Update security events docs

Added some missed updates to CE version. Fixed an outdated
prerequisite in CC version.

DOCS-2386

Author: ctauchen

calico-cloud/threat/security-event-management.mdx

@@ -20,7 +20,7 @@ Security events indicate that a threat actor may be present in your Kubernetes c
 
 **Required**
 
--- [Container threat detection is enabled](./container-threat-detection)
+- [WAF is enabled](./web-application-firewall.mdx)
 
 **Limitations**
 

calico-cloud_versioned_docs/version-21-2/threat/security-event-management.mdx

@@ -20,7 +20,7 @@ Security events indicate that a threat actor may be present in your Kubernetes c
 
 **Required**
 
--- [Container threat detection is enabled](./container-threat-detection)
+- [WAF is enabled](./web-application-firewall.mdx)
 
 **Limitations**
 
@@ -31,7 +31,7 @@ Security events indicate that a threat actor may be present in your Kubernetes c
 
 The **Security Events Dashboard** page gives you a high-level view of recent security events.
 You can use this visual reference to get an overall sense of your cluster's health.
-If you find anything that merits further investigation, you can click on an event for more details. 
+If you find anything that merits further investigation, you can click on an event for more details.
 
 * In the web console, go to **Threat defense > Security Events Dashboard**.
 
@@ -40,7 +40,7 @@ If you find anything that merits further investigation, you can click on an even
 ## Security Events
 
 The **Security Events** page lists all the security events that have been detected for your cluster.
-You can view and filter your security events to focus on 
+You can view and filter your security events to focus on
 
 * In the web console, go to **Threat Defense > Security Events**.
 
@@ -119,4 +119,4 @@ Security events generated from older managed clusters will not have values for t
 
 **Where can I view security event logs?**
 
-Go to: **Logs**, Kibana index, `tigera_secure_ee_events`.
+Go to: **Logs**, Kibana index, `tigera_secure_ee_events`.

calico-enterprise/threat/security-event-management.mdx

@@ -8,12 +8,13 @@ Manage security events from your cluster in a single place.
 
 ## Value
 
-Security events indicate that a threat actor may be present in your cluster. For example, a DNS request to a malicious hostname, a triggered WAF rule, or the opening of a sensitive file. $[prodname] provides security engineers and incident response teams with a single dashboard to manage threat alerts. Benefits include:
+Security events indicate that a threat actor may be present in your Kubernetes cluster. For example, a DNS request to a malicious hostname, a triggered WAF rule, or the opening of a sensitive file. $[prodname] provides security engineers and incident response teams with a single dashboard to manage threat alerts. Benefits include:
 
 - A filtered list of critical events with recommended remediation
 - Identify impacts on applications
 - Understand the scope and frequency of the issue
 - Manage alert noise by dismissing events (show/hide)
+- Manage alert noise by creating exceptions
 
 ## Before you begin
 
@@ -26,9 +27,44 @@ Security events indicate that a threat actor may be present in your cluster. For
 - Only WAF basic security events. Over time, the dashboard will contain a full range of $[prodname] security events.
 - You cannot control which users can view or edit the page using fine-grained role-based access controls
 
-## Security events dashboard
+## Security Events Dashboard
 
-In the web console, go to **Threat defense**, **Security Events**.
+The **Security Events Dashboard** page gives you a high-level view of recent security events.
+You can use this visual reference to get an overall sense of your cluster's health.
+If you find anything that merits further investigation, you can click on an event for more details.
+
+* In the web console, go to **Threat defense > Security Events Dashboard**.
+
+![Security Events Dashboard](/img/calico-enterprise/security-events-dashboard.png)
+
+## Security Events
+
+The **Security Events** page lists all the security events that have been detected for your cluster.
+You can view and filter your security events to focus on
+
+* In the web console, go to **Threat Defense > Security Events**.
+
+### Dismiss a security event
+
+You can clear your security events list by dismissing events that you've finished reviewing.
+When you dismiss an event, that event is no longer visibile in the list.
+
+1. In the web console, go to **Threat Defense > Security Events**.
+1. Find a security event in the list, and then click **Action > Dismiss Security Event**.
+
+### Create a security event exception
+
+You can prevent certain kinds of security events from appearing in the list by creating a security event exception.
+This is helpful if you want to reduce alert noise for workloads that you know are safe.
+When you create an exception, all matching security events are removed from the security events list.
+Future matches will not appear in the list.
+
+1. In the web console, go to **Threat Defense > Security Events**.
+1. Find a security event in the list, and then click **Action > Add exception**.
+1. On the **Create an Exception** dialog, select a scope for the exception and click **Create Exception**.
+
+You can manage your exceptions by clicking **Threat Defense > Security Events > Exceptions**.
+You can browse, edit, and delete exceptions on the list.
 
