Restructure Attack Discovery docs (structural changes only, no content rewrites) (#7448)

<!--
Thank you for contributing to the Elastic Docs! 🎉
Use this template to help us efficiently review your contribution.
-->

## Summary
<!--
Describe what your PR changes or improves.  
If your PR fixes an issue, link it here. If your PR does not fix an
issue, describe the reason you are making the change.
-->

Fixes elastic/docs-content-internal#1493

The current `attack-discovery.md` page is a single file covering RBAC,
setup, manual runs, scheduling, and saved-discovery management. That's
manageable today because nothing has to compete for space in it. 9.5
adds substantial new content (the skill-based architecture, context
enrichment, and other new flyout elements) that has no clean home in
that structure without making an already-overloaded page worse.

Restructuring now, before any 9.5 content is written, is the only point
where this move is risk-free to existing content. If it happens after
9.5 ships instead, the same restructuring work still has to happen,
except now it also has to migrate the new 9.5 content alongside the old.

This PR is scoped as **structural only, no content rewrites**, so it
only requires a lightweight review. The 9.5 content itself will be
reviewed separately, by whoever has the subject-matter context, without
that review being tangled up in structural decisions at the same time.

### How this helps with future-proofing the AD docs

There are future plans to deprecate and or remove the Attack Discovery
page in the security application. When that happens, the corresponding
docs will need to be flagged as deprecated. Today, that content is mixed
into a single page shared with unrelated tasks, so flagging it would
mean disentangling what to keep, move, or deprecate within a shared
page. With this restructure, the content already lives in pages that map
directly to that surface, so deprecation notices can be applied
precisely, without that disentangling step first.

### Note on diff size

Several files outside `attack-discovery/` show up in this diff
(ai-features.md, agent-builder pages, workflow pages, etc.). Those are
incidental nav/redirect updates from the folder move, not content
changes.

## Improvements

- **Findability**: Each page answers one question, so readers land on
exactly the content they need instead of scanning a long page.
- **Reviewability**: Future changes touch one small, purpose-built page
instead of one large shared one, making diffs and reviews easier to
scope.
- **Scalability**: New 9.5+ content, or notes about deprecated/removed
functionality, now has an obvious, dedicated home instead of competing
for space in a single page. New content can be cleanly added to logical
sections or pages now too. For example, with this restructure:
- The [dedicated hub for triggering
AD](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/run-attack-discovery)
can gain additional child pages for running AD from Workflows or Agent
Builder chat (tracked in
elastic/docs-content-internal#1448), alongside
the existing Attacks page and Attack Discovery page children.
- The ["Configure alert retrieval"
section](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/run-from-attacks-page#attacks-page-configure-alert-retrieval)
on the Run AD from the Attack page provides a clear spot to drop in 9.5
docs for the new skill based architecture, context enrichment, and other
elements in the new AD flyout (tracked in
elastic/docs-content-internal#1448).
- **Consistency**: The new TOC mirrors the overview → subtopic structure
used across the rest of the docs, instead of being a one-off layout.

## Before → After

**Before**: One monolithic page plus two loosely attached siblings:

````
security/ai/
├── attack-discovery.md          # Overview + RBAC + manual runs + scheduling, all in one page
├── attacks-page.md
└── triage-attack-discovery-findings.md
````

**After**: Dedicated pages for individual tasks, each flows naturally:

````
security/ai/attack-discovery/
├── attack-discovery.md                                  # Overview only
├── grant-access.md                                      # How to grant access to Attack Discovery (AD)
├── run-attack-discovery.md                              # Where to trigger AD, by page
│   ├── run-from-attacks-page.md                         #   Trigger AD from the Attacks page (schedules only) (1)
│   └── run-from-attack-discovery-page.md                #   Trigger AD from the Attack Discovery page (settings, manual runs, schedules) (2)
├── triage-attack-discovery-findings.md                  # What to do with discoveries
└── manage-saved-discoveries.md                          # Where to manage saved discoveries, by page
    ├── manage-discoveries-from-attacks-page.md          #   Manage via the Attacks page (1)
    └── manage-discoveries-from-attack-discovery-page.md #   Manage via the Attack Discovery page (2)
````
(1) Page is applicable to users who are on 9.4+/Serverless and have
enabled the "Enable alerts and attacks alignment" advanced setting.
(2) Page is applicable to users who are on 9.4+/Serverless or earlier
and are using the default setup/UI for Attack Discovery. It is **not**
for users who haven't enabled the "Enable alerts and attacks alignment"
advanced setting.

