diff --git a/docs/detections/alerts-reduce.asciidoc b/docs/detections/alerts-reduce.asciidoc index 9cc9ec56ce..2520b1d457 100644 --- a/docs/detections/alerts-reduce.asciidoc +++ b/docs/detections/alerts-reduce.asciidoc @@ -9,7 +9,7 @@ | <> a| *_Stops a specific rule's notification actions from running_*. -Use to avoid unnecessary notifications from a specific rule. The rule continues to run and generate alerts during the snooze period, but its <> don't run. +Use to avoid unnecessary notifications from a specific rule. The rule continues to run and generate alerts during the snooze period, but its <> don't run. | {kibana-ref}/maintenance-windows.html[Maintenance window] a| *_Prevents all rules' notification actions from running_*. diff --git a/docs/detections/alerts-ui-manage.asciidoc b/docs/detections/alerts-ui-manage.asciidoc index 1613a1074b..96eac3e0e6 100644 --- a/docs/detections/alerts-ui-manage.asciidoc +++ b/docs/detections/alerts-ui-manage.asciidoc @@ -22,7 +22,7 @@ The Alerts page offers various ways for you to organize and triage detection ale [role="screenshot"] image::images/view-alert-details.png[View details button, 200] -* View the rule that created an alert. Click a name in the *Rule* column to open the rule's details page. +* View the rule that created an alert. Click a name in the *Rule* column to open the rule's details. * View the details of the host and user associated with the alert. In the Alerts table, click a host name to open the <>, or a user name to open the <>. @@ -115,7 +115,7 @@ image::images/group-alerts-expand.png[Expanded alert group with alerts table] Use the toolbar buttons in the upper-left of the Alerts table to customize the columns you want displayed: * **Columns**: Reorder the columns. -* **_x_ fields sorted**: Sort the table by one or more columns. +* **Sort fields _x_**: Sort the table by one or more columns. * **Fields**: Select the fields to display in the table. You can also add <> to detection alerts and display them in the Alerts table. Click the *Full screen* button in the upper-right to view the table in full-screen mode. diff --git a/docs/detections/alerts-view-details.asciidoc b/docs/detections/alerts-view-details.asciidoc index b4e7f1699c..29a8f00825 100644 --- a/docs/detections/alerts-view-details.asciidoc +++ b/docs/detections/alerts-view-details.asciidoc @@ -94,10 +94,6 @@ The About section has the following information: + NOTE: The event renderer only displays if an event renderer exists for the alert type. Fields are interactive; hover over them to access the available actions. -* **Last alert status change**: Shows the last time the alert's status was changed, along with the user who changed it. - -* **MITRE ATT&CK**: Provides relevant https://attack.mitre.org/[MITRE ATT&CK] framework tactics, techniques, and sub-techniques. - [discrete] [[investigation-section]] == Investigation diff --git a/docs/detections/images/about-section-rp.png b/docs/detections/images/about-section-rp.png index 754cf1c0dd..8df877381d 100644 Binary files a/docs/detections/images/about-section-rp.png and b/docs/detections/images/about-section-rp.png differ diff --git a/docs/serverless/alerts/alerts-ui-manage.asciidoc b/docs/serverless/alerts/alerts-ui-manage.asciidoc new file mode 100644 index 0000000000..feb495ba01 --- /dev/null +++ b/docs/serverless/alerts/alerts-ui-manage.asciidoc @@ -0,0 +1,306 @@ +[[security-alerts-manage]] += Manage detection alerts + +// :description: Filter alerts, view trends, and start investigating and analyzing detections on the Alerts page. +// :keywords: serverless, security, alerting, how-to, manage + +++++ +Alerts +++++ + + +The Alerts page displays all detection alerts. + +[role="screenshot"] +image::images/alerts-ui-manage/-detections-alert-page.png[Alerts page overview] + +[discrete] +[[detection-view-and-filter-alerts]] +== View and filter detection alerts + +The Alerts page offers various ways for you to organize and triage detection alerts as you investigate suspicious events. You can: + +* View an alert's details. Click the **View details** button from the Alerts table to open the alert details flyout. Learn more at <>. ++ +[role="screenshot"] +image:images/alerts-ui-manage/-detections-view-alert-details.png[View details button] +* View the rule that created an alert. Click a name in the **Rule** column to open the rule's details. +* View the details of the host and user associated with the alert. In the Alerts table, click a host name to open the <>, or a user name to open the <>. +* Filter for a specific rule in the KQL bar (for example, `kibana.alert.rule.name :"SSH (Secure Shell) from the Internet"`). KQL autocomplete is available for `.alerts-security.alerts-*` indices. +* Use the date and time filter to define a specific time range. By default, this filter is set to search the last 24 hours. +* Use the drop-down filter controls to filter alerts by up to four fields. By default, you can filter alerts by **Status**, **Severity**, **User**, and **Host**, and you can <> to use other fields. +* Visualize and group alerts by specific fields in the visualization section. Use the buttons on the left to select a view type (**Summary**, **Trend**, **Counts**, or **Treemap**), and