 ### UI help
 
@@ -83,4 +119,4 @@ Security events generated from older managed clusters will not have values for t
 
 **Where can I view security event logs?**
 
-Go to: **Logs**, Kibana index, `tigera_secure_ee_events`.
+Go to: **Logs**, Kibana index, `tigera_secure_ee_events`.

calico-enterprise_versioned_docs/version-3.19-2/threat/security-event-management.mdx

@@ -1,12 +1,10 @@
 ---
-description: Get alerts on threats in a single dashboard.
+description: Manage security events from your cluster in a single place.
 ---
 
 # Security event management
 
-## Big picture
-
-Get alerts on security events in a single dashboard.
+Manage security events from your cluster in a single place.
 
 ## Value
 
@@ -33,7 +31,7 @@ Security events indicate that a threat actor may be present in your Kubernetes c
 
 The **Security Events Dashboard** page gives you a high-level view of recent security events.
 You can use this visual reference to get an overall sense of your cluster's health.
-If you find anything that merits further investigation, you can click on an event for more details. 
+If you find anything that merits further investigation, you can click on an event for more details.
 
 * In the web console, go to **Threat defense > Security Events Dashboard**.
 
@@ -42,7 +40,7 @@ If you find anything that merits further investigation, you can click on an even
 ## Security Events
 
 The **Security Events** page lists all the security events that have been detected for your cluster.
-You can view and filter your security events to focus on 
+You can view and filter your security events to focus on
 
 * In the web console, go to **Threat Defense > Security Events**.
 
@@ -121,4 +119,4 @@ Security events generated from older managed clusters will not have values for t
 
 **Where can I view security event logs?**
 
-Go to: **Logs**, Kibana index, `tigera_secure_ee_events`.
+Go to: **Logs**, Kibana index, `tigera_secure_ee_events`.

calico-enterprise_versioned_docs/version-3.20-2/threat/security-event-management.mdx

@@ -8,12 +8,13 @@ Manage security events from your cluster in a single place.
 
 ## Value
 
-Security events indicate that a threat actor may be present in your cluster. For example, a DNS request to a malicious hostname, a triggered WAF rule, or the opening of a sensitive file. $[prodname] provides security engineers and incident response teams with a single dashboard to manage threat alerts. Benefits include:
+Security events indicate that a threat actor may be present in your Kubernetes cluster. For example, a DNS request to a malicious hostname, a triggered WAF rule, or the opening of a sensitive file. $[prodname] provides security engineers and incident response teams with a single dashboard to manage threat alerts. Benefits include:
 
 - A filtered list of critical events with recommended remediation
 - Identify impacts on applications
 - Understand the scope and frequency of the issue
 - Manage alert noise by dismissing events (show/hide)
+- Manage alert noise by creating exceptions
 
 ## Before you begin
 
@@ -26,9 +27,44 @@ Security events indicate that a threat actor may be present in your cluster. For
 - Only WAF basic security events. Over time, the dashboard will contain a full range of $[prodname] security events.
 - You cannot control which users can view or edit the page using fine-grained role-based access controls
 
-## Security events dashboard
+## Security Events Dashboard
 
-In the web console, go to **Threat defense**, **Security Events**.
+The **Security Events Dashboard** page gives you a high-level view of recent security events.
+You can use this visual reference to get an overall sense of your cluster's health.
+If you find anything that merits further investigation, you can click on an event for more details.
+
+* In the web console, go to **Threat defense > Security Events Dashboard**.
+
+![Security Events Dashboard](/img/calico-enterprise/security-events-dashboard.png)
+
+## Security Events
+
+The **Security Events** page lists all the security events that have been detected for your cluster.
+You can view and filter your security events to focus on
+
+* In the web console, go to **Threat Defense > Security Events**.
+
+### Dismiss a security event
+
+You can clear your security events list by dismissing events that you've finished reviewing.
+When you dismiss an event, that event is no longer visibile in the list.
+
+1. In the web console, go to **Threat Defense > Security Events**.
+1. Find a security event in the list, and then click **Action > Dismiss Security Event**.
+
+### Create a security event exception
+
+You can prevent certain kinds of security events from appearing in the list by creating a security event exception.
+This is helpful if you want to reduce alert noise for workloads that you know are safe.
+When you create an exception, all matching security events are removed from the security events list.
+Future matches will not appear in the list.
+
+1. In the web console, go to **Threat Defense > Security Events**.
+1. Find a security event in the list, and then click **Action > Add exception**.
+1. On the **Create an Exception** dialog, select a scope for the exception and click **Create Exception**.
+
+You can manage your exceptions by clicking **Threat Defense > Security Events > Exceptions**.
+You can browse, edit, and delete exceptions on the list.
 
 ### UI help
 
@@ -83,4 +119,4 @@ Security events generated from older managed clusters will not have values for t
 
 **Where can I view security event logs?**
 
-Go to: **Logs**, Kibana index, `tigera_secure_ee_events`.
+Go to: **Logs**, Kibana index, `tigera_secure_ee_events`.

calico-enterprise_versioned_docs/version-3.21-2/threat/security-event-management.mdx

@@ -8,12 +8,13 @@ Manage security events from your cluster in a single place.
 
 ## Value
 
-Security events indicate that a threat actor may be present in your cluster. For example, a DNS request to a malicious hostname, a triggered WAF rule, or the opening of a sensitive file. $[prodname] provides security engineers and incident response teams with a single dashboard to manage threat alerts. Benefits include:
+Security events indicate that a threat actor may be present in your Kubernetes cluster. For example, a DNS request to a malicious hostname, a triggered WAF rule, or the opening of a sensitive file. $[prodname] provides security engineers and incident response teams with a single dashboard to manage threat alerts. Benefits include:
 
 - A filtered list of critical events with recommended remediation
 - Identify impacts on applications
 - Understand the scope and frequency of the issue
 - Manage alert noise by dismissing events (show/hide)
+- Manage alert noise by creating exceptions
 
 ## Before you begin
 
@@ -26,9 +27,44 @@ Security events indicate that a threat actor may be present in your cluster. For
 - Only WAF basic security events. Over time, the dashboard will contain a full range of $[prodname] security events.
 - You cannot control which users can view or edit the page using fine-grained role-based access controls
 
-## Security events dashboard
+## Security Events Dashboard
 
-In the web console, go to **Threat defense**, **Security Events**.
+The **Security Events Dashboard** page gives you a high-level view of recent security events.
+You can use this visual reference to get an overall sense of your cluster's health.
+If you find anything that merits further investigation, you can click on an event for more details.
+
+* In the web console, go to **Threat defense > Security Events Dashboard**.
+
+![Security Events Dashboard](/img/calico-enterprise/security-events-dashboard.png)
+
+## Security Events
+
+The **Security Events** page lists all the security events that have been detected for your cluster.
+You can view and filter your security events to focus on
+
+* In the web console, go to **Threat Defense > Security Events**.
+
+### Dismiss a security event
+
+You can clear your security events list by dismissing events that you've finished reviewing.
+When you dismiss an event, that event is no longer visibile in the list.
+
+1. In the web console, go to **Threat Defense > Security Events**.
+1. Find a security event in the list, and then click **Action > Dismiss Security Event**.
+
+### Create a security event exception
+
+You can prevent certain kinds of security events from appearing in the list by creating a security event exception.
+This is helpful if you want to reduce alert noise for workloads that you know are safe.
+When you create an exception, all matching security events are removed from the security events list.
+Future matches will not appear in the list.
+
+1. In the web console, go to **Threat Defense > Security Events**.
+1. Find a security event in the list, and then click **Action > Add exception**.
+1. On the **Create an Exception** dialog, select a scope for the exception and click **Create Exception**.
+
+You can manage your exceptions by clicking **Threat Defense > Security Events > Exceptions**.
+You can browse, edit, and delete exceptions on the list.
 
