Technical preview

Visualize and group detection alerts by specific parameters in the visualization section of the Alerts page.

— Click to open this image in fullscreen mode

Use the left buttons to select a view type (Summary, Trend, Counts, or Treemap), and use the right menus to select the ECS fields to use for grouping:

• Top alerts by or Group by: Primary field for grouping alerts.
• Group by top (if available): Secondary field for further subdividing grouped alerts.

For example, you can group first by rule name (Group by: kibana.alert.rule.name), then by host name (Group by top: host.name) to visualize which detection rules generated alerts, and which hosts triggered each of those rules. For groupings with a lot of unique values, the top 1,000 results are displayed.

To reset a view to default settings, hover over it and click the options menu () that appears, then select Reset group by fields.

Click the collapse icon () to minimize the visualization section and display a summary of key information instead.

— Click to open this image in fullscreen mode

Summary

On the Alerts page, the summary visualization displays by default and shows how alerts are distributed across these indicators:

• Severity levels: How many alerts are in each severity level.
• Alerts by name: How many alerts each detection rule created.
• Top alerts by: Percentage of alerts with a specified field value: host.name (default), user.name, source.ip, or destination.ip.

You can hover and click on elements within the summary — such as severity levels, rule names, and host names — to add filters with those values to the Alerts page.

— Click to open this image in fullscreen mode

Trend

The trend view shows the occurrence of alerts over time. By default, it groups alerts by detection rule name (kibana.alert.rule.name).

— Click to open this image in fullscreen mode

Counts

The counts view shows the count of alerts in each group. By default, it groups alerts first by detection rule name (kibana.alert.rule.name), then by host name (host.name).

— Click to open this image in fullscreen mode

Treemap

The treemap view shows the distribution of alerts as nested, proportionally-sized tiles. This view can help you quickly pinpoint the most prevalent and critical alerts.

— Click to open this image in fullscreen mode

Larger tiles represent more frequent alerts, and each tile's color is based on the alerts' risk score:

• Green: Low risk (0 - 46)
• Yellow: Medium risk (47 - 72)
• Orange: High risk (73 - 98)
• Red: Critical risk (99 - 100)

By default, the treemap groups alerts first by detection rule name (kibana.alert.rule.name), then by host name (host.name). This shows which rules generated the most alerts, and which hosts were responsible.

You can click on the treemap to narrow down the alerts displayed in both the treemap and the alerts table below. Click the label above a group to display the alerts in that group, or click an individual tile to display the alerts related to that tile. This adds filters under the KQL search bar, which you can edit or remove to further customize the view.

— Click to open this image in fullscreen mode