[DOCS-9921] Add attacker clustering & attacker fingerprint public doc

[emmlejeail]

What does this PR do? What is the motivation?

• This PR adds documentation for two recently released features of ASM: attacker fingerprint & attacker clustering
• The pages are added under the Threats section of ASM docs
• Terms are updated to reference those pages too
• Screenshots to illustrate attacker fingerprint & attacker clustering

Merge instructions

Merge readiness:

• Ready for merge

Merge queue is enabled in this repo. To have it automatically merged after it receives the required reviews, create the PR (from a branch that follows the <yourname>/description naming convention) and then add the following PR comment:

/merge

Additional notes

[github-actions]

Preview links (active after the build_preview check completes)

New or renamed files

• https://docs-staging.datadoghq.com/emmanuelle.lejeail/attacker-clustering-fingerprinting/security/application_security/threats/attacker-clustering
• https://docs-staging.datadoghq.com/emmanuelle.lejeail/attacker-clustering-fingerprinting/security/application_security/threats/attacker-fingerprint

Modified Files

• https://docs-staging.datadoghq.com/emmanuelle.lejeail/attacker-clustering-fingerprinting/security/application_security/terms

[jkirsteins]

For the screenshots provided:

• It's not obvious what the screenshots are illustrating, without context imho. I'd suggest adding some guidance on where to look. E.g. we show a screenshot for detection rule editor -> should be a red box showing that focus should be on the tag part.
  • Or if we show the signal sidepanel, a red box should show that the interesting bit is the attacker section at the bottom.
• All of the IPs should be blurred out. IIRC that's the policy for screeenshots showing any kind of IP/user/email information, even if randomly generated.

[jkirsteins]

are a threat hunting tool.

Are they useful for anything outside of attacker clustering?

My intuitive understanding is no - the data is fragmented across many attributes, and those are not very clear how to use manually.

Unless we can share some use cases that don't involve relying on Attacker Clustering, I'd suggest framing this as a feature mainly intended to power attacker clustering.

I'd go even further - if they don't have standalone use cases we can demonstrate, I think this content should be on the Attacker Clustering doc page and not separate.

[emmlejeail]

We might be able to use it for blocking or more advanced threat hunting (probably requires good example from @Taiki-San) so I would keep it on it's own page. However it's true that at the moment it's only used for clustering so I'll focus the explanation on that