[DOCS-15189] WP: structural and routing fixes (nav, redirects, dead pages)

[drichards-87]

What does this PR do? What is the motivation?

Follow-up to #38502, targeting the Workload Protection revamp branch.

Structure and routing only. No new explanations, no rewritten prose. Every change is a moved
page, a redirect, a nav entry, a deleted duplicate, or a repointed link.

Items marked ✅ were confirmed with the Workload Protection team.

---

Summary

#	Change
1	Renames the getting_started/ section to setup/
2	Removes a duplicate Workload Protection nav block, and restores the Detection Rules entry for the whole Security section
3	Adds 15 redirects so no published URL 404s, and removes 6 redirects that pointed nowhere useful
4	Deletes 6 pages whose content now lives elsewhere
5	Restores the Hosts and Containers and Serverless pages, which were unreachable ✅
6	Scopes the eBPF-less agent docs to AWS Fargate ✅

---

1. getting_started/ → setup/

Every other security product calls this section Setup, and so did Workload Protection before
the revamp:

Product	Section name
Code Security · CSM · App & API Protection · Sensitive Data Scanner	Setup
Workload Protection on master	Setup
Workload Protection on this branch, before	Getting started

/getting_started/security/ is also a separate site-level section, so reusing that name inside a
product is ambiguous.

What moved: _index, advanced_configuration, docker, ecs_ec2, fargate, kubernetes,
linux_ebpf, windows — 8 pages, moved with git mv so history is preserved.

What was updated to match: the nav label, 15 nav identifiers, 8 nav URLs, 26 inbound links,
and the 3 install-tile partials in layouts/partials/workload-protection/.

---

2. Navigation

Problem	What was wrong	Fix
Duplicate section	Two Workload Protection top-level items, and 4 duplicate identifiers: workload_protection, workload_protection_inventory, workload_protection_guides, workload_protection_troubleshooting	Removed the leftover block. Its 3 child entries were byte-identical to ones already present.
Detection Rules missing site-wide	The entry for /security/detection_rules/ had been dropped, taking identifier security_rules with it. The page still exists but had no sidebar entry for any security product, and its OOTB Rules child was left parentless.	Restored byte-identical to master.
OOTB Rules orphaned	Pointed at parent workload_protection_workload_security_rules, which no longer exists	Entry removed along with its stub page (see §4)

master has 0 duplicate identifiers and 0 orphaned parents. This branch had 4 and 2. Both are now 0.

---

3. Redirects

Every URL that is live today still resolves after this merges. 17 URLs are removed by the branch; all 17 redirect.

Two are easy to miss, because deleting a single page drops two URLs — the page plus an older
alias it was carrying:

• guide/eBPF-free-agent also carried /security/cloud_security_management/guide/ebpf-free-agent
• workload_security_rules/ carried 3 older aliases; custom_rules carried 1

Full redirect map (17)

Removed URL	Now redirects to
/security/cloud_security_management/guide/active-protection	/security/workload_protection/respond_and_report/
/security/workload_protection/guide/active-protection	/security/workload_protection/respond_and_report/
/security/workload_protection/guide/eBPF-free-agent	/security/workload_protection/setup/
/security/workload_protection/inventory/coverage_map	/security/workload_protection/inventory/coverage
/security/workload_protection/investigate_agent_events	/security/workload_protection/investigate_and_triage/agent_events
/security/workload_protection/secl_auth_guide	/security/workload_protection/detect_and_monitor/agent_rules/secl_guide
/security/workload_protection/security_signals	/security/workload_protection/investigate_and_triage/security_signals/
/security/workload_protection/setup/agent	/security/workload_protection/setup/
/security/workload_protection/setup/agent/docker	/security/workload_protection/setup/docker
/security/workload_protection/setup/agent/ecs_ec2	/security/workload_protection/setup/ecs_ec2
/security/workload_protection/setup/agent/kubernetes	/security/workload_protection/setup/kubernetes
/security/workload_protection/setup/agent/linux	/security/workload_protection/setup/linux_ebpf
/security/workload_protection/setup/agent/windows	/security/workload_protection/setup/windows
/security/workload_protection/setup/agent_variables	/security/workload_protection/setup/advanced_configuration
/security/workload_protection/setup/ootb_rules	/security/workload_protection/detect_and_monitor/detection_rules
/security/workload_protection/workload_security_rules	/security/workload_protection/detect_and_monitor/
/security/workload_protection/workload_security_rules/custom_rules	/security/workload_protection/detect_and_monitor/agent_rules/policy_management

