From f84773dbd94a257291d28b38db7af52a786e72a6 Mon Sep 17 00:00:00 2001 From: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Tue, 23 Aug 2022 12:17:43 -0400 Subject: [PATCH] [DOCS] Changes to Alert details flyout and new Insights section (#2298) Co-authored-by: Joe Peeples Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> (cherry picked from commit 20c0674172ec9313a919402672ee95166d16b4fc) --- docs/detections/alerts-view-details.asciidoc | 45 ++++++++++++++---- .../images/alert-details-flyout.png | Bin 347752 -> 286933 bytes docs/detections/images/insights-section.png | Bin 0 -> 322141 bytes 3 files changed, 35 insertions(+), 10 deletions(-) create mode 100644 docs/detections/images/insights-section.png diff --git a/docs/detections/alerts-view-details.asciidoc b/docs/detections/alerts-view-details.asciidoc index b8707f52d2..e09e870735 100644 --- a/docs/detections/alerts-view-details.asciidoc +++ b/docs/detections/alerts-view-details.asciidoc @@ -22,29 +22,54 @@ image::images/alert-details-flyout.png[Alert details flyout] The *Overview* tab summarizes the alert and shows relevant threat intelligence details. Use this information to understand what generated the alert so you can triage and resolve it. -The Overview tab contains these features: +The *Overview* tab contains these features: -* *Summary*: General details such as the alert's status, severity, risk score, and a link to the detection rule that produced the alert. +* *Summary*: Displays general details such as the alert's status, severity, risk score, and a link to the detection rule that produced the alert. -* *Reason statement*: A description of what generated the alert and provides general alert details. You can use this to understand the alert's origin and determine if the alert is relevant to your investigation. +* *Reason statement*: Provides a description of what generated the alert and provides general alert details. You can use this to understand the alert's origin and determine if the alert is relevant to your investigation. -* *Cases*: The total number and names of cases to which the alert has been added. Click a case's name to open its details. +* *Highlighted fields*: Surfaces the most relevant fields for the alert type. Use this to inform your triage efforts as you investigate the alert. -* *Highlighted fields*: The most relevant fields for the alert type. Use this section to inform your triage efforts as you investigate the alert. -+ -NOTE: The *Session ID* field provides a unique ID for tracking a given Linux session and is stored in the `process.entry_leader.entity_id` field in the alert's document. To collect the session ID and other session data, you must enable the *Include session data* setting on your {endpoint-cloud-sec} integration policy. Refer to <> for more information. - -* *Alert prevalence*: The total number of alerts within the selected timeframe that have identical values. For example, an alert prevalence of 3 for `host.name` means three alerts with the same `host.name` value exist within the timeframe. +* *Alert prevalence*: Shows the total number of alerts within the selected time frame that have identical values. For example, an alert prevalence of 3 for `host.name` means three alerts with the same `host.name` value exist within the time frame. + Alert prevalence data can help you investigate relationships with other alerts and gain context about the events producing alerts. You can also click the alert prevalence count to explore the alerts in Timeline. + IMPORTANT: Before investigating alert prevalence data in Timeline, save any Timelines you're working on to ensure you can access them later. -* *Enriched data*: Available threat indicator matches and threat intelligence data. This section only displays for alerts with intelligence data. Click the info icon to learn more about what data is collected. Refer to <> for more information. +* *Insights*: Shows relationships with associated alerts to help you quickly identify patterns. Refer to <> for more information. + +* *Enriched data*: Displays available threat indicator matches and threat intelligence data. This section only displays when examining alerts with intelligence data. Click the info icon to learn more about what data is collected. Refer to <> for more information. + [role="screenshot"] image::images/enriched-data-info-icon.png[Informational message on enriched data, 600] +[discrete] +[[alert-details-insights]] +==== Insights on alerts + +The Insights section shows you how an alert is related to other alerts and offers ways to investigate related alerts. You can use this information to quickly find patterns between alerts and then take action. + +Within the Insights section, you can click on the title for each insight to expand or collapse it. + +[role="screenshot"] +image::images/insights-section.png[Insights section in Alert details flyout, 600] + +The Insights section provides the following details: + +* *Cases related to the alert* - Shows the total number and names of cases to which the alert has been added. Click a case's name to open its details. +* *Alerts related by source event* - Shows the ten most recent alerts created by the same source event. This can help you find alerts with a shared origin and provide more context about the source event. Click the *Investigate in timeline* button to examine related alerts in Timeline. +* *Alerts related by session ID* - Shows the ten most recent alerts generated during the same <>. These alerts share the same Session ID, which is a unique ID for tracking a given Linux session. ++ +beta::[] ++ +NOTE: This feature requires a https://www.elastic.co/pricing[Platinum or Enterprise subscription]. In addition, the *Include session data* setting must be enabled on your {endpoint-cloud-sec} integration policy. Refer to <> for more information. + +* *Alerts related by process ancestry* - Shows alerts that are related by process events on the same linear branch. Note that alerts generated from processes on child or related branches are not shown. To further examine alerts, click *Investigate in timeline*. ++ +beta::[] ++ +NOTE: This feature requires a https://www.elastic.co/pricing[Platinum or Enterprise subscription]. In addition, to display it within the Insights section, you must also add the following feature flag to the `kibana.yml` file: `xpack.securitySolution.enableExperimental: ['insightsRelatedAlertsByProcessAncestry']`. + [discrete] [[enriched-data-overview]] ==== Enriched data on alerts diff --git a/docs/detections/images/alert-details-flyout.png b/docs/detections/images/alert-details-flyout.png index ed941bd1dc6dfbd3a2f813c08bc929c599da5219..096f0410b6e784b16bdfd9f843973d29d33a5f95 100644 GIT binary patch literal 286933 zcmeFZbySpZ*FOqKh)5Vnmr9p(mq>R@D=kAe3_FQg(Z)T)iXF86ET{B-V_-`7a^~F$rd`dBeNh`;e)bk#DJT6vitAPX! zNBJ$sA$B5Vx$@WW$Vki(<*oLCU@#i_WIdIvISPrqW|lv16Al8>Q z`lwBSwsYG|z?3#A{Fv%}k!G&sd!(HHvk_A{AxQXGs=2r`7u$Pww2nAI$|5wh*av0> zP-iT8N=@Fcs%Dw;;ZEpZ{fy{>gP+BcC=d6iNDKtto~OOKkJhLCo^0Dcl=+v^rJIf~ zf!wE`M{PZrG*4p{s)fR?MsqHfW8=z_`(A%wi&ZCo6lf#1eo1XH9Hm|*2(kKs8Rlhv zWzMGkzFX~?UXNnRD{4lj=d}W0t94B4kmobSf-W8lm?xHV^ zmGp(`&3^E$WASTy#^L<#=}-_JJA_)=Di-T{BFStKg-2Cp5rV~iIq1V4^HO$g2A9Np>S zp&s2ZMg3{?M;pTsptt1x3x9U(9#E1-pc3=pSj0A_RxI1AP;nTdMSam(*`^B+<)&4G611&Eo z`?InJ0TXuUhtTJFpSaaEe{gH#7E|g(6ie5Bn$xJ)FfNq(Va@wUMQUPIExfJyEr(Mggh)_0*S8t-7A`yG`?7EK-!k{ao1ecXe@4RP$<>-n z_>wI#sJ6$)tgEtrMtRq4mwcDNPOOf2{^MRJ!J3mGBwcKTgyh58%6fy@0{;Ttg8l-# z5$FB`6MV;ao}IxfT8C!7bZwOWME=mWeDw}A{LuxpNn!Kept$0yka!|fR0%`KA z^h>;wMKPcXux)OM1nOhs-Sr?h;w4Rgp7E3CgGipmKoxV;-Ph70U8G&zLEyU;6a*Ax z6d%YH!t2N~1ju>w$#6)m$sPH{%|%~5=Q`rKmtw~+1Uil_m$n|S*(N^4JEhZ-o_MD9 zVcTJXVB#JRsK%@2d5up^!R8CsAn%|Hs}uecI=lyAWRH~CY}u*x@3WC5J|8Sg+)Jb> zD=oWUrmN4Ve`W~NuPHkz1C?dXMB885yVw`o@6VXolhx_hiP$;Lb$aZ3Ja1-crZ}%` z4Q}o83x+_ohqNn-eilt?9f(9zCKGrQ)DkR4^7hL2KJR7dot|LJ&r_ZkEQ8E>GI|!+ z6||~GWz=SLW#DBPrY|?mG&&g<8|^p58cQ1`HS;&OIoEiuHSf8BS5%#|R@(+zhf!(4 z1;IaZM$9`VzVZyaHbWuU3HOFyb~WsNIJ$Fcu(pvL;{b1C7(k494G^xEvqPKnS+WW0H8s{rhNt%holz!1~zEoQenegpy zU-lhav0K(+e}4BoQ1PAcyV}6DK-R#l56K^HKev?*dcG)45?mMb`s?Gb{6UM>6jhD8 zZpOiuH}b z_;@a;AG<$$ee&Xxhb}S$ARPSA0mF@$arR&n&>PQVBz9La{e%2GVy}MEM`xJA&#Yw{Y}D6 zhKv{LzPa^>(l08dD0y-QCgyR13?159Y`h(%Y&rvozY*)R`mwvQu(A5Kb30oq#b{_q zX^awnmiY0gghVOqpyF7+7AAKZl}#g}+g!d>hXCVNtlJi8z46|j=3C&?n-;Dpds$+X zR8?-?+Kb4bsHFHtv2TC6?Da{xgsr{QdLmpUB5gZOiNAfB+i@_#rT*C1@S`EIVKd8P z*3^1^yZOpJP+sM+gU%}*ltx?`ltShiWw6LO(&IuW?|xtXG*tauRq z3ckMQT_y0^5jh&31v)3&WnF~Zw|n_d2PEGju@wc`5|C3Hnc_{e*y0f6Q8#%DZaKMT zNH6aD7(lk~IlXXR-x&Ln1CNxU1c{6Yn!v+0IOi#t@aZGe*Rp#)GrZQ)b9Hfrems0& z&o0i6&q$@VFJb9Zyz^yb`^-ATI&_3-bTf;}A>j)_=7V(Do3!ckU%ulPA|zJETMeYn zN5^^5O3?X~J!?*+iMV?=a^Pc0c!|oiXgQyWXZzA&39VUJ@<^~+@xy2Muk%R7Ku#?1@-}J4ez^mX{!e!9`Fz<203ht&tzt(WU#^~KF zoog$kAtXs|dVBxVK5W!HOJaZZyai!=j+|b~CRr!hfG|M#P#l2idyehUmX4~1C#+BQ zy*iTka#e+@9fp}+-Tt+PP#;%6pxCC^nCCk~GpQ{G%hcJFwQbf9bU}TD`p7L;6z`OqUZsKdflctqt+(~amN@>*QBNB zBis}YuB`Y0Pg%4T1GHZZIxKP?ObN^9kGsV&Kk<3`meUZMuhW>7PL7848wdk0ade9R z`&t&A3GLQ@eU5>K7W@Vc^S{Ta0`I?nqJh`%d;ax~@d@MKBe3&7-TL?SZL{A)DQ