[DOCS-11464] doc for new Users explorer

[michaelcretzman]

DOCS-11464

New topic covering the new Users explorer for App and API Protection.

Merge instructions

Merge readiness:

• Ready for merge

[github-actions]

📝 Documentation Team Review Required

This pull request requires approval from the @DataDog/documentation team before it can be merged.

Please ensure your changes follow our documentation guidelines and wait for a team member to review and approve your changes.

[github-actions]

Preview links (active after the build_preview check completes)

New or renamed files

• https://docs-staging.datadoghq.com/mcretzman/DOCS-11464-aap-users-explorer/security/application_security/security_signals/users_explorer

[mauricesvay]

The Users explorer includes all users that are associated with security traces, not signals. There are multiple ways customers can associate a user to a trace: https://docs.datadoghq.com/security/application_security/how-it-works/add-user-info/?tab=java#adding-authenticated-user-information-to-traces-and-enabling-user-blocking-capability

[mauricesvay]

Users are identified by the @usr.id. When they are available, we also display the user name and e-mail.

[Taiki-San]

Users aren't a risk in themselves, or at least not generally. Some risks are about the user being under attack (for instance, attempts to compromise them) where they're the victim

[Taiki-San]

Also, if we're tracking traces, then any login attempt will cause a user to show up in there. In this case, the explorer becomes a user inventory (we then want to discourage a heavy handed approach to block any user in the explorer)

[brett0000FF]

Looks good! Just left a few minor suggestions. 🚀

[brett0000FF]

Just a general note that there is inconsistent capitalization for these explorers. For example, Attackers Explorer is all uppercase on its dedicated page.

[michaelcretzman]

I checked and they should all be titlecase: https://datadoghq.atlassian.net/wiki/spaces/WRITING/pages/5369593857/Datadog+products+and+features#T