6 redirects removed. Four pointed at paths that only ever existed on this branch, left over
from in-branch renames: respond_and_report/active_protection, automated_response, response,
and remediation. The response one was shadowing a real page — see §4. The other two,
inventory/hosts_and_containers and inventory/serverless, were shadowing live pages — see §5.

Every alias remaining in Workload Protection now maps to a URL that is live on master.

---

4. Deleted pages

Page	Why	Now redirects to
respond_and_report/response.md ✅	Respond and Report should have no child pages. Its content largely duplicated the page's own ## Response section.	n/a — URL was never published
workload_security_rules/_index.md	Superseded by detect_and_monitor/, which covers the same pipeline, "Saving resources by design", and Agent-expression examples	detect_and_monitor/
workload_security_rules/custom_rules.md	Superseded by agent_rules/policy_management (policies, tags, deployment) and detection_rules (rule creation)	agent_rules/policy_management
setup/ootb_rules.md	8-line stub. Its one uncovered sentence was folded into detection_rules.md.	detect_and_monitor/detection_rules
inventory/coverage_map.md	The new Coverage page is a rewrite of it	inventory/coverage
security/threats/agent.md	Stale build artifact, not intended to be tracked	n/a — was shadowed, never rendered

On security/threats/agent.md: it carried the <!-- SOURCED FROM ... datadog-agent --> marker
that the build inserts into pulled files, and described the product as "CSM Threats". An alias on
workload_protection/_index.md already claimed its URL, so it never published.

Links retargeted (8), 3 of them outside Workload Protection: security/_index.md,
security/detection_rules/_index.md, security/threats/agent.md,
cloud_security_management/guide/custom-rules-guidelines.md,
cloud_security_management/guide/identify-unauthorized-anomalous-procs.md, and
investigate_and_triage/agent_events.md. One pointed at ?tab=host#create-custom-rules, an
anchor that does not exist on master either.

---

5. Hosts and Containers and Serverless restored ✅

Both are still live views in the product. On this branch, inventory/_index.md declared aliases
for both of their URLs, which meant Hugo served a redirect instead of the pages — and their nav
entries had been removed. Both were completely unreachable. Same for coverage_map, though
that one genuinely was superseded.

Coverage should be a standalone page, so the section now has a parent with three siblings:

Before

Coverage  (/inventory)
  ↑ coverage_map, hosts_and_containers, and serverless all aliased to here;
    nav entries for all three removed

After

Assess Coverage  (/inventory)                          new hub page
├── Coverage              (/inventory/coverage)        the rewritten Coverage content
├── Hosts and Containers  (/inventory/hosts_and_containers)
└── Serverless            (/inventory/serverless)

hosts_and_containers and serverless keep the exact URLs they have on master, so no redirects
are needed for them. The new hub follows the
API Inventory
pattern: short intro, one line per child view. Assess Coverage is the nav label and page title;
prose calls the feature Inventory, matching the product.