 ### UI help
 
@@ -83,4 +119,4 @@ Security events generated from older managed clusters will not have values for t
 
 **Where can I view security event logs?**
 
-Go to: **Logs**, Kibana index, `tigera_secure_ee_events`.
+Go to: **Logs**, Kibana index, `tigera_secure_ee_events`.

calico-enterprise_versioned_docs/version-3.22-1/threat/security-event-management.mdx

@@ -8,12 +8,13 @@ Manage security events from your cluster in a single place.
 
 ## Value
 
-Security events indicate that a threat actor may be present in your cluster. For example, a DNS request to a malicious hostname, a triggered WAF rule, or the opening of a sensitive file. $[prodname] provides security engineers and incident response teams with a single dashboard to manage threat alerts. Benefits include:
+Security events indicate that a threat actor may be present in your Kubernetes cluster. For example, a DNS request to a malicious hostname, a triggered WAF rule, or the opening of a sensitive file. $[prodname] provides security engineers and incident response teams with a single dashboard to manage threat alerts. Benefits include:
 
 - A filtered list of critical events with recommended remediation
 - Identify impacts on applications
 - Understand the scope and frequency of the issue
 - Manage alert noise by dismissing events (show/hide)
+- Manage alert noise by creating exceptions
 
 ## Before you begin
 
@@ -26,9 +27,44 @@ Security events indicate that a threat actor may be present in your cluster. For
 - Only WAF basic security events. Over time, the dashboard will contain a full range of $[prodname] security events.
 - You cannot control which users can view or edit the page using fine-grained role-based access controls
 
-## Security events dashboard
+## Security Events Dashboard
 
-In the web console, go to **Threat defense**, **Security Events**.
+The **Security Events Dashboard** page gives you a high-level view of recent security events.
+You can use this visual reference to get an overall sense of your cluster's health.
+If you find anything that merits further investigation, you can click on an event for more details.
+
+* In the web console, go to **Threat defense > Security Events Dashboard**.
+
+![Security Events Dashboard](/img/calico-enterprise/security-events-dashboard.png)
+
+## Security Events
+
+The **Security Events** page lists all the security events that have been detected for your cluster.
+You can view and filter your security events to focus on
+
+* In the web console, go to **Threat Defense > Security Events**.
+
+### Dismiss a security event
+
+You can clear your security events list by dismissing events that you've finished reviewing.
+When you dismiss an event, that event is no longer visibile in the list.
+
+1. In the web console, go to **Threat Defense > Security Events**.
+1. Find a security event in the list, and then click **Action > Dismiss Security Event**.
+
+### Create a security event exception
+
+You can prevent certain kinds of security events from appearing in the list by creating a security event exception.
+This is helpful if you want to reduce alert noise for workloads that you know are safe.
+When you create an exception, all matching security events are removed from the security events list.
+Future matches will not appear in the list.
+
+1. In the web console, go to **Threat Defense > Security Events**.
+1. Find a security event in the list, and then click **Action > Add exception**.
+1. On the **Create an Exception** dialog, select a scope for the exception and click **Create Exception**.
+
+You can manage your exceptions by clicking **Threat Defense > Security Events > Exceptions**.
+You can browse, edit, and delete exceptions on the list.
 
 ### UI help
 
@@ -83,4 +119,4 @@ Security events generated from older managed clusters will not have values for t
 
 **Where can I view security event logs?**
 
-Go to: **Logs**, Kibana index, `tigera_secure_ee_events`.
+Go to: **Logs**, Kibana index, `tigera_secure_ee_events`.