Document ASM Overview page (#37857)

* Rework AAP overview into API Posture, Threat Protection, and Attack Summary pages

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Update content/en/security/application_security/overview/api_posture.md

Co-authored-by: domalessi <111786334+domalessi@users.noreply.github.com>

* Update content/en/security/application_security/overview/threat_protection.md

Co-authored-by: domalessi <111786334+domalessi@users.noreply.github.com>

* Update content/en/security/application_security/overview/threat_protection.md

Co-authored-by: domalessi <111786334+domalessi@users.noreply.github.com>

* Update content/en/security/application_security/overview/api_posture.md

Co-authored-by: domalessi <111786334+domalessi@users.noreply.github.com>

* Link Threat Management in Attack Coverage section

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Rename AAP overview directory to overview-pages

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Rename AAP overview-pages directory back to overview

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Add screenshots to API Posture and Threat Protection overview pages

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Rename AAP overview menu items for clarity

Update menu labels to "Overview Pages", "API Posture Overview", and
"Threat Protection Overview" for consistency.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Restructure AAP overview docs into product pillars

Fold the API Posture and Threat Protection overview pages into their
existing pillars instead of a separate Overview section, so the docs
match how the pillars already group functionality with UI pages (and
avoid duplicate "API Posture"/"Threat Protection" nav entries).

- Move overview/api_posture.md -> api_posture/overview.md
- Move overview/threat_protection.md -> threat_protection/overview.md
- Restore Attack Summary as the standalone overview/_index.md page
- Menu: drop the Overview Pages parent, add Overview entries first under
  the API Posture and Threat Protection pillars, and order the top-level
  pillars (API Posture, Threat Protection, Attack Summary) to match the UI
- Fix further_reading links (incl. broken /overview-pages/ link)
- Editorial fixes: serial comma, Powerpacks capitalization, consistent
  "Threat Protection" term, and two clarity tweaks

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Move Attack Summary out of the overview path

Relocate the Attack Summary page from overview/_index.md to
attack_summary.md so its URL is /security/application_security/attack_summary/
instead of the now-confusing /overview/ path. Alias the old URL to avoid
breaking existing links, and drop the redundant disable_toc: false.

- overview/_index.md -> attack_summary.md (removes the empty overview/ dir)
- Add /security/application_security/overview/ alias
- Update further_reading links on the two overview pages
- Menu: update URL and rename identifier to application_security_attack_summary

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: domalessi <111786334+domalessi@users.noreply.github.com>
Co-authored-by: dominique.alessi <dominique.alessi@datadoghq.com>

Author: 3 people

config/_default/menus/main.en.yaml

@@ -8287,21 +8287,26 @@ menu:
       parent: application_security
       identifier: appsec_threats_management_setup
       weight: 3
-    - name: Overview
-      url: security/application_security/overview
+    - name: Attack Summary
+      url: security/application_security/attack_summary/
       parent: application_security
-      identifier: application_security_overview
-      weight: 4
+      identifier: application_security_attack_summary
+      weight: 6
     - name: Threat Protection
       url: security/application_security/threat_protection/
       parent: application_security
       identifier: application_security_threat_protection
       weight: 5
+    - name: Overview
+      url: security/application_security/threat_protection/overview/
+      parent: application_security_threat_protection
+      identifier: application_security_threat_protection_overview
+      weight: 1
     - name: Security Signals
       url: security/application_security/threat_protection/security_signals
       parent: application_security_threat_protection
       identifier: application_security_security_signals
-      weight: 1
+      weight: 2
     - name: Attackers Explorer
       url: security/application_security/threat_protection/security_signals/attacker-explorer/
       parent: application_security_security_signals
@@ -8326,7 +8331,7 @@ menu:
       url: security/application_security/threat_protection/policies/
       parent: application_security_threat_protection
       identifier: application_security_policies
-      weight: 2
+      weight: 3
     - name: Custom Rules
       url: security/application_security/threat_protection/policies/custom_rules/
       parent: application_security_policies
@@ -8351,27 +8356,32 @@ menu:
       url: security/application_security/threat_protection/exploit-prevention/
       parent: application_security_threat_protection
       identifier: exploit_prevention
-      weight: 3
+      weight: 4
     - name: WAF Integrations
       url: security/application_security/threat_protection/waf-integration/
       parent: application_security_threat_protection
       identifier: aws_waf_int
-      weight: 4
+      weight: 5
     - name: Account Takeover Protection
       url: security/application_security/threat_protection/account_takeover_protection/
       parent: application_security_threat_protection
       identifier: security_ato_protection
-      weight: 5
+      weight: 6
     - name: API Posture
       url: security/application_security/api_posture/
       parent: application_security
       identifier: application_security_api_security
-      weight: 6
+      weight: 4
+    - name: Overview
+      url: security/application_security/api_posture/overview/
+      parent: application_security_api_security
+      identifier: application_security_api_security_overview
+      weight: 1
     - name: API Inventory
       url: security/application_security/api_posture/api_inventory/
       parent: application_security_api_security
       identifier: asm_api_security
-      weight: 1
+      weight: 2
     - name: API Endpoints
       url: security/application_security/api_posture/api_inventory/api_endpoints/
       parent: asm_api_security
@@ -8386,17 +8396,17 @@ menu:
       url: security/application_security/api_posture/api_findings/
       parent: application_security_api_security
       identifier: application_security_api_findings
-      weight: 2
+      weight: 3
     - name: Endpoint Scanning
       url: security/application_security/api_posture/endpoint_scanning/
       parent: application_security_api_security
       identifier: application_security_endpoint_scanning
-      weight: 3
+      weight: 4
     - name: Sensitive Data
       url: security/application_security/api_posture/sensitive_data/
       parent: application_security_api_security
       identifier: application_security_sensitive_data
-      weight: 4
+      weight: 5
     - name: Guides
       url: security/application_security/guide/
       parent: application_security

