diff --git a/docs/detections/alerts-reduce.asciidoc b/docs/detections/alerts-reduce.asciidoc new file mode 100644 index 0000000000..f168f3e2e8 --- /dev/null +++ b/docs/detections/alerts-reduce.asciidoc @@ -0,0 +1,31 @@ +[[reduce-notifications-alerts]] +== Reduce notifications and alerts + +{elastic-sec} offers several features to help reduce the number of notifications and alerts generated by your detection rules. This table provides a general comparison of these features, with links for more details: + +[cols="2"] +|=== + +| <> +a| *_Stops a specific rule's notification actions from running_*. + +Use to avoid unnecessary notifications from a specific rule. The rule continues to run and generate alerts during the snooze period, but its <> don't run. + +| {kibana-ref}/maintenance-windows.html[Maintenance window] +a| *_Prevents all rules' notification actions from running_*. + +Use to avoid false alarms and unnecessary notifications during planned outages. All rules continue to run and generate alerts during the maintenance window, but their <> don't run. + +NOTE: Maintenance windows are a {kib} feature, configured outside of the {security-app} in *Stack Management*. + +| <> +a| *_Reduces repeated or duplicate alerts created by a custom query rule_*. + +Use to reduce the number of alerts created by a <> that matches multiple source events. Matching events are grouped by their values in a specified field, and only one alert is created for each group. + +| <> +a| *_Prevents a rule from creating alerts under specific conditions_*. + +Use to reduce false positive alerts by preventing trusted processes and network activity from generating unnecessary alerts. You can configure an exception to be used by a single rule or shared among multiple rules, but they typically don't affect _all_ rules. + +|=== diff --git a/docs/detections/detections-index.asciidoc b/docs/detections/detections-index.asciidoc index 8c0215bf8b..777a34bd72 100644 --- a/docs/detections/detections-index.asciidoc +++ b/docs/detections/detections-index.asciidoc @@ -32,6 +32,8 @@ include::alerts-add-to-cases.asciidoc[leveloffset=+1] include::alert-suppression.asciidoc[leveloffset=+1] +include::alerts-reduce.asciidoc[] + include::visual-event-analyzer.asciidoc[] include::query-alert-indices.asciidoc[]