This same "pick your page" pattern now appears twice, once for running
Attack Discovery and once for managing what it found, so the two
questions are answered consistently instead of two different ways.

## Previews

[Attack
Discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/attack-discovery)
- [Grant feature
access](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/grant-access)
- [Run Attack
Discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/run-attack-discovery)
- [Attacks
page](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/run-from-attacks-page)
- [Attack Discovery
page](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/run-from-attack-discovery-page)
- [Triage Attack Discovery
findings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/triage-attack-discovery-findings)
- [Manage saved
discoveries](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/manage-saved-discoveries)
- [Attacks
page](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/manage-discoveries-from-attacks-page)
- [Attack Discovery
page](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/solutions/security/ai/attack-discovery/manage-discoveries-from-attack-discovery-page)

## Generative AI disclosure
<!--
To help us ensure compliance with the Elastic open source and
documentation guidelines, please answer the following:
-->
1. Did you use a generative AI (GenAI) tool to assist in creating this
contribution?
- [x] Yes - Cursor + Claude  
- [ ] No  
<!--
2. If you answered "Yes" to the previous question, please specify the
tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.).

Tool(s) and model(s) used:
-->

---------

Co-authored-by: Brandon Morelli <bmorelli25@gmail.com>

Author: nastasha-solomon

deploy-manage/cloud-connect.md

@@ -36,7 +36,7 @@ You can use EIS to enable features such as:
 - [Semantic search](/solutions/search/semantic-search.md)
 - [AI Assistants](/explore-analyze/ai-features/ai-chat-experiences/ai-assistant.md)
 - [Agent Builder](/explore-analyze/ai-features/elastic-agent-builder.md)
-- [Attack Discovery](/solutions/security/ai/attack-discovery.md)
+- [Attack Discovery](/solutions/security/ai/attack-discovery/index.md)
 
 For a full list of EIS-powered features, refer to [AI features powered by EIS](/explore-analyze/elastic-inference/eis.md#ai-features-powered-by-eis).
 

deploy-manage/deploy/elastic-cloud/fedramp.md

@@ -46,7 +46,7 @@ This table provides a comparison of features and capabilities included in {{ech}
 | [Managed OTLP Endpoint (mOTLP)](opentelemetry://reference/motlp.md) | Yes | No | No |
 | [Custom bundles and plugins](/deploy-manage/deploy/elastic-cloud/upload-custom-plugins-bundles.md) | Yes | Yes | No |
 | [Elastic AI Assistant for Observability and Search](/solutions/observability/ai/observability-ai-assistant.md), [Elastic AI Assistant for Security](/solutions/security/ai/ai-assistant.md) | Yes | Elastic Managed LLM not available | Elastic Managed LLM not available |
-| [Attack Discovery](/solutions/security/ai/attack-discovery.md) | Yes | Yes | TBD |
+| [Attack Discovery](/solutions/security/ai/attack-discovery/index.md) | Yes | Yes | TBD |
 | [Universal profiling](/solutions/observability/infra-and-hosts/universal-profiling.md) | Yes | No | No |
 
 ## Get started with FedRAMP [ec-fedramp-get-started]

explore-analyze/ai-features.md

@@ -144,7 +144,7 @@ If you're running earlier versions of {{es}} without Agent Builder, you can use
 
 ### Attack Discovery
 
-[Attack Discovery](/solutions/security/ai/attack-discovery.md) uses AI to triage your alerts and identify potential threats. Each "discovery" represents a potential attack and describes relationships among alerts to identify related users and hosts, map alerts to the MITRE ATT&CK matrix, and help identify threat actors.
+[Attack Discovery](/solutions/security/ai/attack-discovery/index.md) uses AI to triage your alerts and identify potential threats. Each "discovery" represents a potential attack and describes relationships among alerts to identify related users and hosts, map alerts to the MITRE ATT&CK matrix, and help identify threat actors.
 
