Add documentation for OCSF field mapping and correlation engine API

[cwillum]

Description

Adds documentation for OCSF field mapping types, and adds APIs for correlation engine.

Issues Resolved

Fixes #4500

Checklist

• By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
  For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[sbcd90]

the ocsf logs integration piece looks good but correlation engine api documentation is missing.

[getsaurabh02]

Can we provide description for TBDs here?

[getsaurabh02]

Same as above

[cwillum]

@sbcd90 @getsaurabh02 Yes, I could use some help with a few field/parameter descriptions. Those will be conspicuous with the "TBD" placeholder. The last thing I need is a screenshot that shows the log type selectors with VPC_Flow (or however that is labeled). Thanks for looking.

[Naarcha-AWS]

One small style question. Otherwise, LGTM

[cwillum]

Merge conflicts from same edits on different branches.

[natebower]

@cwillum Please see my comments and changes and let me know if you have any questions. Thanks!

[natebower]

Suggested change

	Correlation engine APIs allow you to create new correlation rules, view findings and correlations within a certain span of time, and perform other tasks.
	Correlation engine APIs allow you to create new correlation rules, view findings and correlations within a certain time window, and perform other tasks.

[natebower]

Suggested change

	Provides a list of all findings and their correlations within a specified window of time.
	Provides a list of all findings and their correlations within a specified time window:

[natebower]

Please rephrase as a complete sentence naming the noun (what is used to do this?).

[natebower]

Suggested change

	The Create custom rule API uses Sigma security rule formatting to create a custom rule. For information about how to write a rule in Sigma format, see information provided at [Sigma's GitHub repository](https://github.com/SigmaHQ/sigma).
	The Create custom rule API uses Sigma security rule formatting to create a custom rule. For information about how to write a rule in Sigma format, see the information provided in [Sigma's GitHub repository](https://github.com/SigmaHQ/sigma).

[natebower]

Suggested change

[Amazon Security Lake](https://docs.aws.amazon.com/security-lake/latest/userguide/what-is-security-lake.html) service converts security log and event data to the [Open Cybersecurity Schema Framework](https://docs.aws.amazon.com/security-lake/latest/userguide/open-cybersecurity-schema-framework.html) (OCSF) to normalize combined data and facilitate its management. OpenSearch supports ingestion of log data from Security Lake in the OCSF format, and Security Analytics can automatically map fields from OCSF to ECS (the default field-mapping schema).

[Amazon Security Lake](https://docs.aws.amazon.com/security-lake/latest/userguide/what-is-security-lake.html) converts security log and event data to the [Open Cybersecurity Schema Framework](https://docs.aws.amazon.com/security-lake/latest/userguide/open-cybersecurity-schema-framework.html) (OCSF) to normalize combined data and facilitate its management. OpenSearch supports ingestion of log data from Security Lake in the OCSF format, and Security Analytics can automatically map fields from OCSF to ECS (the default field-mapping schema).

[natebower]

Suggested change

The log types from Security Lake that can be used as log sources for detector creation include CloudTrail, Route 53, and VPC Flow. Given that Route 53 is a log that captures DNS activity, its log type should be specified as **DNS logs** when [defining a detector](#step-1-define-a-detector). Furthermore, since logs such as CloudTrail can be captured conceivably in both raw format and OCSF, it's good practice to name indexes in a way that keeps these logs separate and easily identifiable. This becomes helpful when specifying an index name in any of the APIs associated with Security Analytics.

The Security Lake log types that can be used as log sources for detector creation include CloudTrail, Route 53, and VPC Flow. Given that Route 53 is a log that captures DNS activity, its log type should be specified as **DNS logs** when [defining a detector](#step-1-define-a-detector). Furthermore, because logs such as CloudTrail can conceivably be captured in both raw format and OCSF, it's good practice to name indexes in a way that keeps these logs separate and easily identifiable. This becomes helpful when specifying an index name in any of the APIs associated with Security Analytics.

[natebower]

Confirm capitalization of the API name.