Trusted applications: behavioral detection behavior

[benironside]

Summary

Fixes #4842 — in v9.2+ and serverless, behavioral detections no longer apply to trusted applications. This improves performance.

This PR updates two pages related to this functionality.

• @gabriellandau, please review both pages for accuracy and clarity!
• Docs reviewers, please let me know if you think the content in the {applies-switch} component needs a heading, or if it works as-is.

Thanks!

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

[github-actions]

Vale Linting Results

Summary: 1 suggestion found

💡 Suggestions (1)

File	Line	Rule	Message
solutions/security/manage-elastic-defend/trusted-applications.md	32	Elastic.WordChoice	Consider using 'run, start' instead of 'execute', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/manage-elastic-defend/optimize-elastic-defend.md
• solutions/security/manage-elastic-defend/trusted-applications.md

[gabriellandau]

We changed this in 9.2.5, but 9.2.4 still uses the old behavior. Can we clarify this?

[benironside]

We normally document the latest minor version, with the assumption that if people are on a given minor version, they're probably on the latest patch. Does that work in this case?

[gabriellandau]

We normally document the latest minor version, with the assumption that if people are on a given minor version, they're probably on the latest patch.

Is that documented anywhere for users? A user on 9.2.4 going to the 9.2 docs could easily think that the documented behavior applies to them.