external, does it associate with an expected domain, organization or geography? Note: avoid interacting directly with suspected malicious IP addresses.
 - Consider the user as identified by the username field. Is this network activity part of an expected workflow for the user who ran the program?
 - Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business or maintenance process.
 - Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.
-----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-linux-username.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-linux-username.asciidoc
index a44710ac4d..c0d065d500 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-linux-username.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-linux-username.asciidoc
@@ -42,16 +42,17 @@ A machine learning job detected activity for a username that is not normally act
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating an Unusual Linux User
+*Triage and analysis*
+
+
+
+*Investigating an Unusual Linux User*
+
 Detection alerts from this rule indicate activity for a Linux user name that is rare and unusual. Here are some possible avenues of investigation:
 - Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? Could this be related to troubleshooting or debugging activity by a developer or site reliability engineer?
 - Examine the history of user activity. If this user only manifested recently, it might be a service account for a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process.
 - Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks that the user is performing.
-----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
index 5244aa03db..6c65903a91 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
@@ -44,20 +44,24 @@ Identifies network activity from unexpected system applications. This may indica
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual Network Activity from a Windows System Binary
+*Triage and analysis*
+
+
+
+*Investigating Unusual Network Activity from a Windows System Binary*
+
 
 Attackers can abuse certain trusted developer utilities to proxy the execution of malicious payloads. Since these utilities are usually signed, they can bypass the security controls that were put in place to prevent or detect direct execution.
 
 This rule identifies network connections established by trusted developer utilities, which can indicate abuse to execute payloads or process masquerading.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate abnormal behaviors observed by the subject process, such as registry or file modifications, and any spawned child processes.
@@ -76,11 +80,15 @@ This rule identifies network connections established by trusted developer utilit
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - As trusted developer utilities have dual-use purposes, alerts derived from this rule are not essentially malicious. If these utilities are contacting internal or known trusted domains, review their security and consider creating exceptions if the domain is safe.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -100,7 +108,6 @@ This rule identifies network connections established by trusted developer utilit
     - Consider improvements to the security awareness program.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-network-connection-via-rundll32.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-network-connection-via-rundll32.asciidoc
index 9b938d2d21..8b75357a14 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-network-connection-via-rundll32.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-network-connection-via-rundll32.asciidoc
@@ -48,17 +48,21 @@ Identifies unusual instances of rundll32.exe making outbound network connections
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual Network Connection via RunDLL32
+*Triage and analysis*
+
+
+
+*Investigating Unusual Network Connection via RunDLL32*
+
 
 RunDLL32 is a built-in Windows utility and also a vital component used by the operating system itself. The functionality provided by RunDLL32 to execute Dynamic Link Libraries (DLLs) is widely abused by attackers, because it makes it hard to differentiate malicious activity from normal operations.
 
 This rule looks for external network connections established using RunDLL32 when the utility is being executed with no arguments, which can potentially indicate command and control activity.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -68,11 +72,15 @@ This rule looks for external network connections established using RunDLL32 when
 - Identify the target computer and its role in the IT environment.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -82,7 +90,6 @@ This rule looks for external network connections established using RunDLL32 when
 - Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
index 3564a3c19e..4cfe93160c 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
@@ -50,20 +50,24 @@ Identifies Windows programs run from unexpected parent processes. This could ind
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual Parent-Child Relationship
+*Triage and analysis*
+
+
+
+*Investigating Unusual Parent-Child Relationship*
+
 
 Windows internal/system processes have some characteristics that can be used to spot suspicious activities. One of these characteristics is parent-child relationships. These relationships can be used to baseline the typical behavior of the system and then alert on occurrences that don't comply with the baseline.
 
 This rule uses this information to spot suspicious parent and child processes.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -84,11 +88,15 @@ This rule uses this information to spot suspicious parent and child processes.
 - Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -103,7 +111,17 @@ This rule uses this information to spot suspicious parent and child processes.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd-exe.asciidoc
index 7037757657..cbc0d1999d 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd-exe.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd-exe.asciidoc
@@ -42,6 +42,17 @@ Identifies a suspicious parent child process relationship with cmd.exe descendin
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-print-spooler-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-print-spooler-child-process.asciidoc
index cbcbd00749..aa27129d1b 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-print-spooler-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-print-spooler-child-process.asciidoc
@@ -44,6 +44,17 @@ Detects unusual Print Spooler service (spoolsv.exe) child processes. This may in
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-execution-path-alternate-data-stream.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-execution-path-alternate-data-stream.asciidoc
index d042b6a730..822e380151 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-execution-path-alternate-data-stream.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-execution-path-alternate-data-stream.asciidoc
@@ -43,6 +43,17 @@ Identifies processes running from an Alternate Data Stream. This is uncommon for
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-extension.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-extension.asciidoc
index 39d62ef086..accdc0bb3a 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-extension.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-extension.asciidoc
@@ -30,7 +30,7 @@ Identifies processes running with unusual extensions that are not typically vali
 * Data Source: Elastic Defend
 * Rule Type: BBR
 
-*Version*: 2
+*Version*: 3
 
 *Rule authors*: 
 
@@ -61,7 +61,11 @@ process where host.os.type == "windows" and event.type == "start" and
     (process.name : "C9632CF058AE4321B6B0B5EA39B710FE" and process.code_signature.subject_name == "Dell Inc") or
     (process.name : "*.upd" and process.code_signature.subject_name == "Bloomberg LP") or
     (process.name: "FD552E21-686E-413C-931D-3B82A9D29F3B" and process.code_signature.subject_name: "Adobe Inc.") or
-    (process.name: "3B91051C-AE82-43C9-BCEF-0309CD2DD9EB" and process.code_signature.subject_name: "McAfee, LLC")
+    (process.name: "3B91051C-AE82-43C9-BCEF-0309CD2DD9EB" and process.code_signature.subject_name: "McAfee, LLC") or
+    (process.name: "soffice.bin" and process.code_signature.subject_name: "The Document Foundation") or
+    (process.name: ("VeeamVixProxy_*", "{????????-????-????-????-????????????}") and process.code_signature.subject_name: "Veeam Software Group GmbH") or
+    (process.name: "1cv8p64.bin" and process.code_signature.subject_name: "LLC 1C-Soft") or
+    (process.name: "AGSRunner.bin" and process.code_signature.subject_name: "Intel Corporation")
   )
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-linux-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-linux-host.asciidoc
index 5845e3c675..673eacf555 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-linux-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-linux-host.asciidoc
@@ -42,17 +42,21 @@ Identifies rare processes that do not usually run on individual hosts, which can
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-###  Investigating Unusual Process For a Linux Host
+*Triage and analysis*
+
+
+
+*Investigating Unusual Process For a Linux Host*
+
 
 Searching for abnormal Linux processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.
 
