From 9494ee36634c4bb1a640afc8f0b5d857eb412393 Mon Sep 17 00:00:00 2001 From: Joe Peeples Date: Wed, 13 Dec 2023 12:16:55 -0500 Subject: [PATCH 1/4] First draft for classic docs --- docs/detections/alert-suppression.asciidoc | 25 ++++++++++++------ docs/detections/alerts-reduce.asciidoc | 4 +-- docs/detections/rules-ui-create.asciidoc | 30 +++++++++++++--------- 3 files changed, 37 insertions(+), 22 deletions(-) diff --git a/docs/detections/alert-suppression.asciidoc b/docs/detections/alert-suppression.asciidoc index 079bddd12a..9d23a9b45e 100644 --- a/docs/detections/alert-suppression.asciidoc +++ b/docs/detections/alert-suppression.asciidoc @@ -9,9 +9,12 @@ Alert suppression requires a https://www.elastic.co/pricing[Platinum or higher s preview::[] -- -Alert suppression allows you to reduce the number of repeated or duplicate detection alerts created by a <> detection rule. +Alert suppression allows you to reduce the number of repeated or duplicate detection alerts created by these detection rule types: -Normally, when a rule matches multiple source events, it creates multiple alerts, one for each event. When alert suppression is configured, matching events are grouped by their values in a specified field, and only one alert is created for each group. You can configure alert suppression to create alerts each time the rule runs, or once within a specified time window. You can also specify multiple fields to group events by unique combinations of values. +* <> +* <> + +Normally, when a rule matches multiple source events, it creates multiple alerts, one for each event. When alert suppression is configured, matching events are grouped by their values in a specified field, and only one alert is created for each group. Depending on the rule type, you can configure alert suppression to create alerts each time the rule runs, or once within a specified time window. You can also specify multiple fields to group events by unique combinations of values. The {security-app} displays several indicators in the Alerts table and the alert details flyout when a detection alert is created with alert suppression enabled. You can view the original events associated with suppressed alerts by investigating the alert in Timeline. @@ -19,23 +22,29 @@ NOTE: Alert suppression is not available for Elastic prebuilt rules. However, if === Configure alert suppression -You can configure alert suppression when you create or edit a custom query rule. Refer to <> for detailed instructions. +You can configure alert suppression when you create or edit a supported rule type. Refer to <> or <> for detailed instructions. -. When configuring the rule type (the *Define rule* step for a new rule, or the *Definition* tab for an existing rule), enter one or more field names in *Suppress alerts by*. +. When configuring the rule type (the *Define rule* step for a new rule, or the *Definition* tab for an existing rule), enter 1–3 field names to use for suppressing alerts. The setting where you enter the field names depends on the rule type: ++ +-- +* Custom query rule: *Suppress alerts by* +* Threshold rule: *Group by* +-- + NOTE: If you specify a field with multiple values, an alert grouping is created for each value. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts will be suppressed separately for each matching value of `127.0.0.1`, `127.0.0.2`, and `127.0.0.3`. -. Select how often to create alerts for duplicate events: + +. If available, select how often to create alerts for duplicate events: + -- -* *Per rule execution*: Create an alert each time the rule runs and matches one or more events. -* *Per time period*: Create one alert for all matching events within a specified time window, beginning when the rule first matches an event and creates the alert. +* *Per rule execution*: (Custom query rules only) Create an alert each time the rule runs and matches one or more events. +* *Per time period*: Create one alert for all matching events within a specified time window, beginning when the rule first matches an event and creates the alert. (This is the only option available for threshold rules.) + For example, if a rule runs every 5 minutes but you don't need alerts that frequently, you can set the suppression time period to a longer time, such as 1 hour. If the rule matches an event, it creates an alert at that time, and for the next hour, it'll suppress any subsequent matches. + image::images/alert-suppression-options.png[Alert suppression options,400] -- -. Under *If a suppression field is missing*, choose how to handle events with missing suppression fields (events in which one or more of the *Suppress alerts by* fields don't exist): +. (Custom query rules only) Under *If a suppression field is missing*, choose how to handle events with missing suppression fields (events in which one or more of the *Suppress alerts by* fields don't exist): * *Suppress and group alerts for events with