content/en/security/application_security/api_posture/overview.md

@@ -0,0 +1,43 @@
+---
+title: API Posture Overview
+disable_toc: false
+further_reading:
+- link: "/security/application_security/threat_protection/overview/"
+  tag: "Documentation"
+  text: "Threat Protection Overview"
+- link: "/security/application_security/attack_summary/"
+  tag: "Documentation"
+  text: "Attack Summary"
+---
+
+The **API Posture** overview page gives you a security-focused view of your API estate. It surfaces how well your endpoints are covered, the open findings affecting them, the endpoints most exposed to risk, and the policies that protect them. The following sections describe each area of the page.
+
+{{< img src="security/application_security/overview/api_posture.png" alt="API Posture overview page" >}}
+
+## Ask Bits panel
+
+The **Ask Bits** panel is a contextual entry point to Bits AI for questions about your API posture. It offers ready-made prompts such as **Top priorities**, **Summarize Last Week insights**, and **What I'm exposed to?** to help you start an investigation without writing a query. The panel appears when Bits AI is enabled and you have the required access. You can dismiss it.
+
+## Coverage
+
+The **Coverage** section provides an inventory overview of your API endpoints. It classifies endpoints as **Documented** (receiving traffic and described in your API definitions), **Orphan** (documented but receiving no traffic), and **Shadow** (receiving traffic but undocumented). It also breaks down the authentication posture of your endpoints across **Authenticated**, **Unauthenticated**, and **Undetected** states, and highlights the top sensitive data types observed across your endpoints.
+
+## Open Findings
+
+The **Open Findings** section summarizes the API security findings that are open. Findings are broken down by severity (critical, high, medium, and low) and by the rules that generate them, so you can see which issues are most pressing and which rules account for the most findings. The counts reflect the selected time range, so you can compare findings at the start and end of the period.
+
+## Threats Exposure
+
+The **Threats Exposure** section ranks the endpoints that are most exposed to risk, surfacing those with the highest number of critical and high-severity findings. From here you can examine a specific endpoint and the findings affecting it to prioritize remediation.
+
+## Policies Coverage
+
+The **Policies Coverage** section shows how your API protection is configured. It reports the deployment status of your API finding rules, including which rules are enabled and which are disabled, and it displays coverage across OWASP API Security categories so you can identify gaps in protection.
+
+## Customize Page
+
+Use the **Customize Page** button in the page header to tailor the page to your needs. In the popover, drag sections between the **Visible** and **Hidden** areas to control which sections appear, and reorder visible sections by dragging them. Your changes persist locally so the page keeps your layout on future visits.
+
+## Further reading
+
+{{< partial name="whats-next/whats-next.html" >}}

…/application_security/overview/_index.md …y/application_security/attack_summary.mdcontent/en/security/application_security/overview/_index.md renamed to content/en/security/application_security/attack_summary.md content/en/security/application_security/overview/_index.md renamed to content/en/security/application_security/attack_summary.md

@@ -1,8 +1,16 @@
 ---
 title: Attack Summary
 aliases:
+  - /security/application_security/overview/
   - /security/application_security/threats/threat-overview
   - /security/application_security/threats/attack-summary
+further_reading:
+- link: "/security/application_security/api_posture/overview/"
+  tag: "Documentation"
+  text: "API Posture Overview"
+- link: "/security/application_security/threat_protection/overview/"
+  tag: "Documentation"
+  text: "Threat Protection Overview"
 ---
 
 <!-- {{< img src="security/application_security/threats/appsec-threat-overview-page-top.png" alt="Screenshot of the AAP Attack Summary page"  >}} -->
@@ -17,7 +25,7 @@ Attack Surface Area
 : This section provides insights into the exposed services, the tools attackers are using, and the commercial scanners that identify potential vulnerabilities.
 