 This rule uses a machine learning job to detect a Linux process that is rare and unusual for an individual Linux host in your environment.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, and whether they are located in expected locations.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -61,12 +65,16 @@ This rule uses a machine learning job to detect a Linux process that is rare and
 - Validate if the activity has a consistent cadence (for example, if it runs monthly or quarterly), as it could be part of a monthly or quarterly business process.
 - Examine the arguments and working directory of the process. These may provide indications as to the source of the program or the nature of the tasks it is performing.
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -81,7 +89,6 @@ This rule uses a machine learning job to detect a Linux process that is rare and
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
index 1b251b68e7..37b22f35ca 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
@@ -43,20 +43,24 @@ Identifies rare processes that do not usually run on individual hosts, which can
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-###  Investigating Unusual Process For a Windows Host
+*Triage and analysis*
+
+
+
+*Investigating Unusual Process For a Windows Host*
+
 
 Searching for abnormal Windows processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.
 
 This rule uses a machine learning job to detect a Windows process that is rare and unusual for an individual Windows host in your environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
   - If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.
@@ -80,18 +84,24 @@ This rule uses a machine learning job to detect a Windows process that is rare a
       - !{osquery{"label":"Retrieve Service Unisgned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'"}}
   - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False Positive Analysis
+
+*False Positive Analysis*
+
 
 - If this activity is related to new benign software installation activity, consider adding exceptions — preferably with a combination of user and command line conditions.
 - Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Unusual Process For a Windows Host - 6d448b96-c922-4adb-b51c-b767f1ea5b76
 - Unusual Windows Path Activity - 445a342e-03fb-42d0-8656-0367eb2dead5
 - Unusual Windows Process Calling the Metadata Service - abae61a8-c560-4dbd-acca-1e1438bff36b
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -106,7 +116,6 @@ This rule uses a machine learning job to detect a Windows process that is rare a
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-mssql-service-accounts.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-mssql-service-accounts.asciidoc
index 76ad1e9859..e96d16762b 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-mssql-service-accounts.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-mssql-service-accounts.asciidoc
@@ -34,7 +34,7 @@ Identifies unusual process executions using MSSQL Service accounts, which can in
 * Data Source: Elastic Defend
 * Rule Type: BBR
 
-*Version*: 2
+*Version*: 3
 
 *Rule authors*: 
 
@@ -59,11 +59,27 @@ process where event.type == "start" and host.os.type == "windows" and
     "SQLWriter", "winmgmt"
   ) and user.domain : "NT SERVICE" and
   not (
-    process.name : (
+    (
+      process.name : (
         "sqlceip.exe", "sqlservr.exe", "sqlagent.exe",
         "msmdsrv.exe", "ReportingServicesService.exe",
-        "MsDtsSrvr.exe", "sqlbrowser.exe"
-    ) and (process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true)
+        "MsDtsSrvr.exe", "sqlbrowser.exe", "DTExec.exe",
+        "SQLPS.exe", "fdhost.exe", "fdlauncher.exe",
+        "SqlDumper.exe", "sqlsqm.exe", "DatabaseMail.exe"
+      ) or
+      process.executable : (
+        "?:\\Windows\\System32\\wermgr.exe",
+        "?:\\Windows\\System32\\conhost.exe",
+        "?:\\Windows\\System32\\WerFault.exe"
+      )
+    ) and
+    (
+      process.code_signature.subject_name : ("Microsoft Corporation", "Microsoft Windows") and
+      process.code_signature.trusted == true
+    )
+  ) and
+  not (
+    process.name : "cmd.exe" and process.parent.name : "sqlservr.exe"
   )
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-network-connection.asciidoc
index 447351ec0c..7104f5a77f 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-network-connection.asciidoc
@@ -44,26 +44,34 @@ Identifies network activity from unexpected system applications. This may indica
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual Process Network Connection
+*Triage and analysis*
+
+
+
+*Investigating Unusual Process Network Connection*
+
 
