This topic describes how to view a summary of alerts. You can see a consolidated view of alerts generated in a specified time range.
Procedure
To view a summary of alerts:
-
In the Security Analytics menu, select Alerts > Summary.
If there is a default ESA service, the Summary view is displayed with the information for that service.
If no default service has been selected, the Select an ESA Service dialog is displayed.
- In the Select an ESA Service dialog, select a service and click Select.
The Summary view is displayed. - To choose a new service to view:
- To choose the timeframe of the summary, open the Time Range drop-down menu and select a time range.
The Start Time and End Time fields reflect the new range. - To choose the timeline, open the Unit drop-down menu and select a unit of time.
- To refresh the information in the Summary view, click
.
- To view alerts in a list, click
.
- In the list view, you can see more details about each alert.
- Date-- date the alert was generated.
- Name--name of the alert.
- Severity-- severity of the alert. (low, medium, or high).
- # of Events-- the number of events associated with the alert.
- Alert ID-- unique ID for each alert.
- Statement - dynamically generated statement name.
Also, you can view a detailed summary of each alert generated by clicking an alert. The following figure shows more details about the alert generated.
- Description - description of the alert.
- Statement - dynamically generated statement name.
- Time - time the alert was generated as per the timezone set on Security Analytics UI.
- Severity - severity of the alert (low, medium, high).
- Date- date the event was executed .
- ID- event ID.
- Raw Content - detailed information of the event.
For more information, see Alerts Summary View.
Previous Topic:View Stats for ESA Service
Next Topic:Use Automated Threat Detection
You are here
Table of Contents > View ESA Stats and Alerts > View a Summary of Alerts