Skip to content
25 changes: 3 additions & 22 deletions docs/detections/alerts-view-details.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -58,18 +58,11 @@ The Insights section provides the following details:

* *Cases related to the alert* - Shows the total number and names of cases to which the alert has been added. Click a case's name to open its details.
* *Alerts related by source event* - Shows the ten most recent alerts created by the same source event. This can help you find alerts with a shared origin and provide more context about the source event. Click the *Investigate in timeline* button to examine related alerts in Timeline.
* *Alerts related by session ID* - Shows the ten most recent alerts generated during the same <<session-view, session>>. These alerts share the same Session ID, which is a unique ID for tracking a given Linux session.
+
beta::[]
+
NOTE: This feature requires a https://www.elastic.co/pricing[Platinum or Enterprise subscription]. In addition, the *Include session data* setting must be enabled on your {elastic-defend} integration policy. Refer to <<enable-session-view, Enable Session View data>> for more information.

If you have a https://www.elastic.co/pricing[Platinum or Enterprise subscription], these details are also included:

* *Alerts related by session ID* - Shows the ten most recent alerts generated during the same <<session-view, session>>. These alerts share the same session ID, which is a unique ID for tracking a given Linux session. To use this feature, you must enable the *Include session data* setting in your {elastic-defend} integration policy. Refer to <<enable-session-view, Enable Session View data>> for more information.
* *Alerts related by process ancestry* - Shows alerts that are related by process events on the same linear branch. Note that alerts generated from processes on child or related branches are not shown. To further examine alerts, click *Investigate in timeline*.
+
beta::[]
+
NOTE: This feature requires a https://www.elastic.co/pricing[Platinum or Enterprise subscription]. In addition, to display it within the Insights section, you must also add the following feature flag to the `kibana.yml` file:
`xpack.securitySolution.enableExperimental: ['insightsRelatedAlertsByProcessAncestry']`

[discrete]
[[enriched-data-overview]]
Expand Down Expand Up @@ -118,15 +111,3 @@ Matched threats are organized into several sections, described below. Within eac
* *Enriched with Threat Intelligence*: This section shows indicator matches that {elastic-sec} found when querying the alert for fields with threat intelligence. You can use the date time picker to modify the query time frame, which looks at the past 30 days by default. Click the **Inspect** button, located on the far right of the threat label, to view more information on the query. If threat matches are not discovered within the selected time frame, the section displays a message that none are available.

NOTE: The event enrichment query uses the indices specified in the `securitySolution:defaultThreatIndex` advanced setting. For more information, refer to <<update-threat-intel-indices, Update default Elastic Security threat intelligence indices>>.

////
[discrete]
=== Table tab

The *Table* tab shows the alert details in table format. Alert details are organized into field value pairs.

[float]
=== JSON tab

The *JSON* tab shows the alert details in JSON format.
////