[vishaangelova]

Relates to #8153. Part of a set of PRs for this issue, split by docs set:

• #9055: the integration policy and agent policy pages, and a new page, Open an integration's details, that other pages link to
• This PR: Security pages
• #9251: Fleet and ingest pages
• #9252: Observability pages

The PRs don't depend on each other and can merge in any order. Close #8153 after all four merge.

Summary

Two UI changes affect the steps for adding an integration:

• Starting in 9.6 (and in Serverless), selecting an integration tile opens the Add page directly instead of the integration's details page (kibana#299010). This includes the tiles in Observability and Security onboarding, which use the same Fleet card logic.
• The Ready to add your first integration? page was removed in 9.3.6, 9.4.3, and 9.5.0 (kibana#271801). In earlier releases, it only appears on Elastic Cloud when no agents are enrolled yet, and never for a few integrations with their own setup flow, such as Elastic APM.

How the steps change

• "Click Add " becomes "If the integration's Overview page opens, click Add ." The next step is the same in every version, so there's no badge.
• "If the Ready to add your first integration? page opens, click Add integration only (skip agent installation)." This step has no applies_to badge on purpose. Even in the releases that still have it, the page only appears under the conditions above, so the step must stay conditional either way. Readers who don't see the page skip the step, and everyone reaches the same configuration page next. A badge would only add noise. Where this step was a tip or note, it's now a numbered step, because readers who see that page can't continue without it.

Changes

13 pages: CSPM, KSPM, CNVM, asset discovery, third-party response actions, ingesting data, Elastic Defend install, and the get-started guides for SIEM and endpoint security.

• Elastic Defend install page: the Integrations page screenshot is removed, because it shows the old tile layout.
• Get-started guides: a new first step expands Add data with integrations before selecting Elastic Defend, because that card on the Get started page starts collapsed in every version.

Not changed: the Elastic GovCloud and Firehose pages, because those integrations still open their details page.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

Tool(s) and model(s) used: Cursor with Claude Opus 5.5

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: completed, no findings. View progress.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/cloud/asset-disc-aws.md
• solutions/security/cloud/asset-disc-azure.md
• solutions/security/cloud/asset-disc-gcp.md
• solutions/security/cloud/get-started-with-cnvm.md
• solutions/security/cloud/get-started-with-cspm-for-aws.md
• solutions/security/cloud/get-started-with-cspm-for-azure.md
• solutions/security/cloud/get-started-with-cspm-for-gcp.md
• solutions/security/cloud/get-started-with-kspm.md
• solutions/security/configure-elastic-defend/install-elastic-defend.md
• solutions/security/endpoint-response-actions/configure-third-party-response-actions.md

More links …

• solutions/security/get-started/get-started-detect-with-siem.md
• solutions/security/get-started/get-started-endpoint-security.md
• solutions/security/get-started/ingest-data-to-elastic-security.md

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

Docs review summary

Issue satisfaction

Satisfied for the Security pages. The 13 pages in the diff update the integration tile steps for the direct Add page navigation, as described in #8153. The Fleet, Observability, and integration policy pages are covered by the sibling PRs listed in the description.

Review coverage

• Content type: how-to and get-started procedures. The conditional steps fit the surrounding step pattern.
• Checked: user focus, technical accuracy, applicability, maintainability, language, and style.
• Not checked: UI labels: not verified. The labels are Add data with integrations, Ready to add your first integration?, and Add integration only (skip agent installation). I didn't check the product source. The version claims for kibana#299010 and kibana#271801 rely on the PR description and weren't checked against those PRs.

Generated from Docs review agent · ◷

Was this review helpful? When the PR closes, add the label ai-review:helpful or ai-review:unhelpful to it.