[Quality][Security] Improve usability of the "Detections requirements" page

[nastasha-solomon]

Summary

Fixes https://github.com/elastic/docs-content-internal/issues/511

This PR improves the organization, usability, and clarity of the Elastic Security detections documentation by splitting a dense requirements page into focused, task-oriented guides.

Note: This PR will eventually include exception priv docs that are being written in #4400.

Major Changes

1. Split detections-requirements.md into two focused pages

Before: A single long page mixed setup instructions, privilege requirements, custom role configuration, and advanced settings—making it difficult for users to find what they needed.

After:

• detections-requirements.md → "Turn on detections": A streamlined quick-start guide focused on enabling the detections feature. Preview
• detections-privileges.md → "Detections privileges": A comprehensive reference for privilege requirements, predefined roles, and the authorization model. Preview

2. Reorganized content by deployment type

The setup instructions now use a tabbed interface organized by deployment type (Serverless → Cloud → Self-managed), letting users jump directly to their relevant configuration. Self-managed setup uses a stepper component for clear sequential steps. Preview

3. Improved "next steps" guidance

Added a comprehensive "Start detecting threats" section (preview) that guides users through:

• Adding detection rules (prebuilt, custom, and ML-based)
• Responding to and managing alerts
• Links to the SIEM quickstart guide

4. Relocated content to contextually appropriate pages

• Moved "Configure upload limits" from the privileges page to create-manage-value-lists.md, where users actually perform that task. Preview
• Added cross-references between related pages

5. Clarified index privilege requirements

Added an "About index privileges" section (preview) that explains:

• Why users need to know about system indices (creating custom roles)
• Which indices apply to each deployment type (Serverless vs Stack)
• Legacy index requirements for upgraded deployments

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

Cursor, claude-4.5-opus-high

[github-actions]

Vale Linting Results

Summary: 3 suggestions found

💡 Suggestions (3)

File	Line	Rule	Message
solutions/security/detect-and-alert.md	42	Elastic.WordChoice	Consider using 'refer to (if it's a document), view (if it's a UI element)' instead of 'see', unless the term is in the UI.
solutions/security/detect-and-alert.md	91	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/security/detect-and-alert.md	99	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/detect-and-alert/detections-privileges.md
• explore-analyze/alerts-cases/alerts/alerting-setup.md
• solutions/security/detect-and-alert.md
• solutions/security/detect-and-alert/create-detection-rule.md
• solutions/security/detect-and-alert/create-manage-value-lists.md
• solutions/security/detect-and-alert/cross-cluster-search-detection-rules.md
• solutions/security/detect-and-alert/detections-requirements.md
• solutions/security/detect-and-alert/manage-detection-rules.md
• solutions/security/get-started/get-started-detect-with-siem.md
• solutions/security/investigate/cases-requirements.md

[dhurley14]

We've had some discussions on the team and I think we can remove the Saved Objects Management privilege from our requirements as this can lead to unintentional access to other SO's outside of the security team.

[nastasha-solomon]

Would that change eventually go into 9.4 and Serverless? If so, I'd add it here once the changes were released.

[benironside]

LGTM! Love the reorg, splitting "Turn on detections" from "Detections privileges" makes this section more intuitive and navigable IMO.