use the menus on the right to select the ECS fields used for grouping alerts. Refer to <> for more on each view type. +* Hover over a value to display available <>, such as **Filter In**, **Filter Out**, and **Add to timeline**. Click the expand icon for more options, including **Show top _x_** and **Copy to Clipboard**. The available options vary based on the type of data. ++ +[role="screenshot"] +image:images/alerts-ui-manage/-detections-inline-actions-menu.png[Inline additional actions menu] +* Filter alert results to include building block alerts or to only show alerts from indicator match rules by selecting the **Additional filters** drop-down. By default, <> are excluded from the Overview and Alerts pages. You can choose to include building block alerts on the Alerts page, which expands the number of alerts. ++ +[role="screenshot"] +image::images/alerts-ui-manage/-detections-additional-filters.png[Alerts table with Additional filters menu highlighted] ++ +[NOTE] +==== +When updating alert results to include building block alerts, the Security app searches the `.alerts-security.alerts-` index for the `kibana.alert.building_block_type` field. When looking for alerts created from indicator match rules, the app searches the same index for `kibana.alert.rule.type:'threat_match'`. +==== +* View detection alerts generated by a specific rule. Go to **Rules** → **Detection rules (SIEM)**, then select a rule name in the table. The rule details page displays a comprehensive view of the rule's settings, and the Alerts table under the Trend histogram displays the alerts associated with the rule, including alerts from any previous or deleted revision of that rule. + +[discrete] +[[drop-down-filter-controls]] +== Edit drop-down filter controls + +By default, the drop-down controls on the Alerts page filter alerts by **Status**, **Severity**, **User**, and **Host**. You can edit them to filter by different fields, as well as remove, add, and reorder them if you prefer a different order. + +[role="screenshot"] +image::images/alerts-ui-manage/-detections-alert-page-dropdown-controls.png[Alerts page with drop-down controls highlighted] + +[NOTE] +==== +* You can have a maximum of four controls on the Alerts page. +* You can't remove the **Status** control. +* If you make any changes to the controls, you _must_ save the pending changes for them to persist. +* Saved changes are stored in your browser's local storage, not your {ref}/user-profile.html[user profile]. If you clear your browser's storage or log into your user profile from a different browser, you will lose your customizations. +==== + +. Click the three-dot icon next to the controls (image:images/icons/boxesHorizontal.svg[More actions]), then select **Edit Controls**. +. Do any of the following: ++ +** To reorder controls, click and drag a control by its handle (image:images/icons/grabHorizontal.svg[Reorder]). +** To remove a control, hover over it and select **Remove control** (image:images/icons/cross.svg[Remove]). +** To edit a control, hover over it and select **Edit control** (image:images/icons/pencil.svg[Edit]). +** To add a new control, click **Add Controls** (image:images/icons/plusInCircle.svg[Add]). If you already have four controls, you must first remove one to make room for the new one. +. If you're editing or adding a control, do the following in the configuration flyout that opens: ++ +.. In the **Field** list, select the field for the filter. The **Control type** is automatically applied to the field you selected. +.. Enter a **Label** to identify the control. +.. Click **Save and close**. +. Click **Save pending changes** (image:images/icons/save.svg[Save]). + +[discrete] +[[group-alerts]] +== Group alerts + +You can group alerts by rule name, user name, host name, source IP address, or any other field. Select **Group alerts by**, then select an option or **Custom field** to specify a different field. + +Select up to three fields for grouping alerts. The groups will nest in the order you selected them, and the nesting order is displayed above the table next to **Group alerts by**. + +[role="screenshot"] +image::images/alerts-ui-manage/-detections-group-alerts.png[Alerts table with Group alerts by drop-down] + +Each group displays information such as the alerts' severity and how many users, hosts, and alerts are in the group. The information displayed varies depending on the selected fields. + +To interact with grouped alerts: + +* Select the **Take actions** menu to perform a bulk action on all alerts in a group, such as <>. +* Click a group's name or the expand icon (image:images/icons/arrowRight.svg[Next]) to display alerts within that group. You can filter and customize this view like any other alerts table. ++ +[role="screenshot"] +image::images/alerts-ui-manage/-detections-group-alerts-expand.png[Expanded alert group with alerts table] + +[discrete] +[[customize-the-alerts-table]] +== Customize the Alerts table + +Use the toolbar buttons in the upper-left of the Alerts table to customize the columns you want displayed: + +* **Columns**: Reorder the columns. +* **Sort fields _x_**: Sort the table by one or more columns. +* **Fields**: Select the fields to display in the table. You can also add <> to detection alerts and display them in the Alerts table. + +Click the **Full screen** button in the upper-right to view the table in full-screen mode. + +[role="screenshot"] +image::images/alerts-ui-manage/-detections-alert-table-toolbar-buttons.png[Alerts table with toolbar buttons highlighted] + +Use the view options drop-down in the upper-right of the Alerts table to control how alerts are displayed: + +* **Grid view**: Displays alerts in a traditional table view with columns for each field +* **Event rendered view**: Display alerts in a descriptive event flow that includes relevant details and context about the event. + +[role="screenshot"] +image::images/alerts-ui-manage/-detections-event-rendered-view.png[Alerts table with the Event rendered view enabled] + +[TIP] +==== +When using grid view, you can view alert-rendered reason statements and event renderings for specific alerts by clicking the expand icon in the **Reason** column. Some events do not have event renderings. +==== + +[discrete] +[[alert-actions]] +== Take actions on an alert + +From the Alerts table or the alert details flyout, you can: + +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> +* <> (Alert details flyout only) +* <> +* <> +* <> +* <> + +[discrete] +[[detection-alert-status]] +=== Change an alert's status + +You can set an alert's status to indicate whether it needs to be investigated +(**Open**), is under active investigation (**Acknowledged**), or has been resolved +(**Closed**). By default, the Alerts page displays open alerts. To filter alerts that are **Acknowledged** or **Closed**, use the **Status** drop-down filter at the top of the Alerts page. + +To change an alert's status, do one of the following: + +* In the Alerts table, click **More actions** (**...**) in the alert's row, then select a status. +* In the Alerts table, select the alerts you want to change, click **Selected _x_ alerts** at the upper-left above the table, and then select a status. ++ +[role="screenshot"] +image:images/alerts-ui-manage/-detections-alert-change-status.png[Bulk action menu with multiple alerts selected] +* beta:[] To bulk-change the status of <>, select the **Take actions** menu for the group, then select a status. +* In an alert's details flyout, click **Take action** and select a status. + +[discrete] +[[apply-alert-tags]] +=== Apply and filter alert tags + +Use alert tags to organize related alerts into categories that you can filter and group. For example, use the `False Positive` alert tag to label a group of alerts as false positives. Then, search for them by entering the `kibana.alert.workflow_tags : "False Positive"` query into the KQL bar. Alternatively, use the Alert table's <> to filter for tagged alerts. + +[NOTE] +==== +You can manage alert tag options by updating the `securitySolution:alertTags` advanced setting. Refer to <> for more information. +==== + +[TIP] +==== +To display alert tags in the Alerts table, click **Fields** and add the `kibana.alert.workflow_tags` field. +==== + +To apply or remove alert tags on individual alerts, do one of the following: + +* In the Alerts table, click **More actions** (**...**) in an alert's row, then click **Apply alert tags**. Select or unselect tags, then click **Apply tags**. +* In an alert’s details flyout, click **Take action → Apply alert tags**. Select or unselect tags, then click **Apply tags**. + +To apply or remove alert tags on multiple alerts, select the alerts you want to change, then click **Selected _x_ alerts** at the upper-left above the table. Click **Apply alert tags**, select or unselect tags, then click **Apply tags**. + +[role="screenshot"] +image::images/alerts-ui-manage/-detections-bulk-apply-alert-tag.png[Bulk action menu with multiple alerts selected] + +[discrete] +[[assign-users-to-alerts]] +=== Assign users to alerts + +Assign users to alerts that you want them to investigate, and manage alert assignees throughout an alert's lifecycle. + +.Requirements +[NOTE] +==== +All <>, except for the Viewer role, can assign and unassign users to alerts. +==== + +[IMPORTANT] +==== +Users are not notified when they've been assigned to, or unassigned from, alerts. +==== + +|=== +| Action | Instructions + +| Assign users to an alert +a| Choose one of the following: + +* **Alerts table** - Click **More actions** (**...**) in an alert's row, then click **Assign alert**. Select users, then click **Apply**. +* **Alert details flyout** - Click **Take action → Assign alert**. Alternatively, click the **Assign alert** icon (image:images/icons/plusInCircle.svg[Assign alert]) at the top of the alert details flyout, select users, then click **Apply**. + +| Unassign all users from an alert +a| Choose one of the following: + +* **Alerts table** - Click **More actions** (**...**) in an alert's row, then click **Unassign alert**. +* **Alert details flyout** - Click **Take action → Unassign alert**. + +| Assign users to multiple alerts +a| From the Alerts table, select the alerts you want to change. Click **Selected _x_ alerts** at the upper-left above the table, then click **Assign alert**. Select users, then click **Apply**. + +[NOTE] +==== +Users assigned to some of the selected alerts will be displayed as unassigned in the selection list. Selecting said users will assign them to all alerts they haven't been assigned to yet. +==== + +| Unassign users from multiple alerts +| From the Alerts table, select the alerts you want to change and click **Selected _x_ alerts** at the upper-left above the table. Click **Unassign alert** to remove users from the alert. +|=== + +Show users that have been assigned to alerts by adding the **Assignees** column to the Alerts table (**Fields** → `kibana.alert.workflow_assignee_ids`). Up to four assigned users can appear in the **Assignees** column. If an alert is assigned to five or more users, a number appears instead. + +[role="screenshot"] +image::images/alerts-ui-manage/-detections-alert-assigned-alerts.png[Alert assignees in the Alerts table] + +Assigned users are automatically displayed in the alert details flyout. Up to two assigned users can be shown in the flyout. If an alert is assigned to three or more users, a numbered badge displays instead. + +[role="screenshot"] +image::images/alerts-ui-manage/-detections-alert-flyout-assignees.png[Alert assignees in the alert details flyout] + +[discrete] +[[filter-assigned-alerts]] +=== Filter assigned alerts + +Click the **Assignees** filter above the Alerts table, then select the users you want to filter by. + +[role="screenshot"] +image::images/alerts-ui-manage/-detections-alert-filter-assigned-alerts.png[Filtering assigned alerts] + +[discrete] +[[add-exception-from-alerts]] +=== Add a rule exception from an alert + +You can add exceptions to the rule that generated an alert directly from the +Alerts table. Exceptions prevent a rule from generating alerts even when its +criteria are met. + +To add an exception, click the **More actions** menu (**...**) in the Alerts table, then select +**Add exception**. Alternatively, select **Take action** → **Add rule exception** in the alert details flyout. + +For information about exceptions and how to use them, refer to +<>. + +[discrete] +[[signals-to-timelines]] +=== View alerts in Timeline + +* To view a single alert in Timeline, click the **Investigate in timeline** button in the Alerts table. Alternatively, select **Take action** → **Investigate in timeline** in the alert details flyout. ++ +[role="screenshot"] +image:images/alerts-ui-manage/-detections-timeline-button.png[Investigate in timeline button] +* To view multiple alerts in Timeline (up to 2,000), select the checkboxes next to the alerts, then click **Selected _x_ alerts** → **Investigate in timeline**. ++ +[role="screenshot"] +image:images/alerts-ui-manage/-detections-bulk-add-alerts-to-timeline.png[Bulk add alerts to timeline button] + +[TIP] +==== +When you send an alert generated by a +<> to Timeline, all matching events are +listed in the Timeline, even ones that did not reach the threshold value. For +example, if you have an alert generated by a threshold rule that detects 10 +failed login attempts, when you send that alert to Timeline, all failed login +attempts detected by the rule are listed. +==== + +Suppose the rule that generated the alert uses a Timeline template. In this case, when you investigate the alert in Timeline, the dropzone query values defined in the template are replaced with their corresponding alert values. + +**Example** + +This Timeline template uses the `host.name: "{host.name}"` dropzone filter in +the rule. When alerts generated by the rule are investigated in Timeline, the +`{host.name}` value is replaced with the alert's `host.name` value. If the +alerts's `host.name` value is `Windows-ArsenalFC`, the Timeline dropzone query +is `host.name: "Windows-ArsenalFC"`. + +[NOTE] +==== +Refer to <> for information on creating Timelines and Timeline +templates. For information on how to add Timeline templates to rules, refer to <>. +==== diff --git a/docs/serverless/alerts/reduce-notifications-alerts.asciidoc b/docs/serverless/alerts/reduce-notifications-alerts.asciidoc new file mode 100644 index 0000000000..304ae120ba --- /dev/null +++ b/docs/serverless/alerts/reduce-notifications-alerts.asciidoc @@ -0,0 +1,32 @@ +[[security-reduce-notifications-alerts]] += Reduce notifications and alerts + +// :description: A comparison of alert-reduction features. +// :keywords: serverless, security, how-to + + +{elastic-sec} offers several features to help reduce the number of notifications and alerts generated by your detection rules. This table provides a general comparison of these features, with links for more details: + +|=== +| | + +| <> +a| **_Stops a specific rule's notification actions from running_**. + +Use to avoid unnecessary notifications from a specific rule. The rule continues to run and generate alerts during the snooze period, but its <> don't run. + +| <> +a| **_Prevents all rules' notification actions from running_**. + +Use to avoid false alarms and unnecessary notifications during planned outages. All rules continue to run and generate alerts during the maintenance window, but their <> don't run. + +| <> +a| **_Reduces repeated or duplicate alerts_**. + +Use to reduce the number of alerts created when a rule meets its criteria repeatedly. Duplicate qualifying events are grouped, and only one alert is created for each