Initialize docs for secops

[karenzone]

Set up files and file structure for secops

[andrewkroh]

These docs should not be included in 7.0 so I'm wondering how we handle this since we haven't branched for 7.0 yet.

[andrewkroh]

@elastic/secops We're starting a doc book for the project so we can start documenting some of the ways to get compatible host/network data into the system.

[lcawl]

I can successfully build this book with the following command:
./docs/build_docs.pl --doc stack-docs/docs/en/secops/index.asciidoc --chunk 1

If you don't want it to be published yet, we can just refrain from adding it to the https://github.com/elastic/docs/blob/master/conf.yaml for now.

[andrewkroh]

I'd like to split this apart and describe what the options are for host security monitoring and the options for the network security monitoring. We could list the products and what data they provide.

Host Security Monitoring

• Auditbeat
• Filebeat
  • System Module - Authentication logs.
  • Santa Module - Process execution monitoring for MacOS.

Network Security Monitoring

• Filebeat Bro Module
• Filebeat Suricata Module
• Filebeat Netflow Input
• Filebeat IPTables Module
• Packetbeat
• Auditbeat System Socket Module
• Any ECS compatible data source

Another way to present the information would be to turn it around and list the things you can monitor like processes, packages, and flows; and then list all things that can be used to monitor them. This might present better as a matrix with the features on the left and products across the top.

Host Security Monitoring

• Processes - Auditbeat / Filebeat Santa
• Network Connections - Auditbeat System Sockets Module / Winlogbeat + Sysmon
• System Changes - Auditbeat System Host Module
• Users - Auditbeat System User Module
• Logins / Logoffs - Auditbeat Login Module
• Packages - Auditbeat System Package Module

Network Security Monitoring

• Flows - Packetbeat / Filebeat Netflow / Filebeat Bro / Filebeat Suricata
• Firewalls
  • IPTables - Filebeat
• Deep Packet Inspection
  • DHCP - Packetbeat
  • DNS - Packetbeat / Filebeat Bro / Filebeat Suricata
  • HTTP - Packetbeat / Filebeat Bro
  • TLS - Packetbeat / Filebeat Bro
  • ICMP - Packetbeat

@karenzone I'll let you decide on what's the best way to present the information. I can help with filling in the details. We could merge this as and then continue to iterate from here or make the changes now.