Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
6b842dc
First draft
nastasha-solomon Oct 4, 2022
7cac158
Andrew M.'s input
nastasha-solomon Oct 5, 2022
0a84eba
Hyphen
nastasha-solomon Oct 5, 2022
d169e3b
Update docs/detections/alerts-view-details.asciidoc
nastasha-solomon Oct 5, 2022
110f27d
Merge branch 'main' into issue-2479-alert-event-renderer
nastasha-solomon Oct 5, 2022
a67569a
Merge branch 'main' into issue-2479-alert-event-renderer
nastasha-solomon Oct 6, 2022
1494549
Merge branch 'main' into issue-2479-alert-event-renderer
nastasha-solomon Oct 6, 2022
a23b0fa
Merge branch 'main' into issue-2479-alert-event-renderer
nastasha-solomon Oct 6, 2022
e6f731b
Refresh text and screenshot
nastasha-solomon Oct 6, 2022
3c7a750
Merge branch 'main' into issue-2479-alert-event-renderer
nastasha-solomon Oct 6, 2022
d5cde6d
Merge branch 'main' into issue-2479-alert-event-renderer
nastasha-solomon Oct 11, 2022
decfbe0
Updated screenshots
nastasha-solomon Oct 11, 2022
f254010
Update docs/detections/alerts-ui-manage.asciidoc
nastasha-solomon Oct 11, 2022
0ded8e8
Update docs/detections/alerts-view-details.asciidoc
nastasha-solomon Oct 11, 2022
c89197b
Update docs/detections/alerts-view-details.asciidoc
nastasha-solomon Oct 11, 2022
6a19aaf
Update docs/detections/alerts-view-details.asciidoc
nastasha-solomon Oct 12, 2022
7888f84
Update docs/detections/alerts-view-details.asciidoc
nastasha-solomon Oct 12, 2022
f46d283
Update docs/detections/alerts-view-details.asciidoc
nastasha-solomon Oct 12, 2022
6d2a1bc
Used a shrink ray on ADF
nastasha-solomon Oct 13, 2022
17eaf70
Merge branch 'main' into issue-2479-alert-event-renderer
nastasha-solomon Oct 13, 2022
5b3565e
Merge branch 'main' into issue-2479-alert-event-renderer
nastasha-solomon Oct 18, 2022
41c016e
Merge branch 'main' into issue-2479-alert-event-renderer
nastasha-solomon Oct 18, 2022
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/detections/alerts-ui-manage.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ Use the view options drop-down in the upper-right of the Alerts table to control
[role="screenshot"]
image::images/event-rendered-view.png[Alerts table with the Event rendered view enabled]

TIP: If you're in the grid view, you can still view the event rendering for a specific alert by clicking the link in the *Event Summary* column, if a link is available. Some events do not have event renderings.
TIP: When using grid view, you can view alert-rendered reason statements and event renderings for specific alerts by clicking the expand icon in the *Reason* column. Some events do not have event renderings.

[float]
[[alert-actions]]
Expand Down
8 changes: 6 additions & 2 deletions docs/detections/alerts-view-details.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ The alert details flyout contains these informational tabs:
* *JSON*: The alert data in JSON format.

[role="screenshot"]
image::images/alert-details-flyout.png[Alert details flyout]
image::images/alert-details-flyout.png[Alert details flyout, 90%]

[discrete]
[[alert-details-overview]]
Expand All @@ -26,7 +26,11 @@ The *Overview* tab contains these features:

* *Summary*: Displays general details such as the alert's status, severity, risk score, and a link to the detection rule that produced the alert.

* *Reason statement*: Provides a description of what generated the alert and provides general alert details. You can use this to understand the alert's origin and determine if the alert is relevant to your investigation.
* *Alert-rendered reason statement*: Provides alert details in a logically-arranged format. Shows high-level details, including the alert severity (`kibana.alert.severity`) and the rule that generated the alert (`kibana.alert.rule.name`). Fields are interactive, hover over one to access the available actions.

* *Event renderer*: Displays relevant event details to provide context for the alert, such as file paths or process arguments. Shows alert details in a human-readable format. Fields are interactive; hover over to access the available actions.
+
NOTE: The event renderer only displays if an event renderer exists for the alert type.

* *Highlighted fields*: Surfaces the most relevant fields for the alert type. Use this to inform your triage efforts as you investigate the alert.

Expand Down
Binary file modified docs/detections/images/alert-details-flyout.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified docs/detections/images/event-rendered-view.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified docs/detections/images/insights-section.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.