 This rule identifies network activity from unexpected system utilities and applications. These applications are commonly abused by attackers to execute code, evade detections, and bypass security protections.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate the target host that the process is communicating with.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -73,7 +81,6 @@ This rule identifies network activity from unexpected system utilities and appli
 - Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-host.asciidoc
index 6144cfa63b..56d37bc811 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-host.asciidoc
@@ -41,6 +41,75 @@ A machine learning job has detected a suspicious Windows process. This process h
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
+*Anomaly Detection Setup*
+
+Before you can enable this rule, you'll need to enable the corresponding Anomaly Detection job. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-parent-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-parent-process.asciidoc
index 49ef172bc0..d384d9318a 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-parent-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-parent-process.asciidoc
@@ -41,6 +41,75 @@ A machine learning job has detected a suspicious Windows process. This process h
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
+*Anomaly Detection Setup*
+
+Before you can enable this rule, you'll need to enable the corresponding Anomaly Detection job. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-user.asciidoc
index 5b439f0079..687081cbb8 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-user.asciidoc
@@ -41,6 +41,75 @@ A machine learning job has detected a suspicious Windows process. This process h
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
+*Anomaly Detection Setup*
+
+Before you can enable this rule, you'll need to enable the corresponding Anomaly Detection job. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-writing-data-to-an-external-device.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-writing-data-to-an-external-device.asciidoc
index a9d6977dc9..c63cf04d62 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-writing-data-to-an-external-device.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-writing-data-to-an-external-device.asciidoc
@@ -39,6 +39,41 @@ A machine learning job has detected a rare process writing data to an external d
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Data Exfiltration Detection integration assets to be installed, as well as network and file events collected by integrations such as Elastic Defend and Network Packet Capture (for network events only).  
+
+
+*Data Exfiltration Detection Setup*
+
+The Data Exfiltration Detection integration detects data exfiltration activity by identifying abnormalities in network and file events. Anomalies are detected using Elastic's Anomaly Detection feature. 
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Data Exfiltration Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- File events collected by the Elastic Defend integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+
+
+*The following steps should be executed to install assets associated with the Data Exfiltration Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Data Exfiltration Detection and select the integration to see more details about it.
+- Under Settings, click Install Data Exfiltration Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Data Exfiltration Detection, you'll need to enable the corresponding Anomaly Detection jobs. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your file events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/ded/kibana/ml_module/ded-ml.json[this] configuration file, you will see a card for Data Exfiltration Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-remote-file-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-remote-file-directory.asciidoc
index 488972e552..b317fc49dc 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-remote-file-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-remote-file-directory.asciidoc
@@ -40,6 +40,41 @@ An anomaly detection job has detected a remote file transfer on an unusual direc
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration.  
+
+
+*Lateral Movement Detection Setup*
+
+The Lateral Movement Detection integration detects lateral movement activity by identifying abnormalities in file and Windows RDP events. Anomalies are detected using Elastic's Anomaly Detection feature.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Lateral Movement Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- File events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+
+
+*The following steps should be executed to install assets associated with the Lateral Movement Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Lateral Movement Detection and select the integration to see more details about it.
+- Under Settings, click Install Lateral Movement Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Lateral Movement Detection, you'll need to enable the corresponding Anomaly Detection jobs.
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your file events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/lmd/kibana/ml_module/lmd-ml.json[this] configuration file, you will see a card for Lateral Movement Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-remote-file-extension.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-remote-file-extension.asciidoc
index 317abb729c..a3dbf41d2d 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-remote-file-extension.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-remote-file-extension.asciidoc
@@ -40,6 +40,41 @@ An anomaly detection job has detected a remote file transfer with a rare extensi
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration.  
+
+
+*Lateral Movement Detection Setup*
+
+The Lateral Movement Detection integration detects lateral movement activity by identifying abnormalities in file and Windows RDP events. Anomalies are detected using Elastic's Anomaly Detection feature.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Lateral Movement Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- File events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+
+
+*The following steps should be executed to install assets associated with the Lateral Movement Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Lateral Movement Detection and select the integration to see more details about it.
+- Under Settings, click Install Lateral Movement Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Lateral Movement Detection, you'll need to enable the corresponding Anomaly Detection jobs.
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your file events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/lmd/kibana/ml_module/lmd-ml.json[this] configuration file, you will see a card for Lateral Movement Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-remote-file-size.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-remote-file-size.asciidoc
index 4376fef532..6396bf0f33 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-remote-file-size.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-remote-file-size.asciidoc
@@ -40,6 +40,41 @@ A machine learning job has detected an unusually high file size shared by a remo
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration.  
+
+
+*Lateral Movement Detection Setup*
+
+The Lateral Movement Detection integration detects lateral movement activity by identifying abnormalities in file and Windows RDP events. Anomalies are detected using Elastic's Anomaly Detection feature.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Lateral Movement Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- File events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+
+
+*The following steps should be executed to install assets associated with the Lateral Movement Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Lateral Movement Detection and select the integration to see more details about it.
+- Under Settings, click Install Lateral Movement Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Lateral Movement Detection, you'll need to enable the corresponding Anomaly Detection jobs.
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your file events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/lmd/kibana/ml_module/lmd-ml.json[this] configuration file, you will see a card for Lateral Movement Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-service-host-child-process-childless-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-service-host-child-process-childless-service.asciidoc
index 0202f75f46..4e7f909935 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-service-host-child-process-childless-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-service-host-child-process-childless-service.asciidoc
@@ -43,6 +43,17 @@ Identifies unusual child processes of Service Host (svchost.exe) that traditiona
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-time-or-day-for-an-rdp-session.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-time-or-day-for-an-rdp-session.asciidoc
index 1baa1bba8b..30f74848ee 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-time-or-day-for-an-rdp-session.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-time-or-day-for-an-rdp-session.asciidoc
@@ -40,6 +40,42 @@ A machine learning job has detected an RDP session started at an usual time or w
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration.  
+
+
+*Lateral Movement Detection Setup*
+
+The Lateral Movement Detection integration detects lateral movement activity by identifying abnormalities in file and Windows RDP events. Anomalies are detected using Elastic's Anomaly Detection feature.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Lateral Movement Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows RDP process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration.
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+
+
+*The following steps should be executed to install assets associated with the Lateral Movement Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Lateral Movement Detection and select the integration to see more details about it.
+- Under Settings, click Install Lateral Movement Detection assets and follow the prompts to install the assets.
+
+
+*Anomaly Detection Setup*
+
+Before you can enable rules for Lateral Movement Detection, you'll need to enable the corresponding Anomaly Detection jobs.
+- Before enabling the Anomaly Detection jobs, confirm that the Pivot Transform asset is installed and actively gathering data in the destination index `ml-rdp-lmd`.
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your transformed RDP process data i.e.`ml-rdp-lmd`.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/lmd/kibana/ml_module/lmd-ml.json[this] configuration file, you will see a card for Lateral Movement Detection under "Use preconfigured jobs".
+- Keep the default settings and click "Create jobs" to start the anomaly detection jobs and datafeeds.
+
+
 *Framework*: MITRE ATT&CK^TM^
 
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-user-privilege-enumeration-via-id.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-user-privilege-enumeration-via-id.asciidoc
index 0346961b78..66cb981065 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-user-privilege-enumeration-via-id.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-user-privilege-enumeration-via-id.asciidoc
@@ -38,6 +38,41 @@ This rule monitors for a sequence of 20 "id" command executions within 1 second
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-windows-network-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-windows-network-activity.asciidoc
index 13bb719cb3..4916756fa0 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-windows-network-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-windows-network-activity.asciidoc
@@ -41,11 +41,13 @@ Identifies Windows processes that do not usually use the network but have unexpe
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Unusual Network Activity
+*Triage and analysis*
+
+
+
+*Investigating Unusual Network Activity*
+
 Detection alerts from this rule indicate the presence of network activity from a Windows process for which network activity is very unusual.  Here are some possible avenues of investigation:
 - Consider the IP addresses, protocol and ports. Are these used by normal but infrequent network workflows? Are they expected or unexpected?
 - If the destination IP address is remote or external, does it associate with an expected domain, organization or geography? Note: avoid interacting directly with suspected malicious IP addresses.
@@ -54,4 +56,3 @@ Detection alerts from this rule indicate the presence of network activity from a
 - Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.
 - Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.
 - If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools.
-----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-windows-remote-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-windows-remote-user.asciidoc
index 99162705ee..4b08d9e2c6 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-windows-remote-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-windows-remote-user.asciidoc
@@ -42,15 +42,16 @@ A machine learning job detected an unusual remote desktop protocol (RDP) usernam
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating an Unusual Windows User
+*Triage and analysis*
+
+
+
+*Investigating an Unusual Windows User*
+
 Detection alerts from this rule indicate activity for a rare and unusual Windows RDP (remote desktop) user. Here are some possible avenues of investigation:
 - Consider the user as identified by the username field. Is the user part of a group who normally logs into Windows hosts using RDP (remote desktop protocol)? Is this logon activity part of an expected workflow for the user?
 - Consider the source of the login. If the source is remote, could this be related to occasional troubleshooting or support activity by a vendor or an employee working remotely?
-----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-windows-username.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-windows-username.asciidoc
index f2b603e2c1..17d4473ba5 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-windows-username.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-windows-username.asciidoc
@@ -42,17 +42,18 @@ A machine learning job detected activity for a username that is not normally act
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating an Unusual Windows User
+*Triage and analysis*
+
+
+
+*Investigating an Unusual Windows User*
+
 Detection alerts from this rule indicate activity for a Windows user name that is rare and unusual. Here are some possible avenues of investigation:
 - Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? Could this be related to occasional troubleshooting or support activity?
 - Examine the history of user activity. If this user only manifested recently, it might be a service account for a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process.
 - Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks that the user is performing.
 - Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.
-----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
 
