SIEM and XDR Alerts

Elastic Security
1

Hi,

is possible to differentiate alert detections between SIEM and XDR on the console?

2

In Security > Rules > Detection Rules you will find all the rules related to the integration of Elastic Defend which takes EDR actions and, when used for protection in cloud or container services, assumes the role of XDR delivering scalable and extended protection for these services.

rules01
rules011584×720 143 KB

Rules02
Rules021620×475 62.3 KB

Rule03
Rule031844×698 104 KB

3

@wsouza Thanks for the feedback . but this is based on the rule right? is it possible to pull alerts for a month for example the one only XDR detected?

4

When creating a detection rule, you can add an exception to the endpoint. You find this option in Advanced Settings when creating a detection rule. Does it help you with anything?

image

5

Hi @wsouza Thanks i thought maybe i can separate xdr alerts and siem alerts not on the rules but on the alerts.

6

I think it's possible with the right query / filter on the right tags.

7

Hi @willemdh oh okay any idea?

8

If you are looking at Security > Alerts, you can filter with event.dataset:"endpoint.alerts". This will show you all the alerts coming from the Endpoint Security rule.

If you want to have a broader scope to include all detection alerts that use the logs coming from the Defend integration, you can filter on the alert page with event.dataset:endpoint.*. This would include datasets like endpoint.events.file, endpoint.events.network, endpoint.events.process, etc.

Hopefullly this helps!

9

Hi @guessWho Thanks