[Internal]: Document confidence assessment patterns for AD findings

[benironside]

Description

The Attack Discovery skill's three-signal methodology for assessing Attack discovery findings (alert diversity, rule frequency, entity risk) is entirely tribal knowledge. Let's create a page on "Assessing Attack Discovery findings" would help users triage attacks more effectively.

Resources

Which documentation set does this change impact?

Elastic On-Prem and Cloud (all)

Feature differences

What release is this request related to?

N/A

Serverless release

Collaboration model

The documentation team

Point of contact.

Main contact: @

Stakeholders: