Add Threat Intelligence Section

[Naarcha-AWS]

Modifies #7847.

Closes #7714.

Checklist

• By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
  For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[natebower]

@Naarcha-AWS Please see my comments and changes and let me know if you have any questions. Thanks!

[natebower]

Suggested change

	The threat intelligence Alerts and Findings API retrieves information about alerts and findings found in threat intelligence feeds.
	The threat intelligence Alerts and Findings API retrieves information about alerts and findings from threat intelligence feeds.

[natebower]

Suggested change

	`size` | An optional limit for the maximum number of results returned in the response. Optional.
	`size` | An optional maximum number of results to be returned in the response. Optional.

[natebower]

Suggested change

	Threat intelligence alerts can have one of the following states.
	A threat intelligence alert can have one of the following states.

[natebower]

Suggested change

	| `ACKNOWLEDGED` | The alert is acknowledged but the root cause of the alert has not been addressed. |
	| `ACKNOWLEDGED` | The alert is acknowledged, but the root cause of the alert has not been addressed. |

[natebower]

Suggested change

	You can view the findings and alerts generated by threat intelligence monitors to analyze which malicious indicators have occurred in their security logs. To view alerts or findings, select **View findings** or **View alerts** from the threat intelligence view.
	You can view the alerts and findings generated by threat intelligence monitors to analyze which malicious indicators have occurred in their security logs. To view alerts or findings, select **View findings** or **View alerts** from the threat intelligence view.

[natebower]

Suggested change

Threat intelligence in Security Analytics offers the capability to integrate your threat intelligence feeds. Feeds are comprised Indicators of Compromise (IOCs), which search for malicious indicators within your data by setting up a threat intelligence monitor. These monitors generate findings and can send notifications when malicious IPs, domains, or hashes referenced from the threat intelligence feeds match your data.

Threat intelligence in Security Analytics offers the capability to integrate your threat intelligence feeds. Feeds comprise indicators of compromise (IOCs), which search for malicious indicators in your data by setting up threat intelligence monitors. These monitors generate findings and can send notifications when malicious IPs, domains, or hashes from the threat intelligence feeds match your data.

[natebower]

I believe the linked heading is in sentence case where it appears ("Threat intelligence APIs").

[natebower]

"Getting started" (sentence case)?

[natebower]

Suggested change

A threat intelligence feed is a real-time, continuous data stream that gathers information related to risks or threats. A piece of information in the tactical threat intelligence feed suggesting that your cluster may have been compromised, such as a login from an unknown user or location or anomalous activity like an increase in read volume, is called an *indicator of compromise* (IOC). These IOCs can be used by investigators to help isolate security incidents.

A threat intelligence feed is a real-time, continuous data stream that gathers information related to risks or threats. A piece of information in the tactical threat intelligence feed suggesting that your cluster may have been compromised, such as a login from an unknown user or location or anomalous activity like an increase in read volume, is called an *indicator of compromise (IOC)*. These IOCs can be used by investigators to help isolate security incidents.

[Naarcha-AWS]

Suggested change

	## Path and HTTP methods
	### Path and HTTP methods

[Naarcha-AWS]

Suggested change

	The following example requests show how to use the Source API.

[natebower]

@Naarcha-AWS "example requests show you how"

[Naarcha-AWS]

Suggested change

	- Threat intelligence API: To configure threat intelligence using API operations, see [Threat Intelligence APIs]({{site.url}}{{site.baseurl}}/security-analytics/threat-intelligence/api/threat-intel-api/).
	- Threat intelligence APIs: To configure threat intelligence using API operations, see [Threat Intelligence APIs]({{site.url}}{{site.baseurl}}/security-analytics/threat-intelligence/api/threat-intel-api/).