# Detection Alerts - Want To Only See that Alert

**URL:** <https://discuss.elastic.co/t/detection-alerts-want-to-only-see-that-alert/259135>\
**Category:** SIEM\
**Tags:** elastic-stack-alerting\
**Created:** [December 18, 2020, 7:01pm UTC](https://discuss.elastic.co/t/detection-alerts-want-to-only-see-that-alert/259135 "2020-12-18T19:01:02Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\
**Post date:** [December 18, 2020, 7:01pm UTC](https://discuss.elastic.co/t/detection-alerts-want-to-only-see-that-alert/259135/1 "2020-12-18T19:01:02Z")

</div>

When clicking on a detection alert it shows the list with a list of other detections during a timeframe is there a way we can make it so it only shows that specific alert and not a list of others.

Like make that timeframe like exactly the time that alert came in?

```
https://<Placeholder>.eastus2.azure.elastic-cloud.com:9243/app/security/detections/rules/id/94ce4952-f99c-4c58-ae1c-e886b5e1c6e1?sourcerer=(default:!())&timerange=(global:(linkTo:!(),timerange:(from:'2020-12-17T18:53:28.150Z',fromStr:now-24h,kind:relative,to:'2020-12-18T18:53:28.150Z',toStr:now)),timeline:(linkTo:!(),timerange:(from:'2020-11-11T23:15:53.110Z',kind:absolute,to:'2020-11-12T23:15:53.134Z')))&timeline=(graphEventId:'',id:'02d79220-24fd-11eb-9ddd-db279b467fd0',isOpen:!f)
```

---

<div class="post-metadata">

**Author:** ![yctercero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yctercero/32/68560_2.png) [@yctercero](https://discuss.elastic.co/u/yctercero)\
**Post date:** [December 21, 2020, 4:31pm UTC](https://discuss.elastic.co/t/detection-alerts-want-to-only-see-that-alert/259135/2 "2020-12-21T16:31:18Z")

</div>

Hi @austinsonger!

Thanks for your post! I just wanted to clarify, you're wanting to view alerts only from one specific timeframe?

One thing you can do is that you can go to the alert of interest and do the following:

1. Click on view alert details  
 ![Screen Shot 2020-12-21 at 11.25.26 AM](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a94547cbb7f546592368c3b32d9a8ae2c349cebe.png)

2. Hover over the timestamp value and find the icon that is a magnify glass with a plus sign  

3. Click on that icon mentioned in step 2 and you should now see the detections tab filtered by that specific timestamp  

You can also [save queries](https://www.elastic.co/guide/en/kibana/master/save-load-delete-query.html#save-load-delete-query) if this is one you often use or want to come back to.  
 ![Screen Shot 2020-12-21 at 11.30.17 AM](https://us1.discourse-cdn.com/elastic/original/3X/5/e/5eaa8f252692cfc7c742fedcac436c6262965c01.png)

Hope that helps!

Best,  
Yara

---

<div class="post-metadata">

**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\
**Post date:** [December 21, 2020, 4:47pm UTC](https://discuss.elastic.co/t/detection-alerts-want-to-only-see-that-alert/259135/3 "2020-12-21T16:47:07Z")

</div>

When Elastic sends the link to JIRA, I want it to only send the link for that specific detection alert and not a timeframe.

---

<div class="post-metadata">

**Author:** ![christos.nasikas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christos.nasikas/32/45611_2.png) [@christos.nasikas](https://discuss.elastic.co/u/christos.nasikas)\
**Post date:** [December 21, 2020, 5:20pm UTC](https://discuss.elastic.co/t/detection-alerts-want-to-only-see-that-alert/259135/4 "2020-12-21T17:20:38Z")

</div>

Hi @austinsonger,

Are you talking about `{{{context.results_link}}}` ?

---

<div class="post-metadata">

**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\
**Post date:** [December 22, 2020, 7:57am UTC](https://discuss.elastic.co/t/detection-alerts-want-to-only-see-that-alert/259135/5 "2020-12-22T07:57:25Z")

</div>

Yup.

---

<div class="post-metadata">

**Author:** ![christos.nasikas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christos.nasikas/32/45611_2.png) [@christos.nasikas](https://discuss.elastic.co/u/christos.nasikas)\
**Post date:** [December 23, 2020, 4:11pm UTC](https://discuss.elastic.co/t/detection-alerts-want-to-only-see-that-alert/259135/6 "2020-12-23T16:11:16Z")

</div>

The [current behavior](https://github.com/elastic/kibana/blob/master/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/utils.ts#L22) of `context.results_link` does not filter the results to show only the specific alert either by the alert id or by the exact timeframe. Could you please open a [feature request](https://github.com/elastic/kibana/issues/new?template=Feature_request.md) and tag it with `Team: SecuritySolution`?

Thank you!

---

<div class="post-metadata">

**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\
**Post date:** [December 24, 2020, 7:22am UTC](https://discuss.elastic.co/t/detection-alerts-want-to-only-see-that-alert/259135/7 "2020-12-24T07:22:33Z")

</div>

Here it is.

> <https://github.com/elastic/kibana/issues/86615>
>
> Describe the feature:
> Detection Alert - Link to Exact Time of Detection Alert
> Describe a specific use case for the feature:
> Instead of a...

---

<div class="post-metadata">

**Author:** ![christos.nasikas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christos.nasikas/32/45611_2.png) [@christos.nasikas](https://discuss.elastic.co/u/christos.nasikas)\
**Post date:** [December 24, 2020, 9:17am UTC](https://discuss.elastic.co/t/detection-alerts-want-to-only-see-that-alert/259135/8 "2020-12-24T09:17:42Z")

</div>

Thank you so much! I let my team know about it.

Happy new year!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 21, 2021, 9:18am UTC](https://discuss.elastic.co/t/detection-alerts-want-to-only-see-that-alert/259135/9 "2021-01-21T09:18:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
