ROX-32074: updates file activity docs for GA

modules/create-file-activity-monitoring-policy.adoc

@@ -36,21 +36,21 @@ Use glob syntax wildcard patterns in your policies to match multiple files or di
 * *Deployment*: Select this option to monitor file activity initiated by Kubernetes workloads, such as pods, jobs, or deployments. This source identifies when containers try to change their own files or the underlying host system.
 * *Node*: Select this option to monitor sensitive file activity from processes running directly on the host, such as SSH sessions, systemd services, or standalone scripts.
 
-. In the *Policy rules* section, add the policy fields that you want to use. For this policy, select *File activity* -> *File path*. 
+. In the *Policy rules* section, add the policy fields that you want to use. For this policy, select *File activity* -> *File path*.
 +
 [NOTE]
 ====
 The events and violations will show the actual path and effective path, where appropriate. However, the single file path field checks both of these fields.
 ====
 . Enter a file path pattern with optional wildcard characters in glob syntax, as shown in the following examples:
 +
-* For exact path matching, enter the full path without wildcards. 
+* For exact path matching, enter the full path without wildcards.
 ** Example: `/etc/ssh/sshd_config`
-* To match all files in a directory, use a single asterisk. 
+* To match all files in a directory, use a single asterisk.
 ** Example: `/etc/*.conf`
-* To match files at any depth in a directory tree, use double asterisks. 
+* To match files at any depth in a directory tree, use double asterisks.
 ** Example: `/var/log/app/**/*.log`
-* To match specific user directories, combine path segments with wildcards. 
+* To match specific user directories, combine path segments with wildcards.
 ** Example: `/home/*/.ssh/authorized_keys`
 
 . Optional: From *File operation*, select one or more operations to monitor:
@@ -59,10 +59,11 @@ The events and violations will show the actual path and effective path, where ap
 * *Create* - Detects new file creation.
 * *Rename* - Detects file rename operations. Provides the file that was moved and the location where the file was moved to.
 * *Delete (Unlink)* - Detects file deletion.
-* *Change permissions* - Detects permission modifications.
-* *Change ownership* - Detects ownership changes.
+* *Permission change* - Detects permission modifications.
+* *Ownership change* - Detects ownership changes.
+* *Extended attribute change* - Detects extended attribute (xattr) changes.
 
-. Optional: For node policies, you can create a policy that alerts on file activity from specific processes. For example, you can combine file activity and process filtering to suppress violations from legitimate system operations. For more information, see "Filter file activity by process".
+. Optional: You can create a policy that alerts on file activity from specific processes. For example, you can combine file activity and process filtering to suppress violations from legitimate system operations. For more information, see "Filter file activity by process".
 
 . Click *Save*.
 

modules/policy-criteria.adoc

@@ -934,27 +934,10 @@ File activity::
 |===
 | *Attribute* | *Description* | *JSON Attribute* | *Allowed Values* | *Regex*, *NOT*, *AND, OR* | *Phase*
 
-| Effective path
-| The file path as it appears to the process inside the container.
-| Effective Path
-| One of:
-
-/etc/passwd
-/etc/ssh/sshd_config
-/etc/shadow
-/etc/sudoers
-| AND, OR
-| *Runtime*
-
-| Actual path
-| The physical location of the file on the file system of the node.
-| Actual Path
-| One of:
-
-/etc/passwd
-/etc/ssh/sshd_config
-/etc/shadow
-/etc/sudoers
+| File path
+| A file path with optional glob patterns
+| File Path
+| String
 | AND, OR
 | *Runtime*
 
@@ -966,9 +949,11 @@ File activity::
 
 Open (Writable)
 Create
-Delete
+Rename
+Delete (Unlink)
 Permission change
 Ownership change
+Extended attribute change
 | AND, OR
 | *Runtime*
 
@@ -1087,15 +1072,10 @@ File activity::
 |===
 | *Attribute* | *Description* | *JSON Attribute* | *Allowed Values* | *Regex*, *NOT*, *AND, OR* | *Phase*
 
-| Actual path
-| The physical location of the file on the file system of the node or the underlying mount.
-| Actual Path
-| One of:
-
-/etc/passwd
-/etc/ssh/sshd_config
-/etc/shadow
-/etc/sudoers
+| File path
+| A file path with optional glob patterns
+| File Path
+| String
 | AND, OR
 | *Runtime*
 
@@ -1107,10 +1087,12 @@ File activity::
 
 Open (Writable)
 Create
-Delete
+Rename
+Delete (Unlink)
 Permission change
 Ownership change
+Extended attribute change
 | AND, OR
 | *Runtime*
 
-|===
+|===