diff --git a/docs/detections/prebuilt-rules/rule-details/user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/user-account-creation.asciidoc
index 2b13977ff7..b55afb7199 100644
--- a/docs/detections/prebuilt-rules/rule-details/user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/user-account-creation.asciidoc
@@ -46,33 +46,43 @@ Identifies attempts to create new users. This is sometimes done by attackers to
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating User Account Creation
+*Triage and analysis*
+
+
+
+*Investigating User Account Creation*
+
 
 Attackers may create new accounts (both local and domain) to maintain access to victim systems.
 
 This rule identifies the usage of `net.exe` to create new accounts.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Identify if the account was added to privileged groups or assigned special privileges after creation.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Account creation is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.
 
-### Related rules
+
+*Related rules*
+
 
 - Creation of a Hidden Local User Account - 2edc8076-291e-41e9-81e4-e3fcbc97ae5e
 - Windows User Account Creation - 38e17753-f581-4644-84da-0d60a8318694
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -82,7 +92,17 @@ This rule identifies the usage of `net.exe` to create new accounts.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/user-account-exposed-to-kerberoasting.asciidoc b/docs/detections/prebuilt-rules/rule-details/user-account-exposed-to-kerberoasting.asciidoc
index 5bfe95e8be..5ab7ea71ae 100644
--- a/docs/detections/prebuilt-rules/rule-details/user-account-exposed-to-kerberoasting.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/user-account-exposed-to-kerberoasting.asciidoc
@@ -52,11 +52,13 @@ Detects when a user account has the servicePrincipalName attribute modified. Att
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating User account exposed to Kerberoasting
+*Triage and analysis*
+
+
+
+*Investigating User account exposed to Kerberoasting*
+
 
 Service Principal Names (SPNs) are names by which Kerberos clients uniquely identify service instances for Kerberos target computers.
 
@@ -64,11 +66,13 @@ By default, only computer accounts have SPNs, which creates no significant risk,
 
 A user account with an SPN assigned is considered a service account, and is accessible to the entire domain. If any user in the directory requests a ticket-granting service (TGS), the domain controller will encrypt it with the secret key of the account executing the service. An attacker can potentially perform a Kerberoasting attack with this information, as the human-defined password is likely to be less complex.
 
-For scenarios where SPNs cannot be avoided on user accounts, Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that account passwords are robust and changed regularly and automatically. More information can be found [here](https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview).
+For scenarios where SPNs cannot be avoided on user accounts, Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that account passwords are robust and changed regularly and automatically. More information can be found https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview[here].
 
 Attackers can also perform "Targeted Kerberoasting", which consists of adding fake SPNs to user accounts that they have write privileges to, making them potentially vulnerable to Kerberoasting.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
@@ -76,11 +80,15 @@ Attackers can also perform "Targeted Kerberoasting", which consists of adding fa
 - Investigate if tickets have been requested for the target account.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - The use of user accounts as service accounts is a bad security practice and should not be allowed in the domain. The security team should map and monitor any potential benign true positive (B-TP), especially if the account is privileged. Domain Administrators that define this kind of setting can put the domain at risk as user accounts don't have the same security standards as computer accounts (which have long, complex, random passwords that change frequently), exposing them to credential cracking attacks (Kerberoasting, brute force, etc.).
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. Prioritize privileged accounts.
@@ -89,7 +97,32 @@ Attackers can also perform "Targeted Kerberoasting", which consists of adding fa
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success,Failure)
+```
+
+The above policy does not cover User objects, so set up an AuditRule using https://github.com/OTRF/Set-AuditRule.
+As this specifies the servicePrincipalName Attribute GUID, it is expected to be low noise.
+
+```
+Set-AuditRule -AdObjectPath 'AD:\CN=Users,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights WriteProperty -InheritanceFlags Children -AttributeGUID f3a64788-5306-11d1-a9c5-0000f80367c1 -AuditFlags Success
+```
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-application.asciidoc
index f35f51192a..7ccefa98bd 100644
--- a/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-application.asciidoc
@@ -41,10 +41,12 @@ Identifies when a user is added as an owner for an Azure application. An adversa
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-service-principal.asciidoc b/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-service-principal.asciidoc
index ea60b5220a..4893b7473f 100644
--- a/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-service-principal.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/user-added-as-owner-for-azure-service-principal.asciidoc
@@ -43,10 +43,12 @@ Identifies when a user is added as an owner for an Azure service principal. The
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
 
-----------------------------------
+
+==== Setup
+
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/user-added-to-privileged-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/user-added-to-privileged-group.asciidoc
index b4b43d2f88..27e6046f09 100644
--- a/docs/detections/prebuilt-rules/rule-details/user-added-to-privileged-group.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/user-added-to-privileged-group.asciidoc
@@ -48,11 +48,13 @@ Identifies a user being added to a privileged group in Active Directory. Privile
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating User Added to Privileged Group in Active Directory
+*Triage and analysis*
+
+
+
+*Investigating User Added to Privileged Group in Active Directory*
+
 
 Privileged accounts and groups in Active Directory are those to which powerful rights, privileges, and permissions are granted that allow them to perform nearly any action in Active Directory and on domain-joined systems.
 