 
 ### Automatic Migration

explore-analyze/ai-features/agent-builder/tools/builtin-tools-reference.md

@@ -335,7 +335,7 @@ Security tools provide specialized capabilities for security monitoring, threat
 
 $$$agent-builder-security-attack-discovery-search-tool$$$
 `security.attack_discovery_search` {applies_to}`stack: ga 9.4+`
-:   Returns any related [attack discoveries](/solutions/security/ai/attack-discovery.md) from the last week, given one or more alert IDs. Requires attack discovery to have been run at least once.
+:   Returns any related [attack discoveries](/solutions/security/ai/attack-discovery/index.md) from the last week, given one or more alert IDs. Requires attack discovery to have been run at least once.
 
 $$$agent-builder-security-labs-search-tool$$$ `security.security_labs_search`
 :   Searches [Elastic Security Labs](https://www.elastic.co/security-labs) research and threat intelligence content. To use this tool, search for **GenAI Settings** in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md) and install **Security labs** from the **Documentation** section. This takes a few minutes.

explore-analyze/ai-features/llm-guides/connect-to-lmstudio-security.md

@@ -219,5 +219,5 @@ Finally, configure the connector:
 Setup is now complete. You can use the model you’ve loaded in LM Studio to power Elastic’s generative AI features. You can test a variety of models as you interact with AI Assistant to see what works best without having to update your connector.
 
 ::::{note}
-While local models work well for [AI Assistant](/solutions/security/ai/ai-assistant.md), we recommend you use one of [these models](/solutions/security/ai/large-language-model-performance-matrix.md) for interacting with [Attack discovery](/solutions/security/ai/attack-discovery.md). As local models become more performant over time, this is likely to change.
+While local models work well for [AI Assistant](/solutions/security/ai/ai-assistant.md), we recommend you use one of [these models](/solutions/security/ai/large-language-model-performance-matrix.md) for interacting with [Attack discovery](/solutions/security/ai/attack-discovery/index.md). As local models become more performant over time, this is likely to change.
 ::::

explore-analyze/ai-features/llm-guides/connect-to-vLLM.md

@@ -194,7 +194,7 @@ To run a different model:
 With your vLLM connector set up, you can use it to power features including:
 
 * [AI Assistant for Security](/solutions/security/ai/ai-assistant.md): Interact with an agent designed to assist with {{elastic-sec}} tasks.
-* [Attack Discovery](/solutions/security/ai/attack-discovery.md): Use AI to quickly correlate and triage security alerts.
+* [Attack Discovery](/solutions/security/ai/attack-discovery/index.md): Use AI to quickly correlate and triage security alerts.
 * [Automatic Import](/explore-analyze/ai-features/automatic-import.md): Use AI to create custom integrations for third-party data sources.
 * [AI Assistant for Observability and Search](/solutions/observability/ai/observability-ai-assistant.md): Interact with an agent designed to assist with {{observability}} and Search tasks.
 

explore-analyze/elastic-inference/connect-self-managed-cluster-to-eis.md

@@ -18,7 +18,7 @@ You can use EIS to enable features such as:
 - [Semantic search](/solutions/search/semantic-search.md)
 - [AI Assistants](/explore-analyze/ai-features/ai-chat-experiences/ai-assistant.md)
 - [Agent Builder](/explore-analyze/ai-features/elastic-agent-builder.md)
-- [Attack Discovery](/solutions/security/ai/attack-discovery.md)
+- [Attack Discovery](/solutions/security/ai/attack-discovery/index.md)
 
 For a full list of EIS-powered features, refer to [AI features powered by EIS](/explore-analyze/elastic-inference/eis.md#ai-features-powered-by-eis).
 

explore-analyze/workflows/use-cases/security/automate-security-operations/ai-driven-alert-triage.md

@@ -15,7 +15,7 @@ products:
 
 # Triage alerts with an AI agent [workflows-ai-driven-alert-triage]
 
-This guide walks through building a workflow that triages [Attack Discovery](/solutions/security/ai/attack-discovery.md) alerts with an [{{agent-builder}}](/explore-analyze/ai-features/elastic-agent-builder.md) agent. The workflow creates a case for each discovery, has an agent produce a remediation analysis, posts a concise summary to Slack, and isolates the host pending review.
+This guide walks through building a workflow that triages [Attack Discovery](/solutions/security/ai/attack-discovery/index.md) alerts with an [{{agent-builder}}](/explore-analyze/ai-features/elastic-agent-builder.md) agent. The workflow creates a case for each discovery, has an agent produce a remediation analysis, posts a concise summary to Slack, and isolates the host pending review.
 
