Skip to content

[8.5] [DOCS] Feature flag enabled by default for feature that displays alerts in the process tree (backport #2538) #2557

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 6, 2022
Merged

[8.5] [DOCS] Feature flag enabled by default for feature that displays alerts in the process tree (backport #2538) #2557

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 2 additions & 5 deletions docs/detections/visual-event-analyzer.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,14 +120,11 @@ image::images/event-details.png[]

NOTE: In {stack} versions 7.10.0 and newer, there is no limit to the number of events that can be associated with a process. However, in {stack} versions 7.9.0 and earlier, each process is limited to only 100 events.

If you have a https://www.elastic.co/pricing[Platinum or Enterprise subscription], you can also examine alerts associated with events.

To examine alerts associated with the event, select the alert pill (*_x_ alert*). The left pane lists the total number of associated alerts, and alerts are ordered from oldest to newest. Each alert shows the type of event that produced it (`event.category`), the event timestamp (`@timestamp`), and rule that generated the alert (`kibana.alert.rule.name`). Click on the rule name to open the alert's details.

In the example screenshot below, five alerts were generated by the analyzed event (`lsass.exe`). The left pane displays the associated alerts and basic information about each one.

preview::[]

NOTE: Displaying alerts in the process tree is a https://www.elastic.co/pricing[Platinum or Enterprise subscription] feature. In addition, to display it in {elastic-sec} you must add the following feature flag to the `kibana.yml` file:
`xpack.securitySolution.enableExperimental: ['insightsRelatedAlertsByProcessAncestry']`

[role="screenshot"]
image::images/alert-pill.png[]