first draft of Managing Account Theft with ASM

[michaelcretzman]

This guide covers:

1. Collecting login information:

• Enable and verify login activity collection in Datadog ASM using automatic or manual instrumentation methods.
• Use remote configuration options if you cannot modify your service code.
• Troubleshoot missing or incorrect data.

2. Preparing for account takeover campaigns:

• Prepare for ATO campaigns detected by ASM.
• Configure notifications for attack alerts.
• Validate proper data propagation for accurate attacker identification.
• Set up automatic IP blocking for immediate mitigation.
• Learn about the importance of temporary blocking due to dynamic attacker IPs.

3. Reacting to account takeover campaigns:

• Learn how to react to ATO campaigns, including attacker strategies, triage, response, investigation, monitoring, and cleanup.

Merge instructions

Merge readiness:

• Ready for merge

[github-actions]

Preview links (active after the build_preview check completes)

New or renamed files

• https://docs-staging.datadoghq.com/mcretzman/DOCS-9978-asm-account-theft-guide/security/application_security/guide/manage_account_theft_appsec

Modified Files

• https://docs-staging.datadoghq.com/mcretzman/DOCS-9978-asm-account-theft-guide/security/application_security/guide/

[Taiki-San]

Some comment on Phase 1. Mostly, I raise cases where the original meaning was lost in the edit

[Taiki-San]

Phase 2

[drichards-87]

Left a couple of small comments and approved the PR.

[Taiki-San]

Still need to finalize the Distributed Credential Stuffing and the Cleanup/Conclusion sections