 Attack Traffic
-: These graphs identify the classification of attacks, such as SSRF, LFI, SQL and command injection. They allow users to identify spikes in malicious traffic and patterns.
+: These graphs identify the classification of attacks, such as SSRF, LFI, SQL, and command injection. They allow users to identify spikes in malicious traffic and patterns.
 
 Business Logic
 : This section focuses on fraud and business logic abuse such as account takeover attempts or any custom business logic events tracked by your application.
@@ -34,11 +42,15 @@ Attack Traffic Sources
 5. Use **Attack Traffic Sources** to compare the attack traffic sources with your expected customer locations.
 6. Use [Powerpacks](#using-powerpacks) to enhance your dashboards with the most relevant information.
 
-### Using powerpacks
+### Using Powerpacks
 
 When adding a widget to a [new dashboard][1] in Datadog, choose the **Powerpacks** section in the tray. Filter on `tag:attack_summary` or type `Attack Summary` in the search box.
 
 Each section in the **Attack Summary** page corresponds to a dedicated powerpack.
 
+## Further reading
+
+{{< partial name="whats-next/whats-next.html" >}}
+
 [1]: https://app.datadoghq.com/dashboard/lists
 [2]: https://app.datadoghq.com/security/appsec/threat

content/en/security/application_security/threat_protection/overview.md

@@ -0,0 +1,49 @@
+---
+title: Threat Protection Overview
+disable_toc: false
+further_reading:
+- link: "/security/application_security/api_posture/overview/"
+  tag: "Documentation"
+  text: "API Posture Overview"
+- link: "/security/application_security/attack_summary/"
+  tag: "Documentation"
+  text: "Attack Summary"
+---
+
+The **Threat Protection** overview page shows how well your services are instrumented and protected against attacks, the security signals they generate, the services most exposed to threats, and the trends in attack activity. The following sections describe each area of the page.
+
+{{< img src="security/application_security/overview/threat_protection.png" alt="Threat Protection overview page" >}}
+
+## Ask Bits panel
+
+The **Ask Bits** panel is a contextual entry point to Bits AI for questions about your threat protection. It offers ready-made prompts such as **Top priorities**, **Summarize Last Week insights**, and **What I'm exposed to?** to help you start an investigation without writing a query. The panel appears when Bits AI is enabled and you have the required access. You can dismiss it.
+
+## App Instrumentation
+
+The **App Instrumentation** section reports how broadly App and API Protection (AAP) is activated across your services. **Threat detection coverage** shows how many services are actively detecting threats in real time compared to your total services, and **Recommended services activated** tracks your progress in enabling AAP on at-risk services identified by known vulnerabilities and suspicious traffic. From this section you can protect additional services or view the services already protected.
+
+## Attack Coverage
+
+The **Attack Coverage** section shows how well your services are protected against attack vectors. **Attack Tools** reports how many exposed services are protected from scanners, bots, and similar tooling through AAP monitoring and blocking, and **Exploit Prevention** reports how many services are protected from exploits through Runtime Application Self-Protection (RASP). The section also highlights services that need [Threat Protection][1] enabled or a tracing library upgrade.
+
+## Open Signals
+
+The **Open Signals** section summarizes the security signals that are open. Signals are broken down by severity (critical, high, medium, and low) with a trend comparison to the previous time window of equal length, and they are shown across **Open** and **Under Review** states. The section also lists the top rules triggering signals so you can see what is driving activity.
+
+## Threats Exposure
+
+The **Threats Exposure** section ranks the services that are most exposed to threats, surfacing those that have triggered the most signals. From here you can examine a specific service to investigate the activity targeting it.
+
+## Threat Trends
+
+The **Threat Trends** section highlights patterns in attack activity. **Top attack types** shows the most common categories of detected attacks, and **Top countries** shows the geographic distribution of attack sources by origin country. You can pivot to the Traces Explorer for deeper analysis of the underlying activity.
+
+## Customize Page
+
+Use the **Customize Page** button in the page header to tailor the page to your needs. In the popover, drag sections between the **Visible** and **Hidden** areas to control which sections appear, and reorder visible sections by dragging them. Your changes persist locally so the page keeps your layout on future visits.
+
+## Further reading
+
+{{< partial name="whats-next/whats-next.html" >}}
+
+[1]: /security/application_security/how-it-works/#identify-services-exposed-to-application-attacks