Update Bits Security Analyst supported sources

[feldmanr]

What changed

• Add Cloudflare, Windows, Slack, and GitLab to the supported Security log sources for Bits Security Analyst.
• Expand the Amazon GuardDuty coverage description to include the existing finding types plus the new IAM, Bedrock, EKS, ECS, Kubernetes, and S3 finding coverage.

Why

Bits Security Analyst supports additional log sources and GuardDuty finding types that are not represented in the current documentation.

Impact

Customers can see a more complete and accurate view of the sources and GuardDuty findings that Bits Security Analyst can investigate.

Validation

• Confirmed the branch is one commit ahead of master.
• Confirmed the diff changes only content/en/bits_ai/bits_security_analyst.md.
• Reviewed the rendered Markdown list structure and source names.

[github-actions]

Preview links (active after the build_preview check completes)

Modified Files

• https://docs-staging.datadoghq.com/ron.feldman/update-bits-supported-sources/bits_ai/bits_security_analyst

[janine-c]

Looks great! I think adding bullets to the list might make it a little easier to parse. Feel free to take this PR out of draft and merge it whenever you're ready 🙂

[janine-c]

Suggested change

	- Amazon GuardDuty
	- Amazon GuardDuty, where supported [finding types][6] cover:

[janine-c]

Suggested change

	- Supported [finding types][6] cover anomalous and compromised IAM credentials; EC2 and resource credential exfiltration and misuse; Bedrock logging changes, anomalous model invocation, cost harvesting, and direct prompt injection; compromised EKS and ECS cluster attack sequences; Kubernetes credential access, anomalous behavior, execution, privilege escalation, persistence, policy changes, and malicious callers; S3 anomalous behavior, data exposure, malicious callers, and penetration test activity; CloudTrail or S3 defense evasion; and attack sequences correlating IAM credential and S3 data compromise.
	- Anomalous and compromised IAM credentials
	- EC2 and resource credential exfiltration and misuse
	- Bedrock logging changes, anomalous model invocation, cost harvesting, and direct prompt injection
	- Compromised EKS and ECS cluster attack sequences
	- Kubernetes credential access, anomalous behavior, execution, privilege escalation, persistence, policy changes, and malicious callers
	- S3 anomalous behavior, data exposure, malicious callers, and penetration test activity
	- CloudTrail or S3 defense evasion
	- Attack sequences correlating IAM credential and S3 data compromise