group. + +| <> +a| **_Prevents a rule from creating alerts under specific conditions_**. + +Use to reduce false positive alerts by preventing trusted processes and network activity from generating unnecessary alerts. You can configure an exception to be used by a single rule or shared among multiple rules, but they typically don't affect _all_ rules. +|=== diff --git a/docs/serverless/alerts/view-alert-details.asciidoc b/docs/serverless/alerts/view-alert-details.asciidoc new file mode 100644 index 0000000000..d35a462253 --- /dev/null +++ b/docs/serverless/alerts/view-alert-details.asciidoc @@ -0,0 +1,328 @@ +[[security-view-alert-details]] += View detection alert details + +// :description: Expand an alert to view detailed alert data. +// :keywords: serverless, security, defend, reference, manage + +++++ +View alert details +++++ + + +To learn more about an alert, click the **View details** button from the Alerts table. This opens the alert details flyout, which helps you understand and manage the alert. + +[role="screenshot"] +image::images/view-alert-details/-detections-open-alert-details-flyout.gif[Expandable flyout, 90%] + +Use the alert details flyout to begin an investigation, open a case, or plan a response. Click **Take action** at the bottom of the flyout to find more options for interacting with the alert. + +[discrete] +[[alert-details-flyout-ui]] +== Alert details flyout UI + +The alert details flyout has a right panel, a preview panel, and a left panel. Each panel provides a different perspective of the alert. + +[discrete] +[[right-panel]] +=== Right panel + +The right panel provides an overview of the alert. Expand any of the collapsed sections to learn more about the alert. You can also hover over fields on the **Overview** and **Table** tabs to display available <>. + +[role="screenshot"] +image::images/view-alert-details/-detections-alert-details-flyout-right-panel.png[Right panel of the alert details flyout, 65%] + +From the right panel, you can also: + +* Click **Expand details** to open the <>, which shows more information about sections in the right panel. +* Click the **Chat** icon (image:images/view-alert-details/-detections-ai-assistant-chat.png[AI assistant chat icon,15,15]) to access the <>. +* Click the **Share alert** icon (image:images/icons/share.svg[Share alert]) to get a shareable alert URL. We _do not_ recommend copying the URL from your browser's address bar, which can lead to inconsistent results if you've set up filters or relative time ranges for the Alerts page. ++ +[NOTE] +==== +If you've configured the {kibana-ref}/settings.html#server-publicBaseUrl[`server.publicBaseUrl`] setting in the `kibana.yml` file, the shareable URL is also in the `kibana.alert.url` field. You can find the field by searching for `kibana.alert.url` on the **Table** tab. +==== ++ +[IMPORTANT] +==== +If you've enabled grouping on the Alerts page, the alert details flyout won't open until you expand a collapsed group and select an individual alert. +==== + +* Click the **Flyout settings** icon (image:images/view-alert-details/-detections-flyout-settings.png[Flyout settings icon,15,15]) to access options for displaying the alert details flyout. The **Overlay** option (which displays the flyout over the Alerts table) is selected by default. Select **Push** to display the flyout to the side of the table instead. In either display, you can resize the flyout panels to your liking. Clicking **Reset size** reverts the flyout to its default dimensions. + +* Find basic details about the alert, such as the: ++ +** Associated rule +** Alert status and when the alert was created +** Date and time the alert was created +** Alert severity and risk score (these are inherited from rule that generated the alert) +** Users assigned to the alert (click the image:images/icons/plusInCircle.svg[Assign alert] icon to assign more users) +** Notes attached to the alert (click the image:images/icons/plusInCircle.svg[Add note] icon to create a new note) +* Click the **Table** or **JSON** tabs to display the alert details in table or JSON format. In table format, alert details are displayed as field-value pairs. + +[discrete] +[[preview-panel]] +=== Preview panel + +Some areas in the flyout provide previews when you click on them. For example, clicking **Show rule summary** in the rule description displays a preview of the rule's details. To close the preview, click **Back** or **x**. + +[role="screenshot"] +image::images/view-alert-details/-detections-alert-details-flyout-preview-panel.gif[Preview panel of the alert details flyout, 65%] + +[discrete] +[[left-panel]] +=== Left panel + +The left panel provides an expanded view of what's shown in the right panel. To open the left panel, do one of the following: + +* Click **Expand details** at the top of the right panel. ++ +[role="screenshot"] +image:images/view-alert-details/-detections-expand-details-button.png[Expand details button at the top of the alert details flyout, 65%] +* Click one of the section titles on the **Overview** tab within the right panel. ++ +[role="screenshot"] +image:images/view-alert-details/-detections-alert-details-flyout-left-panel.png[Left panel of the alert details flyout, 