For my use case I want to understand, is there an API associated, which gives the highlighted fields section in the alerts flyout in Security Plugin in Kibana. The highlighted fields which gets generated in the alert flyout are dynamic i.e. triggering of different rules as alerts does shows differe…

Hey @Sergie , Here's an explanation of how Highlighted Fields are retrieved then displayed in the Alerts flyout. It might be more information than you asked (if so I apologize), but the logic is actually not straightforward so I figured I'd provide as much as possible here. If you're not interested …

Thanks a lot @Philippe_Oberti for this detailed explanation. This is great. I really appreciate it. Just a query is there an file or something which you have handy which contains the exact kibana fieldnames categorized based on the different conditions (based on category, code) or else I will sta…

@Sergie unfortunately I built my previous answer off of the only file that - to my knowledge - has the information, and it's directly in the code... The links I provided above are pointing to the exact lines for each section though, so hopefully that will make it a little bit easier for you? Grante…

Thanks @Philippe_Oberti , yeah those are really useful :slight_smile: I was able to traverse through the code and get those fields. Just one more question these counts related to alert by ancestry, how these are calculated, is it based on some field/combination of fields from the alert payload ? …

Sorry for my late reply @Sergie , I was off yesterday! So, while the logic to retrieve the count of alerts related by ancestry is not complex per say, it's not straightforward either :laughing: . Let me try to explain the flow: this is the component that renders that line in the flyout. That compo…

Thanks for the response @Philippe_Oberti :slight_smile: , it's really great help. I was off for some days as well so really sorry couldn't reply back soon but this was really helpful again :slight_smile: I really appreciate it. On the similar lines I have last couple of questions. Under threat …

Hey @Sergie , sorry for my even more late reply this time, I've been pretty sick over the last week... So, be ready because this is another complex one! :laughing: These 2 numbers - while in the same section and displayed bascially next to each other - are not calculated the same way at all. In s…

How to get the List of highlighted fields attached per rule in Alerts flyout in Security Analytics

Elastic Security

system (system) Closed June 24, 2025, 8:33pm 9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
How to get the different counts mentioned for threat matches detected and fields enriched with threat intelligence under threat intelligence overview in Security Alerting Elastic Security	1	71	June 3, 2025
Elastic AI Assistant Threshold Rule Fields kibana.alert.new_terms Elastic Security elastic-ai-assistant	5	222	July 4, 2024
Elastic Rule Alert With External hyper link field creation in highlighted Fields [feature request] SIEM	3	37	March 13, 2026
Security Detection Rules ( SIEM ) Elasticsearch	0	138	May 24, 2024
[Detection Rule for Security]: Extract fields from {{context.alerts}} in the Kibana Connector Message Service Kibana	2	1603	August 13, 2021

How to get the List of highlighted fields attached per rule in Alerts flyout in Security Analytics

Related topics