DOCS-7866 added Simple rule creator for CSM Threats

[michaelcretzman]

DOCS-7866

What does this PR do? What is the motivation?

Updates CSM custom rule creation with new Simple rule creator feature.

Merge instructions

Please DO NOT merge after reviewing. Still waiting on whether this is beta or GA.

Additional notes

Updated menu title for another topic:

• Creating Custom Agent Rules > Creating Agent rule expressions

[github-actions]

Preview links (active after the build_preview check completes)

Modified Files

• https://docs-staging.datadoghq.com/mcretzman/DOCS-7866-cust-rule-wizard/security/threats/workload_security_rules/
• https://docs-staging.datadoghq.com/mcretzman/DOCS-7866-cust-rule-wizard/security/threats/workload_security_rules/custom_rules

[aliciascott]

Editorial card: https://datadoghq.atlassian.net/browse/DOCS-7922

[jhgilbert]

Approved with some suggestions, thanks!

[paragbaxi]

approved
comments below

Using this tool is faster than the advanced method of creating the Agent and detection rules separately.

love it

---

In Agent Configuration or Threat Detection Rules

you are on top of it

---

To detect unauthorized changes to files, select File integrity monitoring (FIM).
To track and analyze system software processes for malicious behavior or policy violations, select Process activity monitoring.
Enter the file/process names or paths to monitor.

this is good. I wonder if clarifying that a rule can only be a fim or process is needed
something like

To monitor your resource effectively, you have the option to choose between two detection types:
To detect unauthorized changes to files, select File integrity monitoring (FIM).
To track and analyze system software processes for malicious behavior or policy violations, select Process activity monitoring.
Enter the file/process names or paths to monitor.

could just be an unnecessary change
i'll leave it up to you

---

6. Select Create <> Rules.

should we clarify that NUMBER is populated by the system, or would the user already get that with the <<>>.
again, it's understandable as is