diff --git a/docs/detections/alerts-view-details.asciidoc b/docs/detections/alerts-view-details.asciidoc index 6b0943db75..9c35e8b79f 100644 --- a/docs/detections/alerts-view-details.asciidoc +++ b/docs/detections/alerts-view-details.asciidoc @@ -124,10 +124,32 @@ image::images/visualizations-section-rp.png[Visualizations section of the Overvi Click **Visualizations** to display the following previews: -* **Session view preview**: Shows a preview of <> data. Click **Session viewer preview** to open the **Session View** tab in Timeline. +* **Session viewer preview**: Shows a preview of <> data. Click **Session viewer preview** to open the **Session View** tab in Timeline. * **Analyzer preview**: Shows a preview of the <>. The preview displays up to three levels of the analyzed event's ancestors and up to three levels of the event's descendants and children. The ellipses symbol (**`...`**) indicates the event has more ancestors and descendants to examine. Click **Analyzer preview** to open the **Event Analyzer** tab in Timeline. +[discrete] +[[expanded-visualizations-view]] +=== Expanded visualizations view + +preview::[] + +.Requirements +[sidebar] +-- +To use the **Visualize** tab, you must turn on the `securitySolution:enableVisualizationsInFlyout` <>. +-- + +The **Visualize** tab allows you to maintain the context of the Alerts table, while providing a more detailed view of alerts that you're investigating in the event analyzer or Session View. To open the tab, click **Session viewer preview** or **Analyzer preview** from the right panel. + +[role="screenshot"] +image::images/visualize-tab-lp.png[Expanded view of visualization details, 80%] + +As you examine the alert's related processes, you can also preview the alerts and events which are associated with those processes. Then, if you want to learn more about a particular alert or event, you can click **Show full alert details** to open the full details flyout. + +[role="screenshot"] +image::images/visualize-tab-lp-alert-details.gif[Examine alert details from event analyzer, 80%] + [discrete] [[insights-section]] == Insights diff --git a/docs/detections/images/visualize-tab-lp-alert-details.gif b/docs/detections/images/visualize-tab-lp-alert-details.gif new file mode 100644 index 0000000000..487f87c74a Binary files /dev/null and b/docs/detections/images/visualize-tab-lp-alert-details.gif differ diff --git a/docs/detections/images/visualize-tab-lp.png b/docs/detections/images/visualize-tab-lp.png new file mode 100644 index 0000000000..a65151a658 Binary files /dev/null and b/docs/detections/images/visualize-tab-lp.png differ diff --git a/docs/detections/visual-event-analyzer.asciidoc b/docs/detections/visual-event-analyzer.asciidoc index 4e422292e5..b3ca110815 100644 --- a/docs/detections/visual-event-analyzer.asciidoc +++ b/docs/detections/visual-event-analyzer.asciidoc @@ -29,7 +29,9 @@ Or + ** `agent.type:"winlogbeat" and event.module: "sysmon" and process.entity_id : *` -. Events that can be visually analyzed are denoted by a cubical **Analyze event** icon. Select this option to open the event in the visual analyzer. Alternatively, open the alert details flyout, go to the Visualizations section, then click **Analyzer preview**. This opens the **Analyzer** tab in Timeline. +. Events that can be visually analyzed are denoted by a cubical **Analyze event** icon. Select this option to open the event in the visual analyzer. The event analyzer is accessible from the **Hosts**, **Alerts**, and **Timelines** pages, as well as the alert details flyout. ++ +TIP: Turn on the `securitySolution:enableVisualizationsInFlyout` <> to access the event analyzer from the **Visualize** tab in the alert or event details flyout. + [role="screenshot"] diff --git a/docs/getting-started/advanced-setting.asciidoc b/docs/getting-started/advanced-setting.asciidoc index b1e10980c0..2298fbc483 100644 --- a/docs/getting-started/advanced-setting.asciidoc +++ b/docs/getting-started/advanced-setting.asciidoc @@ -113,6 +113,14 @@ The `securitySolution:enableAssetCriticality` setting determines whether asset c Including data from cold and frozen {ref}/data-tiers.html[data tiers] in <> queries may result in performance degradation. The `securitySolution:excludeColdAndFrozenTiersInAnalyzer` setting allows you to exclude this data from analyzer queries. This setting is turned off by default. +[discrete] +[[visualizations-in-flyout]] +== Access the event analyzer and Session View from the event or alert details flyout + +preview::[] + +The `securitySolution:enableVisualizationsInFlyout` setting allows you to access the event analyzer and Session View in the **Visualize** <> on the alert or event details flyout. This setting is turned off by default. + [discrete] == Change the default search interval and data refresh time