You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/detections/alert-suppression.asciidoc
+4-6Lines changed: 4 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -7,16 +7,14 @@
7
7
* Alert suppression requires a https://www.elastic.co/pricing[Platinum or higher subscription].
8
8
9
9
* {ml-cap} rules have <<ml-requirements,additional requirements>> for alert suppression.
10
-
11
-
preview::["Alert suppression is in technical preview for event correlation rules. The functionality may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features."]
12
10
--
13
11
14
12
Alert suppression allows you to reduce the number of repeated or duplicate detection alerts created by these detection rule types:
@@ -34,7 +32,7 @@ You can configure alert suppression when you create or edit a supported rule typ
34
32
. When configuring the rule type (the *Define rule* step for a new rule, or the *Definition* tab for an existing rule), specify how you want to group events for alert suppression:
35
33
+
36
34
--
37
-
* **Custom query, indicator match, threshold, event correlation (non-sequence queries only), new terms, {ml}, and {esql} rules:** In *Suppress alerts by*, enter 1-3 field names to group events by the fields' values.
35
+
* **Custom query, indicator match, threshold, event correlation, new terms, {ml}, and {esql} rules:** In *Suppress alerts by*, enter 1-3 field names to group events by the fields' values.
38
36
* **Threshold rule:** In *Group by*, enter up to 3 field names to group events by the fields' values, or leave the setting empty to group all qualifying events together.
39
37
40
38
--
@@ -45,7 +43,7 @@ If you specify a field with multiple values, alerts with that field are handled
45
43
46
44
* **Custom query or threshold rules:** A group of alerts is created for each value. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts will be suppressed separately for each value of `127.0.0.1`, `127.0.0.2`, and `127.0.0.3`.
47
45
* **Indicator match, event correlation (non-sequence queries only), new terms, {esql}, or {ml} rules:** Alerts with the specified field name and identical array values are grouped together. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts with the entire array are grouped and only one alert is created for the group.
48
-
46
+
* **Event correlation (sequence queries only) rules:** If the specified field contains an array of values, suppression only happens if the field's values are an exact match and in the same order. For example, if you specify the field `myips` and one sequence alert has [1.1.1.1, 0.0.0.0] and another sequence alert has [1.1.1.1, 192.168.0.1], neither of those alerts will be suppressed, despite sharing an array element.
49
47
======
50
48
51
49
. If available, select how often to create alerts for duplicate events:
@@ -114,5 +112,5 @@ image::images/timeline-button.png[Investigate in timeline button, 200]
114
112
115
113
Some rule types have a maximum number of alerts that can be suppressed (custom query rules don't have a suppression limit):
116
114
117
-
* **Threshold, event correlation (non-sequence queries only), {esql}, and {ml}:** The maximum number of alerts is the value you choose for the rule's **Max alerts per run** <<rule-ui-advanced-params,advanced setting>>, which is `100` by default.
115
+
* **Threshold, event correlation, {esql}, and {ml}:** The maximum number of alerts is the value you choose for the rule's **Max alerts per run** <<rule-ui-advanced-params,advanced setting>>, which is `100` by default.
118
116
* **Indicator match and new terms:** The maximum number is five times the value you choose for the rule's **Max alerts per run** <<rule-ui-advanced-params,advanced setting>>. The default value is `100`, which means the default maximum limit for indicator match rules and new term rules is `500`.
Copy file name to clipboardExpand all lines: docs/detections/rules-ui-create.asciidoc
+1-2Lines changed: 1 addition & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -205,9 +205,8 @@ NOTE: For sequence events, the {security-app} generates a single alert when all
205
205
* *Timestamp field*: Contains the event timestamp used for sorting a sequence of events. This is different from the *Timestamp override* advanced setting, which is used for querying events within a range. Defaults to the `@timestamp` ECS field.
206
206
+
207
207
208
-
. preview:[] (Optional, https://www.elastic.co/pricing[Platinum or higher subscription] required) Use *Suppress alerts by* to reduce the number of repeated or duplicate alerts created by the rule. Refer to <<alert-suppression>> for more information.
208
+
. Optional, https://www.elastic.co/pricing[Platinum or higher subscription] required) Use *Suppress alerts by* to reduce the number of repeated or duplicate alerts created by the rule. Refer to <<alert-suppression>> for more information.
209
209
+
210
-
211
210
////
212
211
The following steps are repeated across multiple rule types. If you change anything
213
212
in these steps or sub-steps, apply the change to the other rule types, too.
@@ -43,7 +43,7 @@ You can configure alert suppression when you create or edit a supported rule typ
43
43
44
44
. When configuring the rule type (the **Define rule** step for a new rule, or the **Definition** tab for an existing rule), specify how you want to group events for alert suppression:
45
45
+
46
-
** **Custom query rule, indicator match, threshold, event correlation (non-sequence queries only), new terms, {esql}, or {ml} rules:** In **Suppress alerts by**, enter 1-3 field names to group events by the fields' values.
46
+
** **Custom query rule, indicator match, threshold, event correlation, new terms, {esql}, or {ml} rules:** In **Suppress alerts by**, enter 1-3 field names to group events by the fields' values.
47
47
** **Threshold rule:** In **Group by**, enter up to 3 field names to group events by the fields' values, or leave the setting empty to group all qualifying events together.
48
48
+
49
49
[NOTE]
@@ -52,6 +52,7 @@ If you specify a field with multiple values, alerts with that field are handled
52
52
53
53
* **Custom query or threshold rules:** Alerts are grouped by each unique value. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts will be suppressed separately for each value of `127.0.0.1`, `127.0.0.2`, and `127.0.0.3`.
54
54
* **Indicator match, event correlation (non-sequence queries only), new terms, {esql}, or {ml} rules:** Alerts with the specified field name and identical array values are grouped together. For example, if you suppress alerts by `destination.ip` of `[127.0.0.1, 127.0.0.2, 127.0.0.3]`, alerts with the entire array are grouped and only one alert is created for the group.
55
+
* **Event correlation (sequence queries only) rules:** If the suppression field is an array of values, the suppressed alert will only suppress values that are an exact match. The values must be equivalent and be in the same position. For example, if you configure suppresson on the field `myips` and one sequence alert has [1.1.1.1, 0.0.0.0] and another sequence alert has [1.1.1.1, 192.168.0.1], neither of those alerts will be suppressed, despite sharing an array element.
55
56
====
56
57
. If available, select how often to create alerts for duplicate events:
57
58
+
@@ -129,5 +130,5 @@ image:images/alert-suppression/-detections-timeline-button.png[Investigate in ti
129
130
130
131
Some rule types have a maximum number of alerts that can be suppressed (custom query rules don't have a suppression limit):
131
132
132
-
* **Threshold, event correlation (non-sequence queries only, {esql}, and {ml}:** The maximum number is the value you choose for the rule's **Max alerts per run** <<rule-ui-advanced-params,advanced setting>>, which is `100` by default.
133
+
* **Threshold, event correlation, {esql}, and {ml}:** The maximum number is the value you choose for the rule's **Max alerts per run** <<rule-ui-advanced-params,advanced setting>>, which is `100` by default.
133
134
* **Indicator match and new terms:** The maximum number is five times the value you choose for the rule's **Max alerts per run** <<rule-ui-advanced-params,advanced setting>>. The default value is `100`, which means the default maximum limit for indicator match rules and new terms rules is `500`.
0 commit comments