Add a new section on how to collect CloudTrail events using Amazon Data Firehose

[alaudazzi]

This tutorial has reached a pretty stable status and is ready to be reviewed.

Doc preview.

Relates to #3819

[github-actions]

A documentation preview will be available soon.

• 🔨 Buildkite builds
• 📚 HTML diff
• 📙 Preview page

Request a new doc build by commenting

• Rebuild this PR: run docs-build
• Rebuild this PR and all Elastic docs: run docs-build rebuild

_{run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.}

_{If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.}

[mergify]

This pull request is now in conflict. Could you fix it @alaudazzi? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b cloudtrail-firehose upstream/cloudtrail-firehose
git merge upstream/main
git push upstream cloudtrail-firehose

[alaudazzi]

@zmoog
Thank you for contributing to the procedure with steps and diagrams.
However, with 1ed0a36 the draft from zmoog/public-notes#80 get merged within the current structure but then require a lot of postprocessing to get the right format and a successful build.
Just wondering if this approach might be reconsidered for future doc efforts?

[alaudazzi]

To give an example of how image references need to be reformatted

[alaudazzi]

@zmoog
I cleaned up the content and fixed the structure. This PR is ready to be reviewed. I still have some doubts about the readability of the diagrams.

[bmorelli25]

Is there a specific use case we could call out with each of these visualization/monitoring options?

[alaudazzi]

These are three different ways to visualize the same CloudTrail logs. But I'll defer to @zmoog to confirm.

[zmoog]

I considered one visualization to showcase a detailed view (Discover or Logs Explorer) and one high-level view (dashboard) of CloudTrail logs.

As a user, I often take this two-level approach of getting the feel of the dataset from a quantitative perspective (how many events, etc) and a qualitative perspective (inspecting some sample documents).

Three ways are probably too many.

@bmorelli25 @alaudazzi Is it better to offer one option only, or is there room for two?

[alaudazzi]

Promoting various visualization options is appropriate for tutorial-oriented content. We do the same in the Monitor VPC Flow Logs use case.

[zmoog]

Just wondering if this approach might be reconsidered for future doc efforts?

Yeah, I see the automation is pretty rough and needs more work.

I may use it personally as an intermediate step, but I'll create a .asciidoc file from now on until the automation improves.

[zmoog]

@alaudazzi, I like the changes you made to the initial draft of the issue thread. I'll use this as a reference for the upcoming documents on the AWS Network Firewall and the generic guide on CloudWatch and S3.