Endpoint Insights feature — Serverless (#6480)

* Endpoint Insights feature — Serverless

* updates image size

* incorporates reviews

* Incorporates Nat's review

* Update identify-third-party-AV-products.asciidoc

Author: benironside

docs/serverless/edr-manage/identify-third-party-AV-products.asciidoc

@@ -0,0 +1,40 @@
+[[identify-third-party-av-products]]
+= Identify antivirus software on your hosts
+
+.Technical preview
+[IMPORTANT]
+====
+This feature is in technical preview. It may change in the future, and you should exercise caution when using it in production environments. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of GA features.
+====
+
+Third-party antivirus (AV) software installed on your hosts can interfere with {elastic-defend}. To mitigate issues with running third-party AV alongside {elastic-defend}, you first have to identify which AV is present. 
+
+After you've installed {elastic-defend} on one or more hosts, you can use **Endpoint Insights** to check whether your endpoints have third-party AV software installed. Using the same kinds of large language model (LLM) connectors as Elastic AI Assistant, Endpoint Insights can analyze file event logs from your hosts to determine whether antivirus software is present. From there, you can address any incompatibilities to make sure your endpoints are protected.
+
+.Requirements
+[sidebar]
+--
+To use this feature, you need:
+
+* A Security Analytics Complete https://www.elastic.co/pricing/serverless-security[subscription].
+* The *Endpoint Insights: Read* or *Endpoint Insights: All* security sub-feature privilege.
+* A working <<security-llm-connector-guides,LLM connector>> for AI Assistant.
+--
+
+[discrete]
+== Scan your hosts for AV software
+
+1. Find **Endpoints** in the navigation menu or use the global search field. 
+2. Click on an endpoint to open its details flyout, then under *Endpoint Insights*, click **Endpoint Insights scan**.
+3. Select an LLM connector, or <<security-llm-connector-guides,add>> a new one. 
+4. Click *Scan*. After a brief processing period, any detected AV products will appear under *Insights*. 
+
+image::images/endpoint-insights-results.png[Endpoint Insights results with the "Create trusted app" button highlighted]
+
+[discrete]
+== Resolve incompatibilities
+
+After a scan has completed, you can click the *Create trusted app* button to the right of a result to quickly add the associated AV program to {elastic-defend}'s trusted applications list. If the button is not clickable, you don't have the <<security-trusted-applications,required privilege>>.
+
+IMPORTANT: If you plan to use {elastic-defend} alongside third-party AV software, we recommend you that you both <<security-allowlist-endpoint, allowlist {elastic-endpoint} in your AV>> and <<security-trusted-applications,make the AV a trusted application>>. 
+

docs/serverless/edr-manage/images/endpoint-insights-results.png

@@ -71,6 +71,7 @@ include::./edr-manage/blocklist.asciidoc[leveloffset=+3]
 include::./edr-manage/optimize-edr.asciidoc[leveloffset=+3]
 include::./edr-manage/endpoint-event-capture.asciidoc[leveloffset=+3]
 include::./edr-manage/endpoint-protection-rules.asciidoc[leveloffset=+3]
+include::./edr-manage/identify-third-party-AV-products.asciidoc[leveloffset=+3]
 include::./edr-manage/allowlist-endpoint-3rd-party-av.asciidoc[leveloffset=+3]
 include::./edr-manage/endpoint-self-protection.asciidoc[leveloffset=+3]
 include::./edr-manage/endpoint-command-ref.asciidoc[leveloffset=+3]