Manage detection alerts

The Alerts page displays all detection alerts. From the Alerts page, you can filter alerts, view alerting trends, change the status of alerts, add alerts to cases, and start investigating and analyzing alerts.

The Alerts page offers various ways for you to organize and triage detection alerts as you investigate suspicious events. You can:

By default, the drop-down controls on the Alerts page filter alerts by Status, Severity, User, and Host. You can edit them to filter by different fields, as well as remove, add, and reorder them if you prefer a different order.

You can group alerts by rule name, user name, host name, source IP address, or any other field. Select Group alerts by, then select an option or Custom field to specify a different field.

Select up to three fields for grouping alerts. The groups will nest in the order you selected them, and the nesting order is displayed above the table next to Group alerts by.

Each group displays information such as the alerts' severity and how many users, hosts, and alerts are in the group. The information displayed varies depending on the selected fields.

To interact with grouped alerts:

Use the toolbar buttons in the upper-left of the Alerts table to customize the columns you want displayed:

Click the Full screen button in the upper-right to view the table in full-screen mode.

Use the view options drop-down in the upper-right of the Alerts table to control how alerts are displayed:

From the Alerts table or the alert details flyout, you can:

You can set an alert’s status to indicate whether it needs to be investigated (Open), is under active investigation (Acknowledged), or has been resolved (Closed). By default, the Alerts page displays open alerts. To filter alerts that are Acknowledged or Closed, use the Status drop-down filter at the top of the Alerts page.

To change an alert’s status, do one of the following:

Use alert tags to organize related alerts into categories that you can filter and group. For example, use the False Positive alert tag to label a group of alerts as false positives. Then, search for them by entering the kibana.alert.workflow_tags : "False Positive" query into the KQL bar. Alternatively, use the Alert table’s drop-down filters to filter for tagged alerts.

To apply or remove alert tags on individual alerts, do one of the following:

To apply or remove alert tags on multiple alerts, select the alerts you want to change, then click Selected x alerts at the upper-left above the table. Click Apply alert tags, select or unselect tags, then click Apply tags.

Assign users to alerts that you want them to investigate, and manage alert assignees throughout an alert’s lifecycle.

Show users that have been assigned to alerts by adding the Assignees column to the Alerts table (Fields → kibana.alert.workflow_assignee_ids). Up to four assigned users can appear in the Assignees column. If an alert is assigned to five or more users, a number appears instead.

Assigned users are automatically displayed in the alert details flyout. Up to two assigned users can be shown in the flyout. If an alert is assigned to three or more users, a numbered badge displays instead.

Click the Assignees filter above the Alerts table, then select the users you want to filter by.

You can add exceptions to the rule that generated an alert directly from the Alerts table. Exceptions prevent a rule from generating alerts even when its criteria are met.

To add an exception, click the More actions menu (…​) in the Alerts table, then select Add exception. Alternatively, select Take action → Add rule exception in the alert details flyout.

For information about exceptions and how to use them, refer to Add and manage exceptions.

Suppose the rule that generated the alert uses a Timeline template. In this case, when you investigate the alert in Timeline, the dropzone query values defined in the template are replaced with their corresponding alert values.

Example

This Timeline template uses the host.name: "{host.name}" dropzone filter in the rule. When alerts generated by the rule are investigated in Timeline, the {host.name} value is replaced with the alert’s host.name value. If the alerts’s host.name value is Windows-ArsenalFC, the Timeline dropzone query is host.name: "Windows-ArsenalFC".