Edit and refine content pre-publish

x-pack/auditbeat/processors/sessionmd/docs/add_session_metadata.asciidoc

@@ -1,12 +1,10 @@
 [[add-session-metadata]]
 === Add session metadata (Beta)
-
-beta::[]
-
 ++++
 <titleabbrev>add_session_metadata</titleabbrev>
 ++++
 
+beta::[]
 
 The `add_session_metadata` processor enriches process events with additional
 information that users can see using the {security-guide}/session-view.html[Session View] tool in the
@@ -29,26 +27,35 @@ auditbeat.modules:
 [[add-session-metadata-explained]]
 ==== How the `add_session_metadata` processor works
 
-==== Backends
-* `auto` is the recommended setting, and will attempt to use `ebpf` first, falling back to `procfs` if necessary, ensuring compatibility even on systems without `ebpf` support.
-* `ebpf` will collect process information with eBPF. This backend requires a system with Linux kernel 5.10.16 or above, kernel support for eBPF enabled, and auditbeat running as superuser.
-* `procfs` will collect process information with the proc filesystem. This is compatible with older systems that may not support ebpf. To gather complete process info, auditbeat requires permissions to read all process data in procfs; for example, run as a superuser or have the `SYS_PTRACE` capability. 
-
-==== Containers
-If running auditbeat in a container, the container must run in the host's PID namespace. With the `auto` or `ebpf` backend, these host directories must also be mounted to the same path within the container: `/sys/kernel/debug`, `/sys/fs/bpf` 
-The recommended `auto` setting attempts to use `ebpf` first, falling back to `procfs` if necessary, ensuring compatibility even on systems without `ebpf` support. 
-
 Using the available Linux kernel technology, the processor collects comprehensive information on all running system processes, compiling this data into a process database. 
 When processing an event (such as those generated by the {auditbeat} `auditd` module), the processor queries this database to retrieve information about related processes, including the parent process, session leader, process group leader, and entry leader. 
 It then enriches the original event with this metadata, providing a more complete picture of process relationships and system activities. 
 
 This enhanced data enables the powerful {security-guide}/session-view.html[Session View] tool in the
 {elastic-sec} platform, offering users deeper insights for analysis and investigation.
 
+[[add-session-metadata-backends]]
+===== Backends
+
+The `add_session_metadata` processor operates using various backend options.
+
+* `auto` is the recommended setting.
+  It attempts to use `ebpf` first, falling back to `procfs` if necessary, ensuring compatibility even on systems without `ebpf` support.
+* `ebpf` collects process information with eBPF. 
+  This backend requires a system with Linux kernel 5.10.16 or above, kernel support for eBPF enabled, and auditbeat running as superuser.
+* `procfs` collects process information with the proc filesystem. 
+  This is compatible with older systems that may not support ebpf. 
+    To gather complete process info, auditbeat requires permissions to read all process data in procfs; for example, run as a superuser or have the `SYS_PTRACE` capability. 
+
+[[add-session-metadata-containers]]
+===== Containers
+If you are running {auditbeat} in a container, the container must run in the host's PID namespace. 
+With the `auto` or `ebpf` backend, these host directories must also be mounted to the same path within the container: `/sys/kernel/debug`, `/sys/fs/bpf`. 
+
 [[add-session-metadata-enable]]
 ==== Enable and configure Session View in {auditbeat}
 
-To configure and enable Session View functionality, you'll:
+To configure and enable {security-guide}/session-view.html[Session View] functionality, you'll:
 
 * Add the `add_sessions_metadata` processor to your `auditbeat.yml` file.
 * Configure audit rules in your `auditbeat.yml` file.