@@ -60,17 +62,23 @@ Attackers can add users to privileged groups to maintain a level of access if th
 
 This rule monitors events related to a user being added to a privileged group.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should manage members of this group.
 - Contact the account owner and confirm whether they are aware of this activity.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This attack abuses a legitimate Active Directory mechanism, so it is important to determine whether the activity is legitimate, if the administrator is authorized to perform this operation, and if there is a need to grant the account this level of privilege.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - If the admin is not aware of the operation, activate your Active Directory incident response plan.
@@ -80,7 +88,17 @@ This rule monitors events related to a user being added to a privileged group.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting-via-grep.asciidoc b/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting-via-grep.asciidoc
index a0da3d4bd8..ed344ddfc9 100644
--- a/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting-via-grep.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting-via-grep.asciidoc
@@ -42,6 +42,17 @@ An adversary may attempt to get detailed information about the operating system
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting.asciidoc b/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting.asciidoc
index 65561e1817..9922e4ea9d 100644
--- a/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/virtual-machine-fingerprinting.asciidoc
@@ -41,6 +41,57 @@ An adversary may attempt to get detailed information about the operating system
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+- Auditbeat
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+*Auditbeat Setup*
+
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+
+*The following steps should be executed in order to add the Auditbeat on a Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete “Setup and Run Auditbeat” information refer to the https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/virtual-private-network-connection-attempt.asciidoc b/docs/detections/prebuilt-rules/rule-details/virtual-private-network-connection-attempt.asciidoc
index 76924a3398..b88b8f379b 100644
--- a/docs/detections/prebuilt-rules/rule-details/virtual-private-network-connection-attempt.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/virtual-private-network-connection-attempt.asciidoc
@@ -42,6 +42,41 @@ Identifies the execution of macOS built-in commands to connect to an existing Vi
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc
index 25c69e075f..59b0377085 100644
--- a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc
@@ -47,11 +47,13 @@ Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Volume Shadow Copy Deleted or Resized via VssAdmin
+*Triage and analysis*
+
+
+
+*Investigating Volume Shadow Copy Deleted or Resized via VssAdmin*
+
 
 The Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes that can later be restored or mounted to recover specific files or folders.
 
@@ -59,7 +61,9 @@ A typical step in the playbook of an attacker attempting to deploy ransomware is
 
 This rule monitors the execution of Vssadmin.exe to either delete or resize shadow copies.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -79,16 +83,22 @@ This rule monitors the execution of Vssadmin.exe to either delete or resize shad
 - Check if any files on the host machine have been encrypted.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This rule may produce benign true positives (B-TPs). If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
 
-### Related rules
+
+*Related rules*
+
 
 - Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921
 - Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.
@@ -108,7 +118,17 @@ This rule monitors the execution of Vssadmin.exe to either delete or resize shad
 
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-powershell.asciidoc
index 69614bb0c0..b60dd02eb6 100644
--- a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-powershell.asciidoc
@@ -53,11 +53,13 @@ Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Volume Shadow Copy Deletion via PowerShell
+*Triage and analysis*
+
+
+
+*Investigating Volume Shadow Copy Deletion via PowerShell*
+
 
 The Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes that can later be restored or mounted to recover specific files or folders.
 
@@ -65,7 +67,9 @@ A typical step in the playbook of an attacker attempting to deploy ransomware is
 
 This rule monitors the execution of PowerShell cmdlets to interact with the Win32_ShadowCopy WMI class, retrieve shadow copy objects, and delete them.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the program execution chain (parent process tree).
 - Check whether the account is authorized to perform this operation.
@@ -84,16 +88,22 @@ This rule monitors the execution of PowerShell cmdlets to interact with the Win3
 - Check if any files on the host machine have been encrypted.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This rule has chances of producing benign true positives (B-TPs). If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
 
-### Related rules
+
+*Related rules*
+
 
 - Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921
 - Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.
@@ -113,7 +123,17 @@ This rule monitors the execution of PowerShell cmdlets to interact with the Win3
 
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-wmic.asciidoc b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-wmic.asciidoc
index faaa8003a8..b5cd8cad82 100644
--- a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-wmic.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-wmic.asciidoc
@@ -47,11 +47,13 @@ Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Volume Shadow Copy Deletion via WMIC
+*Triage and analysis*
+
+
+
+*Investigating Volume Shadow Copy Deletion via WMIC*
+
 
 The Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes that can later be restored or mounted to recover specific files or folders.
 
@@ -59,7 +61,9 @@ A typical step in the playbook of an attacker attempting to deploy ransomware is
 
 This rule monitors the execution of `wmic.exe` to interact with VSS via the `shadowcopy` alias and delete parameter.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the program execution chain (parent process tree).
 - Check whether the account is authorized to perform this operation.
@@ -79,16 +83,22 @@ This rule monitors the execution of `wmic.exe` to interact with VSS via the `sha
 - Check if any files on the host machine have been encrypted.
 
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This rule has chances of producing benign true positives (B-TPs). If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
 
-### Related rules
+
+*Related rules*
+
 
 - Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921
 - Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Priority should be given due to the advanced stage of this activity on the attack.
@@ -108,7 +118,17 @@ This rule monitors the execution of `wmic.exe` to interact with VSS via the `sha
 
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc b/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc
index 27456eba9a..b9fed5250b 100644
--- a/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc
@@ -53,17 +53,21 @@ Identifies suspicious commands executed via a web server, which may suggest a vu
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Web Shell Detection: Script Process Child of Common Web Processes
+*Triage and analysis*
+
+
+
+*Investigating Web Shell Detection: Script Process Child of Common Web Processes*
+
 
 Adversaries may backdoor web servers with web shells to establish persistent access to systems. A web shell is a web script that is placed on an openly accessible web server to allow an adversary to use the web server as a gateway into a network. A web shell may provide a set of functions to execute or a command-line interface on the system that hosts the web server.
 
 This rule detects a web server process spawning script and command-line interface programs, potentially indicating attackers executing commands using the web shell.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate abnormal behaviors observed by the subject process such as network connections, registry or file modifications, and any other spawned child processes.
 - Examine the command line to determine which commands or scripts were executed.
@@ -79,11 +83,15 @@ This rule detects a web server process spawning script and command-line interfac
   - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -99,7 +107,17 @@ This rule detects a web server process spawning script and command-line interfac
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/webproxy-settings-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/webproxy-settings-modification.asciidoc
index d615bf3239..f354becd4c 100644
--- a/docs/detections/prebuilt-rules/rule-details/webproxy-settings-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/webproxy-settings-modification.asciidoc
@@ -41,6 +41,41 @@ Identifies the use of the built-in networksetup command to configure webproxy se
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/webserver-access-logs-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/webserver-access-logs-deleted.asciidoc
index b76f9a5f78..bb983574d7 100644
--- a/docs/detections/prebuilt-rules/rule-details/webserver-access-logs-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/webserver-access-logs-deleted.asciidoc
@@ -43,6 +43,17 @@ Identifies the deletion of WebServer access logs. This may indicate an attempt t
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/whoami-process-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/whoami-process-activity.asciidoc
index f6f9250795..e6fdd475eb 100644
--- a/docs/detections/prebuilt-rules/rule-details/whoami-process-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/whoami-process-activity.asciidoc
@@ -47,32 +47,42 @@ Identifies suspicious use of whoami.exe which displays user, group, and privileg
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Whoami Process Activity
+*Triage and analysis*
+
+
+
+*Investigating Whoami Process Activity*
+
 
