elastic · karenzone · Jun 4, 2019 · Jun 4, 2019 · Jun 4, 2019
diff --git a/docs/en/secops/images/secops-architecture.png b/docs/en/secops/images/secops-architecture.png
diff --git a/docs/en/secops/index.asciidoc b/docs/en/secops/index.asciidoc
diff --git a/docs/en/secops/overview.asciidoc b/docs/en/secops/overview.asciidoc
diff --git a/docs/en/secops/sec-ui.asciidoc b/docs/en/secops/sec-ui.asciidoc
diff --git a/docs/en/siem/images/.DS_Store b/docs/en/siem/images/.DS_Store
diff --git a/docs/en/siem/images/siem-architecture.png b/docs/en/siem/images/siem-architecture.png
diff --git a/docs/en/siem/index.asciidoc b/docs/en/siem/index.asciidoc
@@ -0,0 +1,17 @@
+:doctype: book
+:siem-soln-cap: SIEM Monitoring
+:siem-soln: SIEM monitoring
+:siem-ui: SIEM UI
+
+= SIEM Solution Guide 
+
+//include::{asciidoc-dir}/../../shared/versions.asciidoc[]
+
+include::{asciidoc-dir}/../../shared/attributes.asciidoc[]
+
+include::overview.asciidoc[]
+
+//include::installation.asciidoc[]
+
+//include::siem-ui.asciidoc[]
+
diff --git a/docs/en/secops/installation.asciidoc → docs/en/siem/installation.asciidoc b/docs/en/secops/installation.asciidoc → docs/en/siem/installation.asciidoc
@@ -1,4 +1,4 @@
-[[install-sec-monitoring]]
+[[install-siem]]
 [role="xpack"]
 == Get up and running
 
@@ -27,7 +27,7 @@ such as the index pattern used to query the data, and the timestamp field used
 for sorting. For more information, see {kib}.
 
 [float]
-[[install-beats-for-sec]]
+[[install-beats]]
 === Install {beats} shippers
 
 To populate the security UI with metrics and

diff --git a/docs/en/siem/overview.asciidoc b/docs/en/siem/overview.asciidoc
@@ -0,0 +1,42 @@
+[[siem-overview]]
+//[role="xpack"]
+//== Overview
+
+
+== Coming soon
+
+Won't be long now!
+
+////
+beta[]
+
+{siem-soln-cap} gives you a comprehensive view into your security operations,
+and helps make those insights actionable.
+
+The UI in {kib} brings together data from a variety of sources, making it easier
+for you to identify and resolve security issues.
+
+[float]
+[[siem-components]]
+=== SIEM monitoring components
+
+Security monitoring requires the following {stack} components.
+
+image::images/siem-architecture.png[]
+
+*https://www.elastic.co/products/beats[{beats}]* are open source data
+shippers that you install as agents on your servers to send operational data to
+{es}.
+
+*https://www.elastic.co/products/elasticsearch[{es}]* is a real-time,
+distributed storage, search, and analytics engine. {es} excels is indexing
+streams of semi-structured data, such as logs or metrics.
+
+*https://www.elastic.co/products/kibana[{kib}]* is an open source analytics and
+visualization platform designed to work with {es}. You use {kib} to search,
+view, and interact with data stored in {es} indices. You can easily perform
+advanced data analysis and visualize your data in a variety of charts, tables,
+and maps.
+
+{kib} {siem-ui} provides a dedicated user interface for visualizing host security.
+////
diff --git a/docs/en/siem/siem-ui.asciidoc b/docs/en/siem/siem-ui.asciidoc
@@ -0,0 +1,14 @@
+[[siem-ui-overview]]
+[role="xpack"]
+== SIEM UI
+
+beta[]
+
+After you have security monitoring <<install-siem,up and
+running>> and data is streaming to {es}, use the {siem-ui} in {kib} to monitor
+and identify security problems in real time.
+
+For more information about working with the {siem-ui}, see the
+{kib} documentation.
+
+