missing fields*: Create one alert for each group of events with missing fields. Missing fields get a `null` value, which is used to group and suppress alerts. * *Do not suppress alerts for events with missing fields*: Create a separate alert for each matching event. This basically falls back to normal alert creation for events with missing suppression fields. diff --git a/docs/detections/alerts-reduce.asciidoc b/docs/detections/alerts-reduce.asciidoc index f168f3e2e8..f3bbe6ac6d 100644 --- a/docs/detections/alerts-reduce.asciidoc +++ b/docs/detections/alerts-reduce.asciidoc @@ -19,9 +19,9 @@ Use to avoid false alarms and unnecessary notifications during planned outages. NOTE: Maintenance windows are a {kib} feature, configured outside of the {security-app} in *Stack Management*. | <> -a| *_Reduces repeated or duplicate alerts created by a custom query rule_*. +a| *_Reduces repeated or duplicate alerts_*. -Use to reduce the number of alerts created by a <> that matches multiple source events. Matching events are grouped by their values in a specified field, and only one alert is created for each group. +Use to reduce the number of alerts created by a rule that matches multiple source events. Matching events are grouped by their values in a specified field, and only one alert is created for each group. | <> a| *_Prevents a rule from creating alerts under specific conditions_*. diff --git a/docs/detections/rules-ui-create.asciidoc b/docs/detections/rules-ui-create.asciidoc index 707aa3c3b6..dcb9649f03 100644 --- a/docs/detections/rules-ui-create.asciidoc +++ b/docs/detections/rules-ui-create.asciidoc @@ -81,22 +81,18 @@ When you use a saved query, the *Load saved query "_query name_" dynamically on * Deselect this to load the saved query as a one-time way of populating the rule's *Custom query* field and filters. This copies the settings from the saved query to the rule, so you can then further adjust the rule's query and filters as needed. If the saved query is later changed, the rule will not inherit those changes. -. preview:[] (Optional, https://www.elastic.co/pricing[Platinum or higher subscription] required) Use *Suppress alerts by* to reduce the number of repeated or duplicate alerts created by the rule. +. preview:[] (Optional, https://www.elastic.co/pricing[Platinum or higher subscription] required) Use *Suppress alerts by* to reduce the number of repeated or duplicate alerts created by the rule. Refer to <> for more information. -.. Enter a field name to group matching source events by the field's unique values; only one alert will be created for each group of events. You can also enter multiple fields to group events by unique combinations of values. +.. Enter a field name to group matching source events by the field's unique values; only one alert will be created for each group of events. You can also enter up to 3 fields to group events by unique combinations of values. + NOTE: If you specify a field with multiple values, an alert grouping is created for each value. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts will be suppressed separately for each matching value of `127.0.0.1`, `127.0.0.2`, and `127.0.0.3`. .. Select how often to create alerts for duplicate events: -+ --- + * *Per rule execution*: Create an alert each time the rule runs and matches duplicate events. * *Per time period*: Create one alert for all matching events within a specified time window, beginning when the rule first matches an event and creates the alert. + For example, if a rule runs every 5 minutes but you don't need alerts that frequently, you can set the suppression time period to a longer time, such as 1 hour. If the rule matches an event, it creates an alert at that time, and for the next hour any subsequent matches will be suppressed. --- -+ -With either option, you can view all events associated with suppressed alerts by investigating the alert in Timeline. Refer to <> for more information. . Click **Continue** to <>. @@ -111,14 +107,24 @@ alerts. + NOTE: You can use {kib} saved queries (image:images/saved-query-menu.png[Saved query menu,18,18]) and queries from saved Timelines (*Import query from saved Timeline*) as rule conditions. -.. Use the `Group by` and `Threshold` fields to determine which source event field is used as a threshold and the threshold's value. -.. Use the `Count` field to limit alerts by cardinality of a certain field. +.. Use the *Group by* and *Threshold* fields to determine which source event field is used as a threshold and the threshold's value. +.. Use the *Count* field to limit alerts by cardinality of a certain field. ++ +For example, if *Group by* is `source.ip, destination.ip` and its *Threshold* is `10`, an alert is generated for every pair of source and destination IP addresses that appear in at least 10 of the rule's search results. + -For example, if `Group by` is `source.ip`, `destination.ip` and its `Threshold` is `10`, an alert is generated for every pair of source and destination IP addresses that appear in at least 10 of the rule's search results. +You can also leave the *Group by* field undefined. The rule then creates an alert when the number of search results is equal to or greater than the threshold value. If you set *Count* to limit the results by `process.name` >= 2, an alert will only be generated for source/destination IP pairs that appear with at least 2 unique process names across all events. + -You can also leave the `Group by` field undefined. The rule then creates an alert when the number of search results is equal to or greater than the threshold value. If you set `Count` to limit the results by `process.name` >= 2, an alert will only be generated for source/destination IP pairs that appear with at least 2 unique process names across all events. +IMPORTANT: Alerts created by threshold rules are synthetic alerts that do not resemble the source documents. The alert itself only contains data about the fields that were aggregated over (the *Group by* fields). Other fields are omitted, because they can vary across all source documents that were counted toward the threshold. Additionally, you can reference the actual count of documents that exceeded the threshold from the `kibana.alert.threshold_result.count` field. + +. preview:[] (Optional, https://www.elastic.co/pricing[Platinum or higher subscription] required) Select *Suppress alerts* to reduce the number of repeated or duplicate alerts created by the rule. Refer to <> for more information. + +.. Enter field names in *Group by* to group matching source events by the fields' unique values; only one alert will be created for each group of events. You can enter up to 3 fields to group events by unique combinations of values. ++ +NOTE: If you specify a field with multiple values, an alert grouping is created for each value. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts will be suppressed separately for each matching value of `127.0.0.1`, `127.0.0.2`, and `127.0.0.3`. + +.. In *Per time period*, specify how often to create alerts for duplicate events. This will create one alert for all matching events within the specified time window, beginning when the rule first matches an event and creates the alert. + -IMPORTANT: Alerts created by threshold rules are synthetic alerts that do not resemble the source documents. The alert itself only contains data about the fields that were aggregated over (the `Group by` fields). Other fields are omitted, because they can vary across all source documents that were counted toward the threshold. Additionally, you can reference the actual count of documents that exceeded the threshold from the `kibana.alert.threshold_result.count` field. +For example, if a rule runs every 5 minutes but you don't need alerts that frequently, you can set the suppression time period to a longer time, such as 1 hour. If the rule matches an event, it creates an alert at that time, and for the next hour any subsequent matches will be suppressed. . Click *Continue* to <>. From 4d72150443ad8a08e0bbbdc37dd48bb98cdbbad8 Mon Sep 17 00:00:00 2001 From: Joe Peeples Date: Thu, 14 Dec 2023 14:32:09 -0500 Subject: [PATCH 2/4] Revise language away from "matching" More like "qualifying" or "meets the rule's criteria" --- docs/detections/alert-suppression.asciidoc | 10 +++++----- docs/detections/alerts-reduce.asciidoc | 2 +- docs/detections/rules-ui-create.asciidoc | 18 +++++++++--------- 3 files changed, 15 insertions(+), 15 deletions(-) diff --git a/docs/detections/alert-suppression.asciidoc b/docs/detections/alert-suppression.asciidoc index 9d23a9b45e..380ccdcb14 100644 --- a/docs/detections/alert-suppression.asciidoc +++ b/docs/detections/alert-suppression.asciidoc @@ -14,7 +14,7 @@ Alert suppression allows you to reduce the number of repeated or duplicate detec * <> * <> -Normally, when a rule matches multiple source events, it creates multiple alerts, one for each event. When alert suppression is configured, matching events are grouped by their values in a specified field, and only one alert is created for each group. Depending on the rule type, you can configure alert suppression to create alerts each time the rule runs, or once within a specified time window. You can also specify multiple fields to group events by unique combinations of values. +Normally, when a rule meets its criteria repeatedly, it creates multiple alerts, one for each time the rule's criteria are met. When alert suppression is configured, qualifying events are grouped by their values in a specified field, and only one alert is created for each group. Depending on the rule type, you can configure alert suppression to create alerts each time the rule runs, or once within a specified time window. You can also specify multiple fields to group events by unique combinations of values. The {security-app} displays several indicators in the Alerts table and the alert details flyout when a detection alert is created with alert suppression enabled. You can view the original events associated with suppressed alerts by investigating the alert in Timeline. @@ -31,15 +31,15 @@ You can configure alert suppression when you create or edit a supported rule typ * Threshold rule: *Group by* -- + -NOTE: If you specify a field with multiple values, an alert grouping is created for each value. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts will be suppressed separately for each matching value of `127.0.0.1`, `127.0.0.2`, and `127.0.0.3`. +NOTE: If you specify a field with multiple values, an alert grouping is created for each value. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts will be suppressed separately for each value of `127.0.0.1`, `127.0.0.2`, and `127.0.0.3`. . If available, select how often to create alerts for duplicate events: + -- -* *Per rule execution*: (Custom query rules only) Create an alert each time the rule runs and matches one or more events. -* *Per time period*: Create one alert for all matching events within a specified time window, beginning when the rule first matches an event and creates the alert. (This is the only option available for threshold rules.) +* *Per rule execution*: (Custom query rules only) Create an alert each time the rule runs and meets its criteria. +* *Per time period*: Create one alert for all qualifying events within a specified time window, beginning when the rule first meets its criteria and creates the alert. (This is the only option available for threshold rules.) + -For example, if a rule runs every 5 minutes but you don't need alerts that frequently, you can set the suppression time period to a longer time, such as 1 hour. If the rule matches an event, it creates an alert at that time, and for the next hour, it'll suppress any subsequent matches. +For example, if a rule runs every 5 minutes but you don't need alerts that frequently, you can set the suppression time period to a longer time, such as 1 hour. If the rule meets its criteria, it creates an alert at that time, and for the next hour, it'll suppress any subsequent qualifying events. + image::images/alert-suppression-options.png[Alert suppression options,400] -- diff --git a/docs/detections/alerts-reduce.asciidoc b/docs/detections/alerts-reduce.asciidoc index f3bbe6ac6d..a59a1adba1 100644 --- a/docs/detections/alerts-reduce.asciidoc +++ b/docs/detections/alerts-reduce.asciidoc @@ -21,7 +21,7 @@ NOTE: Maintenance windows are a {kib} feature, configured outside of the {securi | <> a| *_Reduces repeated or duplicate alerts_*. -Use to reduce the number of alerts created by a rule that matches multiple source events. Matching events are grouped by their values in a specified field, and only one alert is created for each group. +Use to reduce the number of alerts created when a rule meets its criteria repeatedly. Matching events are grouped by their values in a specified field, and only one alert is created for each group. | <> a| *_Prevents a rule from creating alerts under specific conditions_*. diff --git a/docs/detections/rules-ui-create.asciidoc b/docs/detections/rules-ui-create.asciidoc index dcb9649f03..47f879c4f4 100644 --- a/docs/detections/rules-ui-create.asciidoc +++ b/docs/detections/rules-ui-create.asciidoc @@ -83,16 +83,16 @@ When you use a saved query, the *Load saved query "_query name_" dynamically on . preview:[] (Optional, https://www.elastic.co/pricing[Platinum or higher subscription] required) Use *Suppress alerts by* to reduce the number of repeated or duplicate alerts created by the rule. Refer to <> for more information. -.. Enter a field name to group matching source events by the field's unique values; only one alert will be created for each group of events. You can also enter up to 3 fields to group events by unique combinations of values. +.. Enter a field name to group qualifying source events by the field's unique values; only one alert will be created for each group of events. You can also enter up to 3 fields to group events by unique combinations of values. + -NOTE: If you specify a field with multiple values, an alert grouping is created for each value. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts will be suppressed separately for each matching value of `127.0.0.1`, `127.0.0.2`, and `127.0.0.3`. +NOTE: If you specify a field with multiple values, an alert grouping is created for each value. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts will be suppressed separately for each value of `127.0.0.1`, `127.0.0.2`, and `127.0.0.3`. .. Select how often to create alerts for duplicate events: -* *Per rule execution*: Create an alert each time the rule runs and matches duplicate events. -* *Per time period*: Create one alert for all matching events within a specified time window, beginning when the rule first matches an event and creates the alert. +* *Per rule execution*: Create an alert each time the rule runs and meets its criteria. +* *Per time period*: Create one alert for all qualifying events within a specified time window, beginning when the rule first meets its criteria and creates the alert. + -For example, if a rule runs every 5 minutes but you don't need alerts that frequently, you can set the suppression time period to a longer time, such as 1 hour. If the rule matches an event, it creates an alert at that time, and for the next hour any subsequent matches will be suppressed. +For example, if a rule runs every 5 minutes but you don't need alerts that frequently, you can set the suppression time period to a longer time, such as 1 hour. If the rule meets its criteria, it creates an alert at that time, and for the next hour, it'll suppress any subsequent qualifying events. . Click **Continue** to <>. @@ -118,13 +118,13 @@ IMPORTANT: Alerts created by threshold rules are synthetic alerts that do not re . preview:[] (Optional, https://www.elastic.co/pricing[Platinum or higher subscription] required) Select *Suppress alerts* to reduce the number of repeated or duplicate alerts created by the rule. Refer to <> for more information. -.. Enter field names in *Group by* to group matching source events by the fields' unique values; only one alert will be created for each group of events. You can enter up to 3 fields to group events by unique combinations of values. +.. Enter field names in *Group by* to group qualifying source events by the fields' unique values; only one alert will be created for each group of events. You can enter up to 3 fields to group events by unique combinations of values. + -NOTE: If you specify a field with multiple values, an alert grouping is created for each value. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts will be suppressed separately for each matching value of `127.0.0.1`, `127.0.0.2`, and `127.0.0.3`. +NOTE: If you specify a field with multiple values, an alert grouping is created for each value. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts will be suppressed separately for each value of `127.0.0.1`, `127.0.0.2`, and `127.0.0.3`. -.. In *Per time period*, specify how often to create alerts for duplicate events. This will create one alert for all matching events within the specified time window, beginning when the rule first matches an event and creates the alert. +.. In *Per time period*, specify how often to create alerts for duplicate events. This will create one alert for all qualifying events within the specified time window, beginning when the rule first meets its criteria and creates the alert. + -For example, if a rule runs every 5 minutes but you don't need alerts that frequently, you can set the suppression time period to a longer time, such as 1 hour. If the rule matches an event, it creates an alert at that time, and for the next hour any subsequent matches will be suppressed. +For example, if a rule runs every 5 minutes but you don't need alerts that frequently, you can set the suppression time period to a longer time, such as 1 hour. If the rule meets its criteria, it creates an alert at that time, and for the next hour, it'll suppress any subsequent qualifying events. . Click *Continue* to <>. From 7726b3b14c20ad7475db5da23269e2ee237b3307 Mon Sep 17 00:00:00 2001 From: Joe Peeples Date: Mon, 18 Dec 2023 18:07:19 -0500 Subject: [PATCH 3/4] Add option of empty "Group by" --- docs/detections/alert-suppression.asciidoc | 8 ++++---- docs/detections/alerts-reduce.asciidoc | 2 +- docs/detections/rules-ui-create.asciidoc | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/detections/alert-suppression.asciidoc b/docs/detections/alert-suppression.asciidoc index 380ccdcb14..f233a8d63f 100644 --- a/docs/detections/alert-suppression.asciidoc +++ b/docs/detections/alert-suppression.asciidoc @@ -14,7 +14,7 @@ Alert suppression allows you to reduce the number of repeated or duplicate detec * <> * <> -Normally, when a rule meets its criteria repeatedly, it creates multiple alerts, one for each time the rule's criteria are met. When alert suppression is configured, qualifying events are grouped by their values in a specified field, and only one alert is created for each group. Depending on the rule type, you can configure alert suppression to create alerts each time the rule runs, or once within a specified time window. You can also specify multiple fields to group events by unique combinations of values. +Normally, when a rule meets its criteria repeatedly, it creates multiple alerts, one for each time the rule's criteria are met. When alert suppression is configured, duplicate qualifying events are grouped, and only one alert is created for each group. Depending on the rule type, you can configure alert suppression to create alerts each time the rule runs, or once within a specified time window. You can also specify multiple fields to group events by unique combinations of values. The {security-app} displays several indicators in the Alerts table and the alert details flyout when a detection alert is created with alert suppression enabled. You can view the original events associated with suppressed alerts by investigating the alert in Timeline. @@ -24,11 +24,11 @@ NOTE: Alert suppression is not available for Elastic prebuilt rules. However, if You can configure alert suppression when you create or edit a supported rule type. Refer to <> or <> for detailed instructions. -. When configuring the rule type (the *Define rule* step for a new rule, or the *Definition* tab for an existing rule), enter 1–3 field names to use for suppressing alerts. The setting where you enter the field names depends on the rule type: +. When configuring the rule type (the *Define rule* step for a new rule, or the *Definition* tab for an existing rule), configure how you want to group events for alert suppression: + -- -* Custom query rule: *Suppress alerts by* -* Threshold rule: *Group by* +* Custom query rule: In *Suppress alerts by*, enter 1-3 field names to group events by the fields' values. +* Threshold rule: In *Group by*, enter up to 3 field names to group events by the fields' values, or leave the setting empty to group all qualifying events together. -- + NOTE: If you specify a field with multiple values, an alert grouping is created for each value. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts will be suppressed separately for each value of `127.0.0.1`, `127.0.0.2`, and `127.0.0.3`. diff --git a/docs/detections/alerts-reduce.asciidoc b/docs/detections/alerts-reduce.asciidoc index a59a1adba1..9cc9ec56ce 100644 --- a/docs/detections/alerts-reduce.asciidoc +++ b/docs/detections/alerts-reduce.asciidoc @@ -21,7 +21,7 @@ NOTE: Maintenance windows are a {kib} feature, configured outside of the {securi | <> a| *_Reduces repeated or duplicate alerts_*. -Use to reduce the number of alerts created when a rule meets its criteria repeatedly. Matching events are grouped by their values in a specified field, and only one alert is created for each group. +Use to reduce the number of alerts created when a rule meets its criteria repeatedly. Duplicate qualifying events are grouped, and only one alert is created for each group. | <> a| *_Prevents a rule from creating alerts under specific conditions_*. diff --git a/docs/detections/rules-ui-create.asciidoc b/docs/detections/rules-ui-create.asciidoc index 47f879c4f4..3d2e429274 100644 --- a/docs/detections/rules-ui-create.asciidoc +++ b/docs/detections/rules-ui-create.asciidoc @@ -118,7 +118,7 @@ IMPORTANT: Alerts created by threshold rules are synthetic alerts that do not re . preview:[] (Optional, https://www.elastic.co/pricing[Platinum or higher subscription] required) Select *Suppress alerts* to reduce the number of repeated or duplicate alerts created by the rule. Refer to <> for more information. -.. Enter field names in *Group by* to group qualifying source events by the fields' unique values; only one alert will be created for each group of events. You can enter up to 3 fields to group events by unique combinations of values. +.. Enter field names in *Group by* to group qualifying source events by the fields' unique values; only one alert will be created for each group of events. You can enter up to 3 fields to group events by unique combinations of values. You can also leave *Group by* empty to group all qualifying events together. + NOTE: If you specify a field with multiple values, an alert grouping is created for each value. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts will be suppressed separately for each value of `127.0.0.1`, `127.0.0.2`, and `127.0.0.3`. From 9be5bb640c3444b97c037f6b53841fdd7d3718ba Mon Sep 17 00:00:00 2001 From: Joe Peeples Date: Mon, 18 Dec 2023 18:20:33 -0500 Subject: [PATCH 4/4] Edit word choice --- docs/detections/alert-suppression.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/detections/alert-suppression.asciidoc b/docs/detections/alert-suppression.asciidoc index f233a8d63f..12bd54892c 100644 --- a/docs/detections/alert-suppression.asciidoc +++ b/docs/detections/alert-suppression.asciidoc @@ -24,7 +24,7 @@ NOTE: Alert suppression is not available for Elastic prebuilt rules. However, if You can configure alert suppression when you create or edit a supported rule type. Refer to <> or <> for detailed instructions. -. When configuring the rule type (the *Define rule* step for a new rule, or the *Definition* tab for an existing rule), configure how you want to group events for alert suppression: +. When configuring the rule type (the *Define rule* step for a new rule, or the *Definition* tab for an existing rule), specify how you want to group events for alert suppression: + -- * Custom query rule: In *Suppress alerts by*, enter 1-3 field names to group events by the fields' values.