Skip to content

Commit ce700c6

Browse files
[Security] [Serverless: Sep 30] Alert closing reason (#3207)
Resolves #2810 by documenting the ability to specify a reason when closing a detection alert. Preview: [Manage detection alerts > Set an alert's closing reason](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/3207/solutions/security/detect-and-alert/manage-detection-alerts#set-an-alerts-closing-reason)
1 parent ce5b89d commit ce700c6

File tree

2 files changed

+16
-0
lines changed

2 files changed

+16
-0
lines changed
-133 KB
Loading

solutions/security/detect-and-alert/manage-detection-alerts.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,22 @@ To change an alert’s status, do one of the following:
191191
::::
192192
* In an alert’s details flyout, click **Take action** and select a status.
193193

194+
#### Set an alert's closing reason
195+
```yaml {applies_to}
196+
stack: ga 9.2
197+
serverless: ga
198+
```
199+
200+
You can specify a reason for closing an alert by selecting one of the following options:
201+
202+
* **Close without reason**: Close the alert without specifying a reason.
203+
* **Duplicate**: The alert is a duplicate of another alert.
204+
* **False positive**: The alert was triggered by normal activity and doesn't indicate a security issue.
205+
* **True positive**: The alert represents a real security incident that has been resolved.
206+
* **Benign positive**: The alert correctly identified the activity, but the activity is acceptable or not actionable.
207+
* **Other**: Any other reason not covered by the predefined categories.
208+
209+
When you select a closing reason, the alert document is populated with a new field called `kibana.alert.workflow_reason`. You can use this field to filter and sort alerts on the **Alerts** page. If you later reopen the alert, the field is removed from the document.
194210

195211
### Apply and filter alert tags [apply-alert-tags]
196212

0 commit comments

Comments
 (0)