 After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
 This rule looks for the execution of the `whoami` utility. Attackers commonly use this utility to measure their current privileges, discover the current user, determine if a privilege escalation was successful, etc.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
-### Related rules
+
+*Related rules*
+
 
 - Account Discovery Command via SYSTEM Account - 2856446a-34e6-435b-9fb5-f8f040bfa7ed
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -82,7 +92,17 @@ This rule looks for the execution of the `whoami` utility. Attackers commonly us
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-defender-disabled-via-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-defender-disabled-via-registry-modification.asciidoc
index c66eb84eab..dfb3821aa6 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-defender-disabled-via-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-defender-disabled-via-registry-modification.asciidoc
@@ -46,17 +46,21 @@ Identifies modifications to the Windows Defender registry settings to disable th
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Windows Defender Disabled via Registry Modification
+*Triage and analysis*
+
+
+
+*Investigating Windows Defender Disabled via Registry Modification*
+
 
 Microsoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple environments. Disabling it is a common step in threat actor playbooks.
 
 This rule monitors the registry for configurations that disable Windows Defender or the start of its service.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
@@ -65,16 +69,22 @@ This rule monitors the registry for configurations that disable Windows Defender
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Check if this operation was approved and performed according to the organization's change management policy.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity, the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting), and no other suspicious activity has been observed.
 
-### Related rules
+
+*Related rules*
+
 
 - Disabling Windows Defender Security Settings via PowerShell - c8cccb06-faf2-4cd5-886e-2c9636cfcb87
 - Microsoft Windows Defender Tampering - fe794edd-487f-4a90-b285-3ee54f2af2d3
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -86,7 +96,17 @@ This rule monitors the registry for configurations that disable Windows Defender
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc
index 06ce265324..789071e8b9 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc
@@ -49,15 +49,19 @@ Identifies modifications to the Windows Defender configuration settings using Po
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Windows Defender Exclusions Added via PowerShell
+*Triage and analysis*
+
+
+
+*Investigating Windows Defender Exclusions Added via PowerShell*
+
 
-Microsoft Windows Defender is an antivirus product built into Microsoft Windows. Since this software product is used to prevent and stop malware, it's important to monitor what specific exclusions are made to the product's configuration settings. These can often be signs of an adversary or malware trying to bypass Windows Defender's capabilities. One of the more notable [examples](https://www.cyberbit.com/blog/endpoint-security/latest-trickbot-variant-has-new-tricks-up-its-sleeve/) was observed in 2018 where Trickbot incorporated mechanisms to disable Windows Defender to avoid detection.
+Microsoft Windows Defender is an antivirus product built into Microsoft Windows. Since this software product is used to prevent and stop malware, it's important to monitor what specific exclusions are made to the product's configuration settings. These can often be signs of an adversary or malware trying to bypass Windows Defender's capabilities. One of the more notable https://www.cyberbit.com/blog/endpoint-security/latest-trickbot-variant-has-new-tricks-up-its-sleeve/[examples] was observed in 2018 where Trickbot incorporated mechanisms to disable Windows Defender to avoid detection.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -74,16 +78,22 @@ Microsoft Windows Defender is an antivirus product built into Microsoft Windows.
   - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
     - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This rule has a high chance to produce false positives due to how often network administrators legitimately configure exclusions. In order to validate the activity further, review the specific exclusion and its intent. There are many legitimate reasons for exclusions, so it's important to gain context.
 
-### Related rules
+
+*Related rules*
+
 
 - Windows Defender Disabled via Registry Modification - 2ffa1f1e-b6db-47fa-994b-1512743847eb
 - Disabling Windows Defender Security Settings via PowerShell - c8cccb06-faf2-4cd5-886e-2c9636cfcb87
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -99,7 +109,17 @@ Microsoft Windows Defender is an antivirus product built into Microsoft Windows.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-event-logs-cleared.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-event-logs-cleared.asciidoc
index 65b288094b..0b1ac1e466 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-event-logs-cleared.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-event-logs-cleared.asciidoc
@@ -44,17 +44,21 @@ Identifies attempts to clear Windows event log stores. This is often done by att
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Windows Event Logs Cleared
+*Triage and analysis*
+
+
+
+*Investigating Windows Event Logs Cleared*
+
 
 Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.
 
 This rule looks for the occurrence of clear actions on the `security` event log.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -63,11 +67,15 @@ This rule looks for the occurrence of clear actions on the `security` event log.
   - Verify if any other anti-forensics behaviors were observed.
 - Investigate the event logs prior to the action for suspicious behaviors that an attacker may be trying to cover up.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
   - This activity is potentially done after the adversary achieves its objectives on the host. Ensure that previous actions, if any, are investigated accordingly with their response playbooks.
@@ -77,7 +85,6 @@ This rule looks for the occurrence of clear actions on the `security` event log.
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc
index 69befddffc..2cc9ce14ef 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc
@@ -52,11 +52,13 @@ Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Windows Firewall Disabled via PowerShell
+*Triage and analysis*
+
+
+
+*Investigating Windows Firewall Disabled via PowerShell*
+
 
 Windows Defender Firewall is a native component that provides host-based, two-way network traffic filtering for a device and blocks unauthorized network traffic flowing into or out of the local device.
 
@@ -64,7 +66,9 @@ Attackers can disable the Windows firewall or its rules to enable lateral moveme
 
 This rule identifies patterns related to disabling the Windows firewall or its rules using the `Set-NetFirewallProfile` PowerShell cmdlet.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -72,12 +76,16 @@ This rule identifies patterns related to disabling the Windows firewall or its r
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Inspect the host for suspicious or abnormal behavior in the alert timeframe.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This mechanism can be used legitimately. Check whether the user is an administrator and is legitimately performing troubleshooting.
 - In case of an allowed benign true positive (B-TP), assess adding rules to allow needed traffic and re-enable the firewall.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -88,7 +96,17 @@ This rule identifies patterns related to disabling the Windows firewall or its r
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-network-enumeration.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-network-enumeration.asciidoc
index 63409e1e1f..1ae8e52aca 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-network-enumeration.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-network-enumeration.asciidoc
@@ -48,28 +48,36 @@ Identifies attempts to enumerate hosts in a network using the built-in Windows n
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Windows Network Enumeration
+*Triage and analysis*
+
+
+
+*Investigating Windows Network Enumeration*
+
 
 After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
 
 This rule looks for the execution of the `net` utility to enumerate servers in the environment that hosts shared drives or printers. This information is useful to attackers as they can identify targets for lateral movements and search for valuable shared data.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Investigate other alerts associated with the user/host during the past 48 hours.
 - Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -79,7 +87,18 @@ This rule looks for the execution of the `net` utility to enumerate servers in t
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-registry-file-creation-in-smb-share.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-registry-file-creation-in-smb-share.asciidoc
index c1b48d5ddd..67400d93af 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-registry-file-creation-in-smb-share.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-registry-file-creation-in-smb-share.asciidoc
@@ -45,17 +45,21 @@ Identifies the creation or modification of a medium-size registry hive file on a
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Windows Registry File Creation in SMB Share
+*Triage and analysis*
+
+
+
+*Investigating Windows Registry File Creation in SMB Share*
+
 
 Dumping registry hives is a common way to access credential information. Some hives store credential material, as is the case for the SAM hive, which stores locally cached credentials (SAM secrets), and the SECURITY hive, which stores domain cached credentials (LSA secrets). Dumping these hives in combination with the SYSTEM hive enables the attacker to decrypt these secrets.
 
