- Elastic Cloud Serverless
- Elasticsearch
- Elastic Observability
- Get started
- Observability overview
- Elastic Observability Serverless billing dimensions
- Create an Observability project
- Quickstart: Monitor hosts with Elastic Agent
- Quickstart: Monitor your Kubernetes cluster with Elastic Agent
- Quickstart: Monitor hosts with OpenTelemetry
- Quickstart: Unified Kubernetes Observability with Elastic Distributions of OpenTelemetry (EDOT)
- Quickstart: Collect data with AWS Firehose
- Get started with dashboards
- Applications and services
- Application performance monitoring (APM)
- Get started with traces and APM
- Learn about data types
- Collect application data
- View and analyze data
- Act on data
- Use APM securely
- Reduce storage
- Managed intake service event API
- Troubleshooting
- Synthetic monitoring
- Get started
- Scripting browser monitors
- Configure lightweight monitors
- Manage monitors
- Work with params and secrets
- Analyze monitor data
- Monitor resources on private networks
- Use the CLI
- Configure a Synthetics project
- Multifactor Authentication for browser monitors
- Configure Synthetics settings
- Grant users access to secured resources
- Manage data retention
- Scale and architect a deployment
- Synthetics Encryption and Security
- Troubleshooting
- Application performance monitoