Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Serverless][8.17][8.16]: Security – Alerts section bugs #6240

Open
wants to merge 9 commits into
base: main
Choose a base branch
from
2 changes: 1 addition & 1 deletion docs/detections/alerts-reduce.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
| <<snooze-rule-actions,Rule action snoozing>>
a| *_Stops a specific rule's notification actions from running_*.

Use to avoid unnecessary notifications from a specific rule. The rule continues to run and generate alerts during the snooze period, but its <<rule-notifications,notification actions>> don't run.
Use to avoid unnecessary notifications from a specific rule. The rule continues to run and generate alerts during the snooze period, but its <<rule-response-action,notification actions>> don't run.

| {kibana-ref}/maintenance-windows.html[Maintenance window]
a| *_Prevents all rules' notification actions from running_*.
Expand Down
4 changes: 2 additions & 2 deletions docs/detections/alerts-ui-manage.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ The Alerts page offers various ways for you to organize and triage detection ale
[role="screenshot"]
image::images/view-alert-details.png[View details button, 200]

* View the rule that created an alert. Click a name in the *Rule* column to open the rule's details page.
* View the rule that created an alert. Click a name in the *Rule* column to open the rule's details.

* View the details of the host and user associated with the alert. In the Alerts table, click a host name to open the <<host-details-flyout, host details flyout>>, or a user name to open the <<user-details-flyout, user details flyout>>.

Expand Down Expand Up @@ -115,7 +115,7 @@ image::images/group-alerts-expand.png[Expanded alert group with alerts table]
Use the toolbar buttons in the upper-left of the Alerts table to customize the columns you want displayed:

* **Columns**: Reorder the columns.
* **_x_ fields sorted**: Sort the table by one or more columns.
* **Sort fields _x_**: Sort the table by one or more columns.
* **Fields**: Select the fields to display in the table. You can also add <<runtime-fields, runtime fields>> to detection alerts and display them in the Alerts table.

Click the *Full screen* button in the upper-right to view the table in full-screen mode.
Expand Down
4 changes: 0 additions & 4 deletions docs/detections/alerts-view-details.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -94,10 +94,6 @@ The About section has the following information:
+
NOTE: The event renderer only displays if an event renderer exists for the alert type. Fields are interactive; hover over them to access the available actions.

* **Last alert status change**: Shows the last time the alert's status was changed, along with the user who changed it.

* **MITRE ATT&CK**: Provides relevant https://attack.mitre.org/[MITRE ATT&CK] framework tactics, techniques, and sub-techniques.

[discrete]
[[investigation-section]]
== Investigation
Expand Down
Binary file modified docs/detections/images/about-section-rp.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
4 changes: 2 additions & 2 deletions docs/serverless/alerts/alerts-ui-manage.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ The Alerts page offers various ways for you to organize and triage detection ale
+
[role="screenshot"]
image:images/alerts-ui-manage/-detections-view-alert-details.png[View details button]
* View the rule that created an alert. Click a name in the **Rule** column to open the rule's details page.
* View the rule that created an alert. Click a name in the **Rule** column to open the rule's details.
* View the details of the host and user associated with the alert. In the Alerts table, click a host name to open the <<security-hosts-overview-host-details-flyout,host details flyout>>, or a user name to open the <<security-users-page-user-details-flyout,user details flyout>>.
* Filter for a specific rule in the KQL bar (for example, `kibana.alert.rule.name :"SSH (Secure Shell) from the Internet"`). KQL autocomplete is available for `.alerts-security.alerts-*` indices.
* Use the date and time filter to define a specific time range. By default, this filter is set to search the last 24 hours.
Expand Down Expand Up @@ -104,7 +104,7 @@ image::images/alerts-ui-manage/-detections-group-alerts-expand.png[Expanded aler
Use the toolbar buttons in the upper-left of the Alerts table to customize the columns you want displayed:

* **Columns**: Reorder the columns.
* **_x_ fields sorted**: Sort the table by one or more columns.
* **Sort fields _x_**: Sort the table by one or more columns.
* **Fields**: Select the fields to display in the table. You can also add <<security-runtime-fields,runtime fields>> to detection alerts and display them in the Alerts table.

Click the **Full screen** button in the upper-right to view the table in full-screen mode.
Expand Down
4 changes: 2 additions & 2 deletions docs/serverless/alerts/reduce-notifications-alerts.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,9 @@
| <<snooze-rule-actions,Rule action snoozing>>
a| **_Stops a specific rule's notification actions from running_**.

Use to avoid unnecessary notifications from a specific rule. The rule continues to run and generate alerts during the snooze period, but its <<security-rules-create,notification actions>> don't run.
Use to avoid unnecessary notifications from a specific rule. The rule continues to run and generate alerts during the snooze period, but its <<rule-response-action,notification actions>> don't run.

| {kibana-ref}/maintenance-windows.html[Maintenance window]
| <<maintenance-windows,Maintenance window>>
a| **_Prevents all rules' notification actions from running_**.

Use to avoid false alarms and unnecessary notifications during planned outages. All rules continue to run and generate alerts during the maintenance window, but their <<security-rules-create,notification actions>> don't run.
Expand Down
2 changes: 0 additions & 2 deletions docs/serverless/alerts/view-alert-details.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -101,8 +101,6 @@ The About section has the following information:
====
The event renderer only displays if an event renderer exists for the alert type. Fields are interactive; hover over them to access the available actions.
====
* **Last Alert Status Change**: Shows the last time the alert's status was changed, along with the user who changed it.
* **MITRE ATT&CK**: Provides relevant https://attack.mitre.org/[MITRE ATT&CK] framework tactics, techniques, and sub-techniques.

[discrete]
[[investigation-section]]
Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.