Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Nested grouping and beta label removed from grouping #3283

Merged
merged 9 commits into from
May 23, 2023
Merged

Nested grouping and beta label removed from grouping #3283

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
8dbc1ab
Remove beta tag
joepeeples May 16, 2023
137703e
First draft
joepeeples May 16, 2023
6dd21ed
Fix typo, edit
joepeeples May 16, 2023
64a3c55
Small fix
joepeeples May 16, 2023
d5d7897
Merge branch 'main' into 3280-nested-grouping-alerts
joepeeples May 18, 2023
fc467b7
Apply suggestions from code review
joepeeples May 22, 2023
85fb5a9
Apply suggestions from Steph's review
joepeeples May 22, 2023
695d816
Merge branch 'main' into 3280-nested-grouping-alerts
joepeeples May 22, 2023
ddc7c4f
Merge branch 'main' into 3280-nested-grouping-alerts
joepeeples May 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions docs/detections/alerts-ui-manage.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,12 +41,14 @@ image::images/additional-filters.png[Alerts table with Additional filters menu h
[[group-alerts]]
=== Group alerts

beta:[] You can group alerts by rule name, host name, user name, source IP address, or any other field. Select *Group alerts by*, then select an option or *Custom field* to specify a different field.
You can group alerts by rule name, user name, host name, source IP address, or any other field. Select *Group alerts by*, then select an option or *Custom field* to specify a different field.

Select up to three fields to create nested groups of alerts. The groups are nested in the order in which you select them.
joepeeples marked this conversation as resolved.
Show resolved Hide resolved

[role="screenshot"]
image::images/group-alerts.png[Alerts table with Group alerts by drop-down]

Each group displays information such as the alerts' severity and how many users, hosts, and alerts are in the group. The type of information displayed varies depending on the selected field.
Each group displays information such as the alerts' severity and how many users, hosts, and alerts are in the group. The information displayed varies depending on the selected fields.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we maybe describe how the selection order will determine the nesting order, and that the order is displayed in the "Group alerts by" label?

Copy link
Contributor Author

@joepeeples joepeeples May 22, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@stephmilovic We do mention the nesting order in the previous paragraph, above the screenshot, but I've added something about how the order is displayed in the label.


To interact with grouped alerts:

Expand Down
Binary file modified docs/detections/images/group-alerts.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.