IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Explore Network page »
Elastic Docs ›Elastic Security Solution [8.13] ›Explore

Hosts page

edit

Hosts page

edit

The Hosts page provides a comprehensive overview of all hosts and host-related security events. Key performance indicator (KPI) charts, data tables, and interactive widgets let you view specific data, drill down for deeper insights, and interact with Timeline for further investigation.

Hosts page

The Hosts page has the following sections:

Host KPI (key performance indicator) charts

edit

KPI charts show metrics for hosts and unique IPs within the time range specified in the date picker. This data is visualized using linear or bar graphs.

Hover inside a KPI chart to display the actions menu (…​), where you can perform these actions: inspect, open in Lens, and add to a new or existing case.

Data tables

edit

Beneath the KPI charts are data tables, categorized by individual tabs, which are useful for viewing and investigating specific types of data. Select the relevant tab to view the following data:

  • Events: All host events. To display alerts received from external monitoring tools, scroll down to the Events table and select Show only external alerts on the right.
  • All hosts: High-level host details.
  • Uncommon processes: Uncommon processes running on hosts.
  • Anomalies: Anomalies discovered by machine learning jobs.
  • Host risk: The latest recorded host risk score for each host, and its host risk classification. This feature requires a Platinum subscription or higher and must be enabled to display the data. Click Enable on the Host risk tab to get started. To learn more, refer to our host risk score documentation.
  • Sessions: Linux process events that you can open in Session View, an investigation tool that allows you to examine Linux process data at a hierarchal level.

The tables within the Events and Sessions tabs include inline actions and several customization options. To learn more about what you can do with the data in these tables, refer to Manage detection alerts.

Events table

Host details page

edit

A host’s details page displays all relevant information for the selected host. To view a host’s details page, click its Host name link in the All hosts table.

The host details page includes the following sections:

  • Asset Criticality: If the securitySolution:enableAssetCriticality advanced setting is on, this section displays the host’s current asset criticality level.
  • Summary: Details such as the host ID, when the host was first and last seen, the associated IP addresses, and associated operating system. If the host risk score feature is enabled, this section also displays host risk score data.
  • Alert metrics: The total number of alerts by severity, rule, and status (Open, Acknowledged, or Closed).
  • Data tables: The same data tables as on the main Hosts page, except with values for the selected host instead of all hosts.
Host’s details page

Host details flyout

edit

In addition to the host details page, relevant host information is also available in the host details flyout throughout the Elastic Security app. You can access this flyout from the following places:

  • The Alerts page, by clicking on a host name in the Alerts table
  • The Events tab on the Users and user details pages, by clicking on a host name in the Events table
  • The User risk tab on the user details page, by clicking on a host name in the Top risk score contributors table
  • The Events tab on the Hosts and host details pages, by clicking on a host name in the Events table
  • The Host risk tab on the host details page, by clicking on a host name in the Top risk score contributors table

The host details flyout includes the following sections:

Host details flyout

Host risk summary

edit

Requirements

The Host risk summary section is only available if the risk scoring engine is turned on.

The Host risk summary section contains a risk summary visualization and table.

The risk summary visualization shows the host risk score and host risk level. Hover over the visualization to display the Options menu. Use this menu to inspect the visualization’s queries, add it to a new or existing case, save it to your Visualize Library, or open it in Lens for customization.

The risk summary table shows the category, score, and number of risk inputs that determine the host risk score. Hover over the table to display the Inspect button, which allows you to inspect the table’s queries.

To expand the Host risk summary section, click View risk contributions. The left panel displays additional details about the host’s risk inputs.

Host risk inputs

Asset Criticality

edit

Requirements

The Asset Criticality section is only available if the securitySolution:enableAssetCriticality advanced setting is on.

The Asset Criticality section displays the selected host’s asset criticality level. Asset criticality contributes to the overall host risk score. The criticality level defines how impactful the host is when calculating the risk score.

Asset criticality

Click Assign to assign a criticality level to the selected host, or Change to change the currently assigned criticality level.

Observed data

edit

This section displays details such as the host ID, when the host was first and last seen, the associated IP addresses and operating system, and the relevant Endpoint integration policy information.

Host observed data
« Explore Network page »