 Attackers can try to evade detection on the host by transferring this data to a system that is not monitored to be parsed and decrypted. This rule identifies the creation or modification of a medium-size registry hive file on an SMB share, which may indicate this kind of exfiltration attempt.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate other alerts associated with the user/source host during the past 48 hours.
 - Identify the user account that performed the action and whether it should perform this kind of action.
@@ -63,15 +67,21 @@ Attackers can try to evade detection on the host by transferring this data to a
 - Inspect the source host for suspicious or abnormal behaviors in the alert timeframe.
 - Capture the registry file(s) to determine the extent of the credential compromise in an eventual incident response.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - Administrators can export registry hives for backup purposes. Check whether the user should be performing this kind of activity and is aware of it.
 
-### Related rules
+
+*Related rules*
+
 
 - Credential Acquisition via Registry Hive Dumping - a7e7bfa3-088e-4f13-b29e-3986e0e756b8
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved hosts to prevent further post-compromise behavior.
@@ -81,7 +91,6 @@ Attackers can try to evade detection on the host by transferring this data to a
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-script-executing-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-script-executing-powershell.asciidoc
index 48f25e611f..ddace63b47 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-script-executing-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-script-executing-powershell.asciidoc
@@ -47,11 +47,13 @@ Identifies a PowerShell process launched by either cscript.exe or wscript.exe. O
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Windows Script Executing PowerShell
+*Triage and analysis*
+
+
+
+*Investigating Windows Script Executing PowerShell*
+
 
 The Windows Script Host (WSH) is an Windows automation technology, which is ideal for non-interactive scripting needs, such as logon scripting, administrative scripting, and machine automation.
 
@@ -59,7 +61,9 @@ Attackers commonly use WSH scripts as their initial access method, acting like d
 
 This rule looks for the spawn of the `powershell.exe` process with `cscript.exe` or `wscript.exe` as its parent process.
 
-#### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate commands executed by the spawned PowerShell process.
@@ -75,11 +79,15 @@ This rule looks for the spawn of the `powershell.exe` process with `cscript.exe`
 - Determine how the script file was delivered (email attachment, dropped by other processes, etc.).
 - Investigate other alerts associated with the user/host during the past 48 hours.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - The usage of these script engines by regular users is unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -100,7 +108,17 @@ This rule looks for the spawn of the `powershell.exe` process with `cscript.exe`
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-----------------------------------
+
+==== Setup
+
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-service-installed-via-an-unusual-client.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-service-installed-via-an-unusual-client.asciidoc
index 207dd9e704..f48d5833f5 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-service-installed-via-an-unusual-client.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-service-installed-via-an-unusual-client.asciidoc
@@ -43,6 +43,25 @@ Identifies the creation of a Windows service by an unusual client process. Servi
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+The 'Audit Security System Extension' logging policy must be configured for (Success)
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+System >
+Audit Security System Extension (Success)
+```
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-distribution-installed.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-distribution-installed.asciidoc
index 6273c94b18..5e9e6870f3 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-distribution-installed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-distribution-installed.asciidoc
@@ -47,17 +47,21 @@ Detects changes to the registry that indicates the install of a new Windows Subs
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Windows Subsystem for Linux Distribution Installed
+*Triage and analysis*
+
+
+
+*Investigating Windows Subsystem for Linux Distribution Installed*
+
 
 The Windows Subsystem for Linux (WSL) lets developers install a Linux distribution (such as Ubuntu, OpenSUSE, Kali, Debian, Arch Linux, etc) and use Linux applications, utilities, and Bash command-line tools directly on Windows, unmodified, without the overhead of a traditional virtual machine or dualboot setup. Attackers may abuse WSL to avoid security protections on a Windows host and perform a wide range of attacks.
 
 This rule identifies the installation of a new Windows Subsystem for Linux distribution via registry events.
 
-### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Examine which distribution was installed. Some distributions such as Kali Linux can facilitate the compromise of the environment.
@@ -66,18 +70,24 @@ This rule identifies the installation of a new Windows Subsystem for Linux distr
 - Validate that the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This is a dual-use tool, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the administrator is aware of the activity, no other suspicious activity was identified, and the WSL distribution is homologated and approved in the environment.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Host Files System Changes via Windows Subsystem for Linux - e88d1fe9-b2f4-48d4-bace-a026dc745d4b
 - Execution via Windows Subsystem for Linux - db7dbad5-08d2-4d25-b9b1-d3a1e4a15efd
 - Suspicious Execution via Windows Subsystem for Linux - 3e0eeb75-16e8-4f2f-9826-62461ca128b7
 - Windows Subsystem for Linux Enabled via Dism Utility - e2e0537d-7d8f-4910-a11d-559bcf61295a
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -86,7 +96,6 @@ This rule identifies the installation of a new Windows Subsystem for Linux distr
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc
index 1dc4e67c40..300ebef06e 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc
@@ -48,17 +48,21 @@ Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Windows Subsystem for Linux Enabled via Dism Utility
+*Triage and analysis*
+
+
+
+*Investigating Windows Subsystem for Linux Enabled via Dism Utility*
+
 
 The Windows Subsystem for Linux (WSL) lets developers install a Linux distribution (such as Ubuntu, OpenSUSE, Kali, Debian, Arch Linux, etc) and use Linux applications, utilities, and Bash command-line tools directly on Windows, unmodified, without the overhead of a traditional virtual machine or dualboot setup. Attackers may abuse WSL to avoid security protections on a Windows host and perform a wide range of attacks.
 
 This rule identifies attempts to enable WSL using the Dism utility. It monitors for the execution of Dism and checks if the command line contains the string "Microsoft-Windows-Subsystem-Linux". 
 
