- Elastic Cloud Serverless
- Elasticsearch
- Get started
- Connect to your endpoint
- Client libraries
- Get started with the Elasticsearch Go client
- Get started with the Java client
- Get started with the serverless .NET client
- Get started with the serverless Node.js client
- Get started with the serverless PHP client
- Get started with the Elasticsearch Python client
- Get started with the serverless Ruby client
- REST APIs
- Developer tools
- Ingest your data
- Search your data
- Explore your data
- Playground
- Serverless differences
- Elasticsearch billing dimensions
- Elastic Observability
- Get started
- Observability overview
- Elastic Observability Serverless billing dimensions
- Create an Observability project
- Quickstart: Monitor hosts with Elastic Agent
- Quickstart: Monitor your Kubernetes cluster with Elastic Agent
- Quickstart: Unified Kubernetes Observability with Elastic Distributions of OpenTelemetry (EDOT)
- Quickstart: Collect data with AWS Firehose
- Get started with dashboards
- Applications and services
- Application performance monitoring (APM)
- Get started with traces and APM
- Learn about data types
- Collect application data
- View and analyze data
- Act on data
- Use APM securely
- Reduce storage
- Managed intake service event API
- Troubleshooting
- Synthetic monitoring
- Get started
- Scripting browser monitors
- Configure lightweight monitors
- Manage monitors
- Work with params and secrets
- Analyze monitor data
- Monitor resources on private networks
- Use the CLI
- Configure a Synthetics project
- Multifactor Authentication for browser monitors
- Configure Synthetics settings
- Grant users access to secured resources
- Manage data retention
- Scale and architect a deployment
- Synthetics Encryption and Security
- Troubleshooting
- Application performance monitoring (APM)
- Infrastructure and hosts
- Logs
- Inventory
- Incident management
- Data set quality
- Observability AI Assistant
- Machine learning
- Reference
- Limitations
- Get started
- Elastic Security
- Elastic Security overview
- Security billing dimensions
- Create a Security project
- Elastic Security requirements
- Elastic Security UI
- AI for Security
- Ingest data
- Configure endpoint protection with Elastic Defend
- Manage Elastic Defend
- Endpoint response actions
- Cloud Security
- Explore your data
- Dashboards
- Detection engine overview
- Rules
- Alerts
- Advanced Entity Analytics
- Investigation tools
- Asset management
- Manage settings
- Troubleshooting
- Manage your project
- Changelog
Elastic Security UI
editElastic Security UI
editThe Elastic Security app is a highly interactive workspace designed for security analysts that provides a clear overview of events and alerts from your environment. You can use the interactive UI to drill down into areas of interest.
Search
editFilter for alerts, events, processes, and other important security data by entering Kibana Query Language (KQL) queries in the search bar, which appears at the top of each page throughout the app. A date/time filter set to Today
is enabled by default, but can be changed to any time range.
-
To refine your search results, select Add Filter (), then enter the field, operator (such as
is not
oris between
), and value for your filter. - To save the current KQL query and any applied filters, select Saved query menu (), enter a name for the saved query, and select Save saved query.
Navigation menu
editThe navigation menu contains direct links and expandable groups, identified by the group icon ().
- Click a top-level link to go directly to its landing page, which contains links and information for related pages.
- Click a group’s icon () to open its flyout menu, which displays links to related pages within that group. Click a link in the flyout to navigate to its landing page.
- Click the Collapse side navigation icon () to collapse and expand the main navigation menu.
Visualization actions
editMany Elastic Security histograms, graphs, and tables display an Inspect button () when you hover over them. Click to examine the Elasticsearch queries used to retrieve data throughout the app.
Other visualizations display an options menu (), which allows you to inspect the visualization’s queries, add it to a new or existing case, or open it in Lens for customization.
Inline actions for fields and values
editThroughout the Elastic Security app, you can hover over many data fields and values to display inline actions, which allow you to customize your view or investigate further based on that field or value.
In some visualizations, these actions are available in the legend by clicking a value’s options icon ().
Inline actions include the following (some actions are unavailable in some contexts):
- Filter In: Add a filter that includes the selected value.
- Filter Out: Add a filter that excludes the selected value.
- Add to timeline: Add a filter to Timeline for the selected value.
- Toggle column in table: Add or remove the selected field as a column in the alerts or events table. (This action is only available on an alert’s or event’s details flyout.)
- Show top x: Display a pop-up window that shows the selected field’s top events or detection alerts.
- Copy to Clipboard: Copy the selected field-value pair to paste elsewhere.
Elastic Security app pages
editThe Elastic Security app contains the following pages that enable analysts to view, analyze, and manage security data.
Discover
editUse the Discover UI to filter your data or learn about its structure.
Dashboards
editExpand this section to access the Overview, Detection & Response, Kubernetes, Cloud Security Posture, Cloud Native Vulnerability Management, and Entity Analytics dashboards, which provide interactive visualizations that summarize your data. You can also create and view custom dashboards. Refer to Dashboards for more information.
Rules
editExpand this section to access the following pages:
-
Rules: Create and manage rules to monitor suspicious events.
-
Benchmark Rules: View, enable, or disable benchmark rules.
-
Shared Exception Lists: View and manage rule exceptions and shared exception lists.
-
MITRE ATT&CK® coverage: Review your coverage of MITRE ATT&CK® tactics and techniques, based on installed rules.
Alerts
editView and manage alerts to monitor activity within your network. Refer to Alerts for more information.
Findings
editIdentify misconfigurations and vulnerabilities in your cloud infrastructure. For setup instructions, refer to Cloud security posture management, Kubernetes security posture management, or Cloud native vulnerability management.
Cases
editOpen and track security issues. Refer to Cases to learn more.
Investigations
editExpand this section to access the following pages:
-
Timelines: Investigate alerts and complex threats — such as lateral movement — in your network. Timelines are interactive and allow you to share your findings with other team members.
Click the Timeline button at the bottom of the Elastic Security app to start an investigation.
- Osquery: Deploy Osquery with Elastic Agent, then run and schedule queries.
Intelligence
editThe Intelligence section contains the Indicators page, which collects data from enabled threat intelligence feeds and provides a centralized view of indicators of compromise (IoCs). Refer to Indicators of compromise to learn more.
Explore
editExpand this section to access the following pages:
-
Hosts: Examine key metrics for host-related security events using graphs, charts, and interactive data tables.
-
Network: Explore the interactive map to discover key network activity metrics and investigate network events further in Timeline.
-
Users: Access a comprehensive overview of user data to help you understand authentication and user behavior within your environment.
Assets
editThe Assets section allows you to manage the following features:
- Fleet
- Integrations
-
- Endpoints: View and manage hosts running Elastic Defend.
- Policies: View and manage Elastic Defend integration policies.
- Trusted applications: View and manage trusted Windows, macOS, and Linux applications.
- Event filters: View and manage event filters, which allow you to filter endpoint events you don’t need to want stored in Elasticsearch.
- Host isolation exceptions: View and manage host isolation exceptions, which specify IP addresses that can communicate with your hosts even when those hosts are blocked from your network.
- Blocklist: View and manage the blocklist, which allows you to prevent specified applications from running on hosts, extending the list of processes that Elastic Defend considers malicious.
- Response actions history: Find the history of response actions performed on hosts.
- Cloud security
Machine learning
editManage machine learning jobs and settings. Refer to Machine learning docs for more information.
Get started
editQuickly add security integrations that can ingest data and monitor your hosts.
Project settings
editConfigure project-wide settings related to users, billing, data management, and more.
Dev tools
editUse additional API and analysis tools to interact with your data.
Accessibility features
editAccessibility features, such as keyboard focus and screen reader support, are built into the Elastic Security UI. These features offer additional ways to navigate the UI and interact with the application.
Interact with draggable elements
editUse your keyboard to interact with draggable elements in the Elastic Security UI:
-
Press the
Tab
key to apply keyboard focus to an element within a table. Or, use your mouse to click on an element and apply keyboard focus to it.
-
Press
Enter
on an element with keyboard focus to display its menu and pressTab
to apply focus sequentially to menu options. Thef
,o
,a
,t
,c
hotkeys are automatically enabled during this process and offer an alternative way to interact with menu options.
- Press the spacebar once to begin dragging an element to a different location and press it a second time to drop it. Use the directional arrows to move the element around the UI.
-
If an event has an event renderer, press the
Shift
key and the down directional arrow to apply keyboard focus to the event renderer andTab
orShift
+Tab
to navigate between fields. To return to the cells in the current row, press the up directional arrow. To move to the next row, press the down directional arrow.
Navigate the Elastic Security UI
editUse your keyboard to navigate through rows, columns, and menu options in the Elastic Security UI:
- Use the directional arrows to move keyboard focus right, left, up, and down in a table.
-
Press the
Tab
key to navigate through a table cell with multiple elements, such as buttons, field names, and menus. Pressing theTab
key will sequentially apply keyboard focus to each element in the table cell.
-
Use
CTRL + Home
to shift keyboard focus to the first cell in a row. Likewise, useCTRL + End
to move keyboard focus to the last cell in the row.
-
Use the
Page Up
andPage Down
keys to scroll through the page.
On this page
- Search
- Navigation menu
- Visualization actions
- Inline actions for fields and values
- Elastic Security app pages
- Discover
- Dashboards
- Rules
- Alerts
- Findings
- Cases
- Investigations
- Intelligence
- Explore
- Assets
- Machine learning
- Get started
- Project settings
- Dev tools
- Accessibility features
- Interact with draggable elements
- Navigate the Elastic Security UI