---

6. eBPF-less scoped to AWS Fargate ✅

eBPF-less is supported on Fargate only. Three places on the branch implied general Linux support,
plus one dead link:

Location	Was	Now
setup/_index.md Requirements	eBPF-less listed as a choice under "On Linux"	Its own bullet: "On AWS Fargate, install the eBPF-less agent"
setup/_index.md support table	"eBPF-less agent supports the following Linux distributions — Any, kernel 3.4.43+"	Table removed; the ptrace detail moved into the Fargate bullet
setup/_index.md heading	"eBPF-less agent (Linux)"	"eBPF-less agent (AWS Fargate)"
wp-ebpfless-tiles.html	A Linux tile linking to setup/linux_ebpfless, a page that does not exist	Tile removed; only the Fargate tile remains

The cloud environments table already read AWS Fargate | ✅ (only using eBPF-less agent), so it
agrees with the new wording.

---

Verification

Check	Before	After
Published URLs that would 404	10	0
Alias/page collisions introduced	1	0
Duplicate nav identifiers	4	0
Orphaned nav parents	2	0
Broken internal links in Workload Protection	6	1

The one remaining broken link is supported_linux_distributions.md:29 — held deliberately, see below.

Merge instructions

Merge readiness:

• Ready for merge

Additional notes

Worth a second opinion: SECL content changes ownership. SECL links now point at
secl_guide.md, which covers everything the removed agent_expressions page did — a matching
22-row operators table, the patterns and duration sections, and a working #operators anchor. But
agent_expressions was single-sourced from DataDog/datadog-agent, and secl_guide.md is
hand-maintained. linux_expressions and windows_expressions are still pulled. The tables match
today, but the operators table lists a minimum Agent version per operator, and that will now drift
silently as the Agent adds operators. Flagging it so this is a decision rather than a side effect.

Open items, deliberately not in this PR:

Item	Detail
supported_linux_distributions.md	Orphaned — no nav entry and no inbound links, on this branch or master. Holds a 4th copy of the Linux support matrix, and its one remaining link is broken. Delete it?
response.md content	8 sections existed only on the deleted page, including the system-probe.yaml setup steps and a "Cancel network isolation" action. It also disagreed with the index on 3 facts: whether enforcement is enabled by default, whether network probes are, and what the removed status applies to. Shared for review separately.
workload_security_rules/ content	4 items existed only on the deleted pages. The largest is the Assisted rule creator procedure, including its File integrity monitoring and Process activity monitoring options. Shared for review separately.
CentOS support row	setup/_index.md reads CentOS 7; #31645 set it to 7, 8, and CentOS Stream 9. Content fix, separate PR.
finding_rules.md step count	Says the rule editor "walks you through five steps", then documents three. Content fix, separate PR.

[github-actions]

Preview links (active after the build_preview check completes)

New or renamed files

• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/inventory/coverage

Removed or renamed files (these should redirect)

• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/threats/agent
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/getting_started/
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/inventory/coverage_map
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/respond_and_report/response
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/setup/ootb_rules
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/workload_security_rules/
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/workload_security_rules/custom_rules

Renamed files

• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/setup/advanced_configuration
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/setup/docker
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/setup/ecs_ec2
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/setup/fargate
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/setup/kubernetes
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/setup/linux_ebpf
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/setup/windows

Modified Files

• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/getting_started/security/cloud_security_management
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/cloud_security_management/guide/custom-rules-guidelines
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/cloud_security_management/guide/identify-unauthorized-anomalous-procs
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/detection_rules/
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/detect_and_monitor/
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/detect_and_monitor/agent_rules/policy_management
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/detect_and_monitor/agent_rules/secl_guide
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/detect_and_monitor/agent_rules/variables_and_actions
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/detect_and_monitor/detection_rules
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/detect_and_monitor/finding_rules
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/inventory/
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/investigate_and_triage/agent_events
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/respond_and_report/
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/setup/
• https://docs-staging.datadoghq.com/deforest/wp-tier1-correctness/security/workload_protection/supported_linux_distributions

[github-actions]

⚠️ Possible site support note detected

The following files have a site-region shortcode at the top of the page that mentions a feature being "not available" or "not supported":

• content/en/getting_started/security/cloud_security_management.md

Are you trying to document site support for a product? If so, the site-region shortcode is not the recommended approach. See the Documenting site support guide for the preferred method.