[DOCS-15474] Add default Standalone product info to Cloud SIEM docs

hugo/content/en/security/cloud_siem/detect_and_monitor/_index.md

@@ -59,8 +59,12 @@ The rule deprecation process is as follows:
 1. There is a warning with the deprecation date on the rule. In the UI, the warning is shown in the:
     - Signal side panel's {{< ui >}}Rule Details{{< /ui >}} > {{< ui >}}Playbook{{< /ui >}} section
     - [Rule editor][3] for that specific rule
-2. Once the rule is deprecated, there is a 15 month period before the rule is deleted. This is due to the signal retention period of 15 months. During this time, you can re-enable the rule by [cloning the rule][3] in the UI.
-3. Once the rule is deleted, you can no longer clone and re-enable it.
+2. After the rule is deprecated, the rule remains available for the length of your retention period before it is deleted. During this time, you can re-enable the rule by [cloning the rule][3] in the UI. The retention period depends on your [Cloud SIEM product][7]:
+    - Standalone: 365 days (12 months)
+    - Add-on with Flex Logs and Legacy: 15 months
+
+    Organizations that adopted Standalone before gigabyte-based usage was introduced have a 15-month retention period.
+3. After the rule is deleted, you can no longer clone and re-enable it.
 
 ## Suppressions
 
@@ -87,4 +91,5 @@ After setting up your detection rules, use the Cloud SIEM [MITRE ATT&CK Map][5]
 [3]: /security/detection_rules/#clone-a-rule
 [4]: /security/cloud_siem/detect_and_monitor/suppressions
 [5]: /security/cloud_siem/detection_rules/mitre_attack_map/
-[6]: /security/cloud_siem/detect_and_monitor/critical_assets
+[6]: /security/cloud_siem/detect_and_monitor/critical_assets
+[7]: /security/cloud_siem/guide/determine-cloud-siem-product/

hugo/content/en/security/cloud_siem/detect_and_monitor/mitre_attack_map.md

@@ -28,7 +28,7 @@ To view detection rules against the MITRE ATT&CK Framework:
 
 The default view of the map shows all Datadog out-of-the-box and custom rules for active sources, broken down into different attack techniques. Active sources are the sources of logs found and analyzed in the Cloud SIEM index.
 
-**Note**: For the legacy SKU, all ingested logs are analyzed by Cloud SIEM unless [security filters][2] have been set up.
+**Note**: For [Cloud SIEM Legacy][5], all ingested logs are analyzed by Cloud SIEM unless [Security Filters][2] have been set up.
 
 To view the map for all sources, in the {{< ui >}}Visualize{{< /ui >}} dropdown menu, select {{< ui >}}All Sources{{< /ui >}}. This shows all out-of-the-box rules, including those that are not currently used to detect threats from your logs.
 
@@ -73,3 +73,4 @@ Note the following formatting details:
 [2]: /security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes/
 [3]: https://app.datadoghq.com/security/siem/rules?query=product=siem&sort=date&viz=attck-map
 [4]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/?tab=threshold
+[5]: /security/cloud_siem/guide/determine-cloud-siem-product/

hugo/content/en/security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes.md

@@ -36,7 +36,7 @@ The filtering tools and configuration methods available depend on your Cloud SIE
 | Add-on with Flex Logs | Security Filters                         | [UI](#configure-security-filters-in-the-ui-add-on-with-flex-logs) and [API](#configure-security-filters-with-the-api) |
 | Legacy                | Security Filters                         | [API](#configure-security-filters-with-the-api)                                                                       |
 
-If you're not sure which Cloud SIEM product your organization uses, see [Determine the Cloud SIEM product your organization is using][2].
+Standalone is the default product for new Cloud SIEM organizations. If you're not sure which Cloud SIEM product your organization uses, see [Determine the Cloud SIEM product your organization is using][2].
 
 <div class="alert alert-info">Security Filters and log index filters control only the logs analyzed by Cloud SIEM. Logs generated by the Datadog Agent for Workload Protection (<code>source:runtime-security-agent</code>) and Cloud Security Misconfigurations (<code>source:compliance-agent</code>) are not billed as analyzed logs regardless of filter configuration.</div>
 
@@ -186,7 +186,7 @@ Example response:
 
 ### Add an exclusion to an existing Security Filter
 
-You can refine existing Security Filters using exclusion filters. These are useful to remove logs that would the main filter query would otherwise process. This example excludes logs tagged `env:staging`.
+You can refine existing Security Filters using exclusion filters. These are useful to remove logs that the main filter query would otherwise process. This example excludes logs tagged `env:staging`.
 
