[Detections RBAC] Update references to detections RBAC

[yctercero]

Summary

Fixes https://github.com/elastic/docs-content-internal/issues/597

In an effort to provide finer grained privileges to our users we have made the initial PR updates to move Rules, Alerts, and Exceptions Kibana privileges out from under Security > Security and into it's own Security > Rules. There will be follow up work done dev side to break out Rules privileges into subfeatures.

Changes made

• Attack Discovery
  • Specified Kibana and ES index privs needed for 9.0, 9.1, and 9.3/Serverless. Noted that users also need (at min) Read for Security > Rules.
• Detections Requirements
  • Updated the privileges table to specify Kibana privs needed for 9.0 and 9.3/Serverless. In updates for 9.3/Serverless, noted that users need at least Read for Security > Rules.
  • Added table that breaks down some info on serverless prebuilt roles
• Automatic Migration
  • Specified Kibana privs needed for 9.0 and 9.3/Serverless. Noted that users need at least Read for Security > Rules.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/ai/attack-discovery.md
• solutions/security/detect-and-alert/detections-requirements.md
• solutions/security/get-started/automatic-migration.md

[benironside]

Thanks so much for this Yara! I'm going to make a few small edits, and I'll hold off on approving because I think another security writer should take a look first

[e40pud]

@yctercero I believe Attack Discovery: All and Rules - Read is enough to use Attack discovery. Since Rules - Read allows user to modify alert documents that will be enough for all actions within the Attack discovery page to work correctly.

[nastasha-solomon]

Thanks for opening this, @yctercero! This is a great starting point for updating the docs that explain the required Kibana privs that roles must have to use certain Security features. I'm planning to make some organizational improvements to the "Detections requirements" page for 9.3, so I may need to open a new PR to re-add the changes you made in this PR if my changes introduce too many gnarly conflicts.

However, before I move forward with the organizational changes, I do want to understand the schedule for the phases that you outlined here. I'll drop my questions the #security-detections-response-rbac channel so we can discuss there.

[nastasha-solomon]

@benironside tomorrow, I could use your review of the updates we made to the Role-based access control (RBAC) for Attack Discovery section and the Automatic Migration requirements. TIA!

[benironside]

Attack discovery and Automatic migrations sections LGTM. Left a couple minor suggestions.