Endpoint Insights feature — Serverless

[benironside]

Fixes #6301 — Adds documentation for the Endpoint Insights feature to serverless.

Preview: Use Endpoint Insights to find incompatible AV products on your hosts

Alternate page title: "Identify antivirus programs on your hosts"

[github-actions]

A documentation preview will be available soon.

• 🔨 Buildkite builds
• 📚 HTML diff
• 📙 Preview page

Request a new doc build by commenting

• Rebuild this PR: run docs-build
• Rebuild this PR and all Elastic docs: run docs-build rebuild

_{run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.}

_{If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.}

[mergify]

This pull request does not have a backport label. Could you fix it @benironside? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• v7.x is the label to automatically backport to the 7.x branch.
• v7./d./d is the label to automatically backport to the 7./d branch. /d is the digit

NOTE: backport-skip has been added to this pull request.

[szwarckonrad]

LGTM!
The only thing I think can be added is that creating a Trusted App requires the Trusted Apps privilege. Without it, links on all the generated insights will be disabled, and the user won’t be able to proceed.

[caitlinbetz]

Thanks @benironside this is great!!

A couple things -

• The Insights feature is expected to evolve over time, with the goal to identify and alert users to various endpoint "issues" that we may observe (either with genAI, or the endpoint itself.). No change needed at this point - I just want to make sure you're aware of this (I think the existing page you have would easily fit under an "Endpoint Insights" main page, if that is the plan!)
• agree with @szwarckonrad 's comment about making note of requiring the trusted application privilege to actually create the TA entry. The link there would be disabled with a tooltip explaining that the privilege is required.
• At the very end you link to this page, which is awesome. It may even help to call even more attention to this - that as a final step, if they have added a trusted app in Elastic we do recommend trusting/allowlisting Elastic in their other AV/EDR.

Thank you!!