 The workflow is adapted from [`ad-automated-triaging.yaml`](https://github.com/elastic/workflows/blob/main/workflows/security/response/ad-automated-triaging.yaml) in the `elastic/workflows` library.
 
@@ -24,7 +24,7 @@ If you're new to workflows, complete [Build your first workflow](/explore-analyz
 ## Before you begin [workflows-ai-driven-alert-triage-prereqs]
 
 - **Permissions.** `All` on **Analytics > Workflows**, **Security > Cases**, and whatever Agent Builder privilege is required to invoke agents in your space. Refer to [{{kib}} privileges](/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md).
-- **Attack Discovery enabled.** Attack Discovery must be running in your {{elastic-sec}} deployment and producing findings. Refer to [Attack Discovery](/solutions/security/ai/attack-discovery.md).
+- **Attack Discovery enabled.** Attack Discovery must be running in your {{elastic-sec}} deployment and producing findings. Refer to [Attack Discovery](/solutions/security/ai/attack-discovery/index.md).
 - **Agent Builder agent.** A configured agent in {{agent-builder}} that can reason over security context. Use one of the built-in agents (for example, the Elastic AI Agent) or a [custom agent](/explore-analyze/ai-features/agent-builder/custom-agents.md). The examples use `elastic-ai-agent` as a default. Substitute your agent ID.
 - **Slack connector.** A Slack [connector](/deploy-manage/manage-connectors.md) or webhook URL for notifications.
 - **Attach the workflow to a rule.** After saving the workflow, attach it to the Attack Discovery detection rule or the rule group you want to triage. Refer to [Alert triggers](/explore-analyze/workflows/triggers/alert-triggers.md).
@@ -378,7 +378,7 @@ steps:
 - [AI steps reference](/explore-analyze/workflows/steps/ai-steps.md): Parameters for `ai.agent`, `ai.classify`, `ai.summarize`, and `ai.prompt`.
 - [Call {{agent-builder}} agents from Elastic Workflows](/explore-analyze/ai-features/agent-builder/agents-and-workflows.md): How to wire agents into workflow steps.
 - [Cases action steps](/explore-analyze/workflows/steps/cases.md): Full reference for `cases.*` steps.
-- [Attack Discovery](/solutions/security/ai/attack-discovery.md): What Attack Discovery produces and how to enable it.
-- [Attacks page](/solutions/security/ai/attacks-page.md): The unified attacks UI where discoveries surface.
-- [Triage Attack Discovery findings](/solutions/security/ai/triage-attack-discovery-findings.md): The interactive triage flow this workflow automates.
+- [Attack Discovery](/solutions/security/ai/attack-discovery/index.md): What Attack Discovery produces and how to enable it.
+- [Attacks page](/solutions/security/ai/attack-discovery/manage-discoveries-from-attacks-page.md): The unified attacks UI where discoveries surface.
+- [Triage Attack Discovery findings](/solutions/security/ai/attack-discovery/triage-attack-discovery-findings.md): The interactive triage flow this workflow automates.
 - [`elastic/workflows` library](https://github.com/elastic/workflows): More agentic and SOC automation examples.

