diff --git a/docs/detections/alerts-view-details.asciidoc b/docs/detections/alerts-view-details.asciidoc index 34cc6f6041..c739ce4798 100644 --- a/docs/detections/alerts-view-details.asciidoc +++ b/docs/detections/alerts-view-details.asciidoc @@ -276,6 +276,8 @@ The expanded Prevalence view provides the following details: * **Document count**: Shows the total number of event documents that have identical field values. A dash (`——`) displays if there are no event documents that match the field value. The Document count column only retrieves documents that don't contain the {ecs-ref}/ecs-allowed-values-event-kind.html#ecs-event-kind-signal[`event.kind:signal`] field-value pair. +The following features require a https://www.elastic.co/pricing[Platinum subscription] or higher: + * **Host prevalence**: Shows the percentage of unique hosts that have identical field values. Host prevalence for highlighted fields is calculated by taking the number of unique hosts with identical highlighted field values and dividing that number by the total number of unique hosts in your environment. * **User prevalence**: Shows the percentage of unique users that have identical highlighted field values. User prevalence for highlighted fields is calculated by taking the number of unique users with identical field values and dividing that number by the total number of unique users in your environment. diff --git a/docs/detections/images/expanded-prevalence-view.png b/docs/detections/images/expanded-prevalence-view.png index 3b4547da10..48c44f6a18 100644 Binary files a/docs/detections/images/expanded-prevalence-view.png and b/docs/detections/images/expanded-prevalence-view.png differ