-### Possible investigation steps
+
+*Possible investigation steps*
+
 
 - Identify the user account that performed the action and whether it should perform this kind of action.
 - Contact the account owner and confirm whether they are aware of this activity.
@@ -66,18 +70,24 @@ This rule identifies attempts to enable WSL using the Dism utility. It monitors
 - Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This is a dual-use tool, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the administrator is aware of the activity, no other suspicious activity was identified, and WSL is homologated and approved in the environment.
 
-### Related Rules
+
+*Related Rules*
+
 
 - Execution via Windows Subsystem for Linux - db7dbad5-08d2-4d25-b9b1-d3a1e4a15efd
 - Suspicious Execution via Windows Subsystem for Linux - 3e0eeb75-16e8-4f2f-9826-62461ca128b7
 - Host Files System Changes via Windows Subsystem for Linux - e88d1fe9-b2f4-48d4-bace-a026dc745d4b
 - Windows Subsystem for Linux Distribution Installed - a1699af0-8e1e-4ed0-8ec1-89783538a061
 
-### Response and Remediation
+
+*Response and Remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -86,7 +96,6 @@ This rule identifies attempts to enable WSL using the Dism utility. It monitors
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
index accf8c934c..e73bf1593e 100644
--- a/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
@@ -51,20 +51,24 @@ Identifies attempts to dump Wireless saved access keys in clear text using the W
 ==== Investigation guide
 
 
-[source, markdown]
-----------------------------------
-## Triage and analysis
 
-### Investigating Wireless Credential Dumping using Netsh Command
+*Triage and analysis*
+
+
+
+*Investigating Wireless Credential Dumping using Netsh Command*
+
 
 Netsh is a Windows command line tool used for network configuration and troubleshooting. It enables the management of network settings and adapters, wireless network profiles, and other network-related tasks.
 
 This rule looks for patterns used to dump credentials from wireless network profiles using Netsh, which can enable attackers to bring their own devices to the network.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
 
-#### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Investigate other alerts associated with the user/host during the past 48 hours.
@@ -80,11 +84,15 @@ This rule looks for patterns used to dump credentials from wireless network prof
       - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
       - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
 
-### False positive analysis
+
+*False positive analysis*
+
 
 - This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
 
-### Response and remediation
+
+*Response and remediation*
+
 
 - Initiate the incident response process based on the outcome of the triage.
 - Isolate the involved host to prevent further post-compromise behavior.
@@ -94,7 +102,6 @@ This rule looks for patterns used to dump credentials from wireless network prof
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-----------------------------------
 
 ==== Rule query
 
diff --git a/docs/detections/prebuilt-rules/rule-details/wmic-remote-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/wmic-remote-command.asciidoc
index d9957a46a8..0f1f018220 100644
--- a/docs/detections/prebuilt-rules/rule-details/wmic-remote-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/wmic-remote-command.asciidoc
@@ -30,7 +30,7 @@ Identifies the use of wmic.exe to run commands on remote hosts. While this can b
 * Data Source: Elastic Defend
 * Rule Type: BBR
 
-*Version*: 2
+*Version*: 3
 
 *Rule authors*: 
 
@@ -47,7 +47,8 @@ Identifies the use of wmic.exe to run commands on remote hosts. While this can b
 process where host.os.type == "windows" and event.type == "start" and
   process.name : "WMIC.exe" and
   process.args : "*node:*" and
-  process.args : ("call", "set", "get")
+  process.args : ("call", "set", "get") and
+  not process.args : ("*/node:localhost*", "*/node:\"127.0.0.1\"*")
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/writedac-access-on-active-directory-object.asciidoc b/docs/detections/prebuilt-rules/rule-details/writedac-access-on-active-directory-object.asciidoc
index bed2b3c50f..85d738a88d 100644
--- a/docs/detections/prebuilt-rules/rule-details/writedac-access-on-active-directory-object.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/writedac-access-on-active-directory-object.asciidoc
@@ -44,6 +44,24 @@ Identifies the access on an object with WRITEDAC permissions. With the WRITEDAC
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+The 'Audit Directory Service Access' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Access (Success,Failure)
+```
+
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/zoom-meeting-with-no-passcode.asciidoc b/docs/detections/prebuilt-rules/rule-details/zoom-meeting-with-no-passcode.asciidoc
index 193bf1a95f..035c76b24c 100644
--- a/docs/detections/prebuilt-rules/rule-details/zoom-meeting-with-no-passcode.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/zoom-meeting-with-no-passcode.asciidoc
@@ -39,6 +39,12 @@ This rule identifies Zoom meetings that are created without a passcode. Meetings
 *Rule license*: Elastic License v2
 
 
+==== Setup
+
+
+
+The Zoom Filebeat module or similarly structured data is required to be compatible with this rule.
+
 ==== Rule query
 
 
diff --git a/docs/index.asciidoc b/docs/index.asciidoc
index f0bd1301bc..9fbd5644ea 100644
--- a/docs/index.asciidoc
+++ b/docs/index.asciidoc
@@ -93,3 +93,5 @@ include::detections/prebuilt-rules/downloadable-packages/8-12-2/prebuilt-rules-8
 include::detections/prebuilt-rules/downloadable-packages/8-12-3/prebuilt-rules-8-12-3-appendix.asciidoc[]
 
 include::detections/prebuilt-rules/downloadable-packages/8-12-4/prebuilt-rules-8-12-4-appendix.asciidoc[]
+
+include::detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rules-8-12-5-appendix.asciidoc[]

From 9c1e5d309064e99f72cd902011b604062ad0c3a2 Mon Sep 17 00:00:00 2001
From: terrancedejesus <terrance.dejesus@elastic.co>
Date: Fri, 23 Feb 2024 17:32:09 -0500
Subject: [PATCH 2/2] adjusted update description

---
 .../prebuilt-rules-downloadable-updates.asciidoc            | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
index df0974641e..3d23eecbec 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
@@ -13,9 +13,9 @@ For previous rule updates, please navigate to the https://www.elastic.co/guide/e
 |Update version |Date | New rules | Updated rules | Notes
 
 
-|<<prebuilt-rule-8-12-5-prebuilt-rules-8-12-5-summary, 8.12.5>> | 23 Feb 2024 | 5 | 33 | 
-updating rules for 8.12.5 release package
-
+|<<prebuilt-rule-8-12-5-prebuilt-rules-8-12-5-summary, 8.12.5>> | 23 Feb 2024 | 5 | 33 |
+This release includes a new rule for Windows detection of suspicious execution from INET cache.
+Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy and performance.
 
 |<<prebuilt-rule-8-12-4-prebuilt-rules-8-12-4-summary, 8.12.4>> | 08 Feb 2024 | 10 | 6 |
 This release includes new and tuned rules for Linux and Windows.