Group identical alerts in Elastic Security [7.14.2]

Elastic Security
1

Hi, everyone

I would like to know whether it is possible to group several occurrences of same alerts in Elastic Security.

For instance, we have configured a detection rule which has generated many alerts in a short period of time. I would like to group alerts with identical field values (source.ip, destination.ip, host.name, and so on).

Here you are a screenshot:

group-alerts
group-alerts1828×920 92.8 KB

Thanks in advance,

Rodrigo

5 Likes
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.