get-started/_snippets/security-overview.md

@@ -46,6 +46,6 @@ Before diving into setup and configuration, familiarize yourself with the founda
 * [**Security posture management:**](/solutions/security/cloud.md) Includes native cloud security features, such as Cloud Security Posture Management (CSPM) and Cloud Native Vulnerability Management (CNVM), that help you evaluate your cloud infrastructure's configuration against security best practices and identify vulnerabilities. You can use Elastic's native tools or ingest third-party cloud security data and incorporate it into {{elastic-sec}}'s workflows.
 * [**Agent Builder:**](/solutions/security/ai/agent-builder/agent-builder.md) Elastic's AI agent platform with a natural language chat interface, built-in agents and tools for security use cases, and the ability to create custom agents and tools. Starting in 9.4, Agent Builder is the default chat experience in {{elastic-sec}}.
 * [**AI Assistant:**](/solutions/security/ai/ai-assistant.md) Helps with tasks like alert investigation, incident response, and query generation. It utilizes natural language processing and knowledge retrieval to provide context-aware assistance, summarize threats, suggest next steps, and automate workflows. Use AI Assistant to better understand and respond to security incidents.
-* [**Attack Discovery:**](/solutions/security/ai/attack-discovery.md) Uses large language models (LLMs) to analyze security alerts, identify coordinated attack patterns, and provide actionable intelligence to security operations teams. It improves alert triage efficiency by automatically correlating related alerts into comprehensive, simplified threat summaries, allowing you to quickly understand and respond to the most impactful attacks.
+* [**Attack Discovery:**](/solutions/security/ai/attack-discovery/index.md) Uses large language models (LLMs) to analyze security alerts, identify coordinated attack patterns, and provide actionable intelligence to security operations teams. It improves alert triage efficiency by automatically correlating related alerts into comprehensive, simplified threat summaries, allowing you to quickly understand and respond to the most impactful attacks.
 * [**Elastic AI SOC Engine (EASE):**](/solutions/security/ai/ease/ease-intro.md) Integrates Elastic's AI-powered security tools into existing SIEM and EDR/XDR platforms to help mitigate alert fatigue, accelerate threat investigations, and improve response efficiency ({{serverless-short}} only).
 :::

redirects.yml

@@ -1026,4 +1026,40 @@ redirects:
   'reference/fleet/managed-integrations-content.md':
     to: 'reference/fleet/managed-content.md'
     anchors:
-      'managed-integrations-content':
+      'managed-integrations-content':
+
+  # Related to https://github.com/elastic/docs-content/pull/7448
+  # Hub page is attack-discovery/index.md, which publishes at the same URL as the
+  # former attack-discovery.md. Keep only split-out anchor redirects for that path.
+  'solutions/security/ai/attack-discovery.md':
+    many:
+      - to: 'solutions/security/ai/attack-discovery/grant-access.md'
+        anchors:
+          'attack-discovery-rbac':
+      - to: 'solutions/security/ai/attack-discovery/run-from-attack-discovery-page.md'
+        anchors:
+          'set-up-attack-discovery': 'set-up-attack-discovery'
+          'attack-discovery-generate-discoveries': 'attack-discovery-generate-discoveries'
+          'schedule-discoveries': 'schedule-discoveries'
+      - to: 'solutions/security/ai/attack-discovery/manage-discoveries-from-attack-discovery-page.md'
+        anchors:
+          'attack-discovery-workflows': 'attack-discovery-workflows'
+          'view-saved-discoveries':
+          'change-a-discoverys-status': 'discovery-status'
+          'share-attack-discoveries': 'share-attack-discoveries'
+          'take-bulk-actions': 'take-bulk-actions'
+          'search-and-filter-saved-discoveries': 'search-filter-discoveries'
+  'solutions/security/ai/attack-discovery/attack-discovery.md': 'solutions/security/ai/attack-discovery/index.md'
+  'solutions/security/ai/attacks-page.md':
+    to: 'solutions/security/ai/attack-discovery/manage-discoveries-from-attacks-page.md'
+    anchors:
+      'attacks-triage':
+    many:
+      - to: 'solutions/security/ai/attack-discovery/run-from-attacks-page.md'
+        anchors:
+          'attacks-prerequisites': 'run-from-attacks-page-prerequisites'
+          'attacks-schedule-discoveries': 'attacks-page-schedule-runs'
+      - to: 'solutions/security/ai/attack-discovery/manage-saved-discoveries.md'
+        anchors:
+          'attacks-next-steps': 'next-steps'
+  'solutions/security/ai/triage-attack-discovery-findings.md': 'solutions/security/ai/attack-discovery/triage-attack-discovery-findings.md'