Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/detections/alerts-ui-manage.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ Use the view options drop-down in the upper-right of the Alerts table to control
[role="screenshot"]
image::images/event-rendered-view.png[Alerts table with the Event rendered view enabled]

TIP: If you're in the grid view, you can still view the event rendering for a specific alert by clicking the link in the *Event Summary* column, if a link is available. Some events do not have event renderings.
TIP: When using grid view, you can view alert-rendered reason statements and event renderings for specific alerts by clicking the expand icon in the *Reason* column. Some events do not have event renderings.

[float]
[[alert-actions]]
Expand Down
8 changes: 6 additions & 2 deletions docs/detections/alerts-view-details.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ The alert details flyout contains these informational tabs:
* *JSON*: The alert data in JSON format.

[role="screenshot"]
image::images/alert-details-flyout.png[Alert details flyout]
image::images/alert-details-flyout.png[Alert details flyout, 90%]

[discrete]
[[alert-details-overview]]
Expand All @@ -26,7 +26,11 @@ The *Overview* tab contains these features:

* *Summary*: Displays general details such as the alert's status, severity, risk score, and a link to the detection rule that produced the alert.

* *Reason statement*: Provides a description of what generated the alert and provides general alert details. You can use this to understand the alert's origin and determine if the alert is relevant to your investigation.
* *Alert-rendered reason statement*: Provides alert details in a logically-arranged format. Shows high-level details, including the alert severity (`kibana.alert.severity`) and the rule that generated the alert (`kibana.alert.rule.name`). Fields are interactive, hover over one to access the available actions.

* *Event renderer*: Displays relevant event details to provide context for the alert, such as file paths or process arguments. Shows alert details in a human-readable format. Fields are interactive; hover over to access the available actions.
+
NOTE: The event renderer only displays if an event renderer exists for the alert type.

* *Highlighted fields*: Surfaces the most relevant fields for the alert type. Use this to inform your triage efforts as you investigate the alert.

Expand Down
Binary file modified docs/detections/images/alert-details-flyout.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified docs/detections/images/event-rendered-view.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified docs/detections/images/insights-section.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.