updates cloud security section of billing page

docs/serverless/billing.mdx

@@ -32,6 +32,29 @@ Cloud Protection is an _optional_ add-on to Security Analytics that provides val
 * **Cloud Protection Essentials** — Protects your cloud workloads, continuously tracks posture of your cloud assets, and helps you manage risks by detecting configuration issues per CIS benchmarks.
 * **Cloud Protection Complete** — Adds response capabilities and configuration drift prevention for Cloud Workloads.
 
-You pay based on the number of protected cloud workload and other cloud assets you configure for use with Elastic Cloud Security. Note that logs, events, alerts, and configuration data ingested into your security project are billed using the **Ingest** and **Retention** pricing described above.
+Your total cost depends on the number of protected cloud workloads and other billable cloud assets you configure for use with Elastic Cloud Security. 
 
-For detailed ((elastic-sec)) serverless project rates, check [Elastic Cloud pricing table](https://cloud.elastic.co/cloud-pricing-table?productType=serverless&project=security).
+For <DocLink id="serverlessSecurityCspm" text="CSPM"/>, billing is based on how many billable resources (`resource.id`s) you monitor. The following types of assets are considered billable:
+
+- VMs:
+    - **AWS:** EC2 instances
+    - **Azure:** Virtual machines
+    - **GCP:** Compute engine instances
+- Storage resources:
+    - **AWS:** S3, S3 Glacier, EBS 
+    - **Azure:** Archive, Blob, Managed disk
+    - **GCP:** Cloud storage, Persistent disk, Coldline storage 
+- SQL databases and servers: 
+    - **AWS:** RDS, DynamoDB, Redshift
+    - **Azure:** SQL database, Cosmos DB, Synapse Analytics
+    - **GCP:** Cloud SQL, Firestore, BigQuery
+
+For <DocLink id="serverlessSecurityKspm" text="KSPM"/>, billing is based on how many Kubernetes nodes (`agent.id`s) you monitor.
+
+For <DocLink id="serverlessSecurityVulnManagementOverview" text="CNVM"/>, billing is based on how many cloud assets (`cloud.instance.id`s) you monitor.
+
+For <DocLink id="serverlessSecurityD4cOverview" text="D4C"/>, billing is based on how many agents (`agent.id`s) you use.
+
+Logs, events, alerts, and configuration data ingested into your security project are billed using the **Ingest** and **Retention** pricing described above.
+
+For more details about ((elastic-sec)) serverless project rates and billable assets, refer to Cloud Protection in the [Elastic Cloud pricing table](https://cloud.elastic.co/cloud-pricing-table?productType=serverless&project=security).