65%] + +[discrete] +[[about-section]] +== About + +The About section is located on the **Overview** tab in the right panel. It provides a brief description of the rule that's related to the alert and an explanation of what generated the alert. + +[role="screenshot"] +image::images/view-alert-details/-detections-about-section-rp.png[About section of the Overview tab, 65%] + +The About section has the following information: + +* **Rule description**: Describes the rule's purpose or detection goals. Click **Show rule summary** to display a preview of the rule's details. From the preview, click **Show rule details** to view the rule's details page. +* **Alert reason**: Describes the source event that generated the alert. Event details are displayed in plain text and ordered logically to provide context for the alert. Click **Show full reason** to display the alert reason in the event rendered format within the <>. ++ +[NOTE] +==== +The event renderer only displays if an event renderer exists for the alert type. Fields are interactive; hover over them to access the available actions. +==== + +[discrete] +[[investigation-section]] +== Investigation + +The Investigation section is located on the **Overview** tab in the right panel. It offers a couple of ways to begin investigating the alert. + +[role="screenshot"] +image::images/view-alert-details/-detections-investigation-section-rp.png[Investigation section of the Overview tab, 65%] + +The Investigation section provides the following information: + +* **Investigation guide**: The **Show investigation guide** button displays if the rule associated with the alert has an investigation guide. Click the button to open the expanded Investigation view in the left panel. ++ +[TIP] +==== +Add an <> to a rule when creating a new custom rule or modifying an existing custom rule's settings. +==== +* **Highlighted fields**: Shows relevant fields for the alert and any <> you added to the rule. Custom highlighted fields with values are added to this section. Those without values aren't added. + +[discrete] +[[visualizations-section]] +== Visualizations + +The Visualizations section is located on the **Overview** tab in the right panel. It offers a glimpse of the processes that led up to the alert and occurred after it. + +[role="screenshot"] +image::images/view-alert-details/-detections-visualizations-section-rp.png[Visualizations section of the Overview tab, 65%] + +Click **Visualizations** to display the following previews: + +* **Session view preview**: Shows a preview of <> data. Click **Session viewer preview** to open the **Session View** tab in Timeline. +* **Analyzer preview**: Shows a preview of the <>. The preview displays up to three levels of the analyzed event's ancestors and up to three levels of the event's descendants and children. The ellipses symbol (**`...`**) indicates the event has more ancestors and descendants to examine. Click **Analyzer preview** to open the **Event Analyzer** tab in Timeline. + +[discrete] +[[expanded-visualizations-view]] +=== Expanded visualizations view + +preview::[] + +.Requirements +[NOTE] +==== +To use the **Visualize** tab, you must turn on the `securitySolution:enableVisualizationsInFlyout` <>. +==== + +The **Visualize** tab allows you to maintain the context of the Alerts table, while providing a more detailed view of alerts that you're investigating in the event analyzer or Session View. To open the tab, click **Session view preview** or **Analyzer preview** from the right panel. + +[role="screenshot"] +image::images/view-alert-details/-detections-visualize-tab-lp.png[Expanded view of visualization details, 80%] + +As you examine the alert's related processes, you can also preview the alerts and events which are associated with those processes. Then, if you want to learn more about a particular alert or event, you can click **Show full alert details** to open the full details flyout. + +[role="screenshot"] +image::images/view-alert-details/-detections-visualize-tab-lp-alert-details.gif[Examine alert details from event analyzer] + +[discrete] +[[insights-section]] +== Insights + +The Insights section is located on the **Overview** tab in the right panel. It offers different perspectives from which you can assess the alert. Click **Insights** to display overviews for <>, <>, <>, and <>. + +[role="screenshot"] +image::images/view-alert-details/-detections-insights-section-rp.png[Insights section of the Overview tab, 65%] + +[discrete] +[[entities-overview]] +=== Entities + +The Entities overview provides high-level details about the user and host that are related to the alert. Host and user risk classifications are also available if you have the Security Analytics Complete <>. + +[role="screenshot"] +image::images/view-alert-details/-detections-entities-overview.png[Overview of the entity details section in the right panel, 60%] + +[discrete] +[[expanded-entities-view]] +==== Expanded entities view + +From the right panel, click **Entities** to open a detailed view of the host and user associated with the alert. The expanded view also includes risk scores and classifications (if you have the Security Analytics Complete <>) and activity on related hosts and users. + +[role="screenshot"] +image::images/view-alert-details/-detections-expanded-entities-view.png[Expanded view of entity details, 70%] + +[discrete] +[[threat-intelligence-overview]] +=== Threat intelligence + +The Threat intelligence overview shows matched indicators, which provide threat intelligence relevant to the alert. + +[role="screenshot"] +image::images/view-alert-details/-detections-threat-intelligence-overview.png[Overview of threat intelligence on the alert, 70%] + +The Threat intelligence overview provides the following information: + +* **Threat match detected**: Only available when examining an alert generated from an <> rule. Shows the number of matched indicators that are present in the alert document. Shows zero if there are no matched indicators or you're examining an alert generated by another type of rule. +* **Fields enriched with threat intelligence**: Shows the number of matched indicators that are present on an alert that _wasn't_ generated from an indicator match rule. If none exist, the total number of matched indicators is zero. + +[discrete] +[[expanded-threat-intel-view]] +==== Expanded threat intelligence view + +From the right panel, click **Threat intelligence** to open the expanded Threat intelligence view within the left panel. + +[NOTE] +==== +The expanded threat intelligence view queries indices specified in the `securitySolution:defaultThreatIndex` advanced setting. Refer to <> to learn more about threat intelligence indices. +==== + +[role="screenshot"] +image::images/view-alert-details/-detections-expanded-threat-intelligence-view.png[Expanded view of threat intelligence on the alert, 80%] + +The expanded Threat intelligence view shows individual indicators within the alert document. You can expand and collapse indicator details by clicking the arrow button at the end of the indicator label. Each indicator is labeled with values from the `matched.field` and `matched.atomic` fields and displays the threat intelligence provider. + +Matched threats are organized into two sections, described below. Within each section, matched threats are shown in reverse chronological order, with the most recent at the top. All mapped fields are displayed for each matched threat. + +**Threat match detected** + +The Threat match detected section is only populated with indicator match details if you're examining an alert that was generated from an indicator match rule. Indicator matches occur when alert field values match with threat intelligence data you've ingested. + +**Fields enriched with threat intelligence** + +Threat intelligence can also be found on alerts that weren't generated from indicator match rules. To find this information, {elastic-sec} queries alert documents from the past 30 days and searches for fields that contain known threat intelligence. If any are found, they're logged in this section. + +[TIP] +==== +Use the date time picker to modify the query time frame, which looks at the past 30 days by default. You can also click the **Inspect** button to examine the query that the Fields enriched with threat intelligence section uses. +==== + +When searching for threat intelligence, {elastic-sec} queries the alert document for the following fields: + +* `file.hash.md5`: The MD5 hash +* `file.hash.sha1`: The SHA1 hash +* `file.hash.sha256`: The SHA256 hash +* `file.pe.imphash`: Imports in a PE file +* `file.elf.telfhash`: Imports in an ELF file +* `file.hash.ssdeep`: The SSDEEP hash +* `source.ip`: The IP address of the source (IPv4 or IPv6) +* `destination.ip`: The event's destination IP address +* `url.full`: The full URL of the event source +* `registry.path`: The full registry path, including the hive, key, and value + +[discrete] +[[correlations-overview]] +=== Correlations + +The Correlations overview shows how an alert is related to other alerts and offers ways to investigate related alerts. Use this information to quickly find patterns between alerts and then take action. + +[role="screenshot"] +image::images/view-alert-details/-detections-correlations-overview.png[Overview of available correlation data, 60%] + +The Correlations overview provides the following information: + +* **Suppressed alerts**: Indicates that the alert was created with alert suppression, and shows how many duplicate alerts were suppressed. This information only appears if alert suppression is enabled for the rule. +* **Alerts related by source event**: Shows the number of alerts that were created by the same source event. +* **Cases related to the alert**: Shows the number of cases to which the alert has been added. +* **Alerts related by session ID**: Shows the number of alerts generated by the same session. +* **Alerts related by process ancestry**: Shows the number of alerts that are related by process events on the same linear branch. + +[discrete] +[[expanded-correlations-view]] +==== Expanded correlations view + +From the right panel, click **Correlations** to open the expanded Correlations view within the left panel. + +[role="screenshot"] +image::images/view-alert-details/-detections-expanded-correlations-view.png[Expanded view of correlation data, 75%] + +In the expanded view, corelation data is organized into several tables: + +* **Suppressed