Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevalence enhancements #4122

Merged
merged 3 commits into from
Nov 2, 2023
Merged

Prevalence enhancements #4122

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0b4e2ad
First draft
nastasha-solomon Oct 31, 2023
e56ff86
Merge branch 'main' into issues-3999-4046-prevalence-updates
nastasha-solomon Nov 2, 2023
17ba31a
Merge branch 'main' into issues-3999-4046-prevalence-updates
nastasha-solomon Nov 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/detections/alerts-view-details.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,6 +276,8 @@ The expanded Prevalence view provides the following details:

* **Document count**: Shows the total number of event documents that have identical field values. A dash (`——`) displays if there are no event documents that match the field value. The Document count column only retrieves documents that don't contain the {ecs-ref}/ecs-allowed-values-event-kind.html#ecs-event-kind-signal[`event.kind:signal`] field-value pair.

The following features require a https://www.elastic.co/pricing[Platinum subscription] or higher:

* **Host prevalence**: Shows the percentage of unique hosts that have identical field values. Host prevalence for highlighted fields is calculated by taking the number of unique hosts with identical highlighted field values and dividing that number by the total number of unique hosts in your environment.

* **User prevalence**: Shows the percentage of unique users that have identical highlighted field values. User prevalence for highlighted fields is calculated by taking the number of unique users with identical field values and dividing that number by the total number of unique users in your environment.
Expand Down
Binary file modified docs/detections/images/expanded-prevalence-view.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.