 1. GET existing Security Filters to find the filter's `id`:
    ```bash

hugo/content/en/security/cloud_siem/guide/determine-cloud-siem-product.md

@@ -1,6 +1,6 @@
 ---
 title: Determine the Cloud SIEM product your organization is using
-description: Cloud SIEM is available in Standalone, Add-on with Flex Logs, and Legacy products. Follow this guide to determine which product your organization is using.
+description: Cloud SIEM is available in Standalone, Add-on with Flex Logs, and Legacy products. Follow this guide to determine which product your organization is using and compare the features available in each.
 ---
 
 ## Overview
@@ -9,10 +9,19 @@ Cloud SIEM is available as the following products:
 - Add-on with Flex Logs
 - Legacy
 
+Standalone is the default product for new Cloud SIEM organizations. In Standalone:
+- Usage is measured in gigabytes of analyzed logs, rather than in millions of analyzed events.
+- Ingestion of logs indexed in the Cloud SIEM index is included in the analyzed log cost, rather than billed separately.
+- Data is retained for 365 days (12 months), rather than for 15 months.
+
+Organizations that adopted Standalone before gigabyte-based usage was introduced have a 15-month retention period. Both are referred to as Standalone in the documentation, because they provide the same features.
+
 There are two ways to see which Cloud SIEM product your organization is using:
 - [Check the Plan & Usage page](#plan-usage)
 - [Check the Cloud SIEM settings page](#settings)
 
+To compare what each product includes, see [Features by Cloud SIEM product](#features).
+
 ## Check the Plan & Usage page{#plan-usage}
 
 <div class="alert alert-info">You may not be able to use this option if:
@@ -87,8 +96,40 @@ In Datadog, go to the [Cloud SIEM settings][2] page. The page shows either a {{<
   </tbody>
 </table>
 
-Need additional assistance? Contact [Datadog support][3].
+## Features by Cloud SIEM product{#features}
+
+The following table lists the Cloud SIEM features available in each product.
+
+| Feature | Standalone | Add-on with Flex Logs | Legacy |
+|---------|:----------:|:---------------------:|:------:|
+| [Content Packs][4] | {{< X >}} | {{< X >}} | {{< X >}} |
+| [Editing default detection rules][5] | {{< X >}} | {{< X >}} | {{< X >}} |
+| [MITRE ATT&CK Map][6] | {{< X >}} | {{< X >}} | {{< X >}} |
+| [Security Filters][7] | | {{< X >}} | {{< X >}} |
+| [Log index filters][8] | {{< X >}} | | |
+| [MITRE ATT&CK Map compact view][6] | {{< X >}} | {{< X >}} | |
+| [Scheduled rules][9] | {{< X >}} | {{< X >}} | |
+| [Sequence detections][10] | {{< X >}} | {{< X >}} | |
+| [Historical jobs][11] | {{< X >}} | {{< X >}} | |
+| [Risk Insights][12] | {{< X >}} | {{< X >}} | |
+| [Critical Assets][13] | {{< X >}} | {{< X >}} | |
+| [Open Cybersecurity Schema Framework (OCSF)][14] | {{< X >}} | {{< X >}} | |
+| [Threat intelligence][15] | {{< X >}} | {{< X >}} | |
+
+For help identifying your product, or to use a feature your product does not include, contact your Datadog account team or [Datadog support][3].
 
 [1]: https://app.datadoghq.com/billing/usage
 [2]: https://app.datadoghq.com/security/configuration/siem/setup
 [3]: /help/
+[4]: /security/cloud_siem/ingest_and_enrich/content_packs/
+[5]: /security/detection_rules/
+[6]: /security/cloud_siem/detect_and_monitor/mitre_attack_map/
+[7]: /security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes/#how-security-filters-work
+[8]: /security/cloud_siem/guide/customize-which-logs-cloud-siem-analyzes/#cloud-siem-standalone-filter-the-cloud-siem-index
+[9]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/
+[10]: /security/cloud_siem/detect_and_monitor/custom_detection_rules/sequence/
+[11]: /security/cloud_siem/detect_and_monitor/historical_jobs/
+[12]: /security/cloud_siem/triage_and_investigate/entities_and_risk_scoring/
+[13]: /security/cloud_siem/detect_and_monitor/critical_assets/
+[14]: /security/cloud_siem/ingest_and_enrich/open_cybersecurity_schema_framework/
+[15]: /security/cloud_siem/ingest_and_enrich/threat_intelligence/