alerts**: preview:[] Shows how many duplicate alerts were suppressed. This information only appears if alert suppression is enabled for the rule. +* **Related cases**: Shows cases to which the alert has been added. Click a case's name to open its details. +* **Alerts related by source event**: Shows alerts created by the same source event. This can help you find alerts with a shared origin and provide more context about the source event. Click the **Investigate in timeline** button to examine related alerts in Timeline. +* **Alerts related by session**: Shows alerts generated during the same <>. These alerts share the same session ID, which is a unique ID for tracking a given Linux session. To use this feature, you must enable the **Collect session data** setting in your {elastic-defend} integration policy. Refer to <> for more information. +* **Alerts related by ancestry**: Shows alerts that are related by process events on the same linear branch. Note that alerts generated from processes on child or related branches are not shown. To further examine alerts, click **Investigate in timeline**. + +[discrete] +[[prevalence-overview]] +=== Prevalence + +The Prevalence overview shows whether data from the alert was frequently observed on other host events from the last 30 days. Prevalence calculations use values from the alert’s highlighted fields. Highlighted field values that are observed on less than 10% of hosts in your environment are considered uncommon (not prevalent) and are listed individually in the Prevalence overview. Highlighted field values that are observed on more than 10% of hosts in your environment are considered common (prevalent) and are described as frequently observed in the Prevalence overview. + +[discrete] +[[expanded-prevalence-view]] +==== Expanded prevalence view + +From the right panel, click **Prevalence** to open the expanded Prevalence view within the left panel. Examine the table to understand the alert's relationship with other alerts, events, users, and hosts. + +[TIP] +==== +Update the date time picker for the table to show data from a different time range. +==== + +[role="screenshot"] +image::images/view-alert-details/-detections-expanded-prevalence-view.png[Expanded view of prevalence data] + +The expanded Prevalence view provides the following details: + +* **Field**: Shows <> for the alert and any custom highlighted fields that were added to the alert's rule. +* **Value**: Shows values for highlighted fields and any custom highlighted fields that were added to the alert's rule. +* **Alert count**: Shows the total number of alert documents that have identical highlighted field values, including the alert you're currently examining. For example, if the `host.name` field has an alert count of 5, that means there are five total alerts with the same `host.name` value. The Alert count column only retrieves documents that contain the {ecs-ref}/ecs-allowed-values-event-kind.html#ecs-event-kind-signal[`event.kind:signal`] field-value pair. +* **Document count**: Shows the total number of event documents that have identical field values. A dash (`——`) displays if there are no event documents that match the field value. The Document count column only retrieves documents that don't contain the {ecs-ref}/ecs-allowed-values-event-kind.html#ecs-event-kind-signal[`event.kind:signal`] field-value pair. +* **Host prevalence**: Shows the percentage of unique hosts that have identical field values. Host prevalence for highlighted fields is calculated by taking the number of unique hosts with identical highlighted field values and dividing that number by the total number of unique hosts in your environment. +* **User prevalence**: Shows the percentage of unique users that have identical highlighted field values. User prevalence for highlighted fields is calculated by taking the number of unique users with identical field values and dividing that number by the total number of unique users in your environment. + +[discrete] +[[response-overview]] +== Response + +The **Response** section is located on the **Overview** tab in the right panel. It shows <> that were added to the rule associated with the alert. Click **Response** to display the response action's results in the left panel. + +[role="screenshot"] +image::images/view-alert-details/-detections-response-action-rp.png[Response section of the Overview tab, 50%] + +[discrete] +[[expanded-notes-view]] +== Notes + +The **Notes** tab (located in the left panel) shows all notes attached to the alert, in addition to the user who created them and when they were created. When you add a new note, the alert's summary also updates and shows how many notes are attached to the alert. + +[TIP] +==== +Go to the **Notes** <> to find notes that were added to other alerts. +==== + +image::images/view-alert-details/-detections-notes-tab-lp.png[Notes tab in the left panel, 70%] diff --git a/docs/serverless/images/view-alert-details/-detections-about-section-rp.png b/docs/serverless/images/view-alert-details/-detections-about-section-rp.png new file mode 100644 index 0000000000..8df877381d Binary files /dev/null and b/docs/serverless/images/view-alert-details/-detections-about-section-rp.png differ