Manage detection alerts

The Alerts page displays all detection alerts. From the Alerts table, you can filter alerts, change an alert’s status, and start investigating and analyzing alerts in Timeline.

The Alerts page offers various ways for you to organize and triage detection alerts as you investigate suspicious events. You can:

Use the toolbar buttons in the upper-left of the Alerts table to customize the columns you want displayed:

Click the Full screen button in the upper-right to view the table in full-screen mode.

Use the view options drop-down in the upper-right of the Alerts table to control how alerts are displayed:

To further inspect a detection alert, click the View details button from the Alerts table. The Alert details flyout appears with several options to view alert data.

The Alert details flyout contains the following informational tabs:

Overview

The Overview tab provides an overview of the alert and shows relevant threat intelligence details. Use this information to understand what generated the alert so you can appropriately triage and resolve it.

The Overview tab has three main sections: the alert summary, Highlighted Fields, and Enriched data. The alert summary and Highlighted Fields sections are standard for every alert. The Enriched data section only displays for alerts with intelligence data.

The alert summary section provides general alert details such as the alert’s status, the severity of the alert, the alert’s calculated risk score, and a link to the rule that produced the alert. These details are provided for all alerts regardless of the alert type.

The alert’s reason statement is under the alert summary. The reason statement describes what generated the alert and provides general alert details. You can use this information to understand the alert’s origin and determine if the alert is relevant to your investigation.

The alert details flyout also lists the number and names of cases to which the alert has been added. Click a case’s names to open its details.

The Highlighted Fields section displays the most relevant fields for the alert type. Use this section to inform your triage efforts as you investigate the alert.

The Alert prevalence column shows the total number of alerts within the selected timeframe that have identical values. For example, an alert with an alert prevalence of 3 for the host.name field means three alerts with the same host.name value exist within the given timeframe. Alert prevalence data can help you investigate relationships with other alerts and gain more context about the event producing the alert.

The Enriched data section displays available threat indicator matches and threat intelligence data. Click the info icon to learn more about what data is collected.

When gathering threat intelligence data for an alert, Elastic Security queries the alert for indicator matches from the past 30 days. The query looks for the following fields:

If these fields aren’t available, Elastic Security does not perform the query and does not display threat intelligence data for the alert.

Discovered threat indicator match data is placed under the Threat Match Detected sub-section.

All other available threat intelligence data is placed under the Enriched with Threat Intelligence sub-section.

Additional threat intelligence data is generated for indicator match alerts when indicators are matched with source events, as outlined by the conditions in the relevant indicator match rule. Indicator match alerts always populate the Threat Matched Detected section under the Threat Intel tab with additional threat match data.

Threat Intel

The Threat Intel tab shows the number of individual threats matching the alert. You can expand and collapse threat details by clicking the arrow button at the end of the threat label. Each threat is labelled with values from the matched.field and matched.atomic fields and displays the threat intelligence provider. If the alert does not contain threat intelligence data, the Threat Intel tab displays a message that none is available.

Matched threats are organized into several sections, described below. Within each section, matched threats are shown in reverse chronological order, with the most recent at the top. All mapped fields are displayed for each matched threat.

Table

The Table tab shows the alert details in table format. Alert details are organized into field value pairs.

JSON

The JSON tab shows the alert details in JSON format.

From the Alerts table or the Alert details flyout, you can do the following:

You can set an alert’s status to indicate whether it needs to be investigated (Open), is under active investigation (Acknowledged), or has been resolved (Closed). By default, the Alerts page displays open alerts. To filter alerts that are Acknowledged or Closed, select the appropriate status in the upper-left corner of the Alerts page. This filters all of the results displayed on the page (the Trend histogram, and the Counts table, and the Alerts table).

To change an alert’s status, do one of the following:

From the Alerts table, you can attach one or more alerts to a case by clicking the More actions menu. You can choose to add the alert to a new case or attach it to an existing one. You can also add an alert to a case from the Alert details flyout by clicking Take action.

You can add multiple alerts from any rule type. If you attach the alert to a case that has been configured to sync its status with associated alerts, the alert’s status updates any time the case’s status is modified.

To add an alert to a new case:

To attach an alert to an existing case:

To view an alert in Timeline, click the Investigate in timeline button in the Alerts table. Alternatively, select Take action → Investigate in timeline in the Alert details flyout.

Suppose the rule that generated the alert uses a Timeline template. In this case, when you investigate the alert in Timeline, the dropzone query values defined in the template are replaced with their corresponding alert values.

Example

This Timeline template uses the host.name: "{host.name}" dropzone filter in the rule. When alerts generated by the rule are investigated in Timeline, the {host.name} value is replaced with the alert’s host.name value. If the alerts’s host.name value is Windows-ArsenalFC, the Timeline dropzone query is host.name: "Windows-ArsenalFC".

You can add exceptions to the rule that generated the alert directly from the Alerts table. Exceptions prevent a rule from generating alerts even when its criteria are met.

To add an exception, click the More actions menu (…​) in the Alerts table, then select Add exception. Alternatively, select Take action → Add rule exception in the Alert details flyout.

For information about exceptions and how to use them, refer to Rule exceptions and value lists.

For process events that are detected by Elastic Endpoint, you can open a visual mapping to view a hierarchal timeline of when these events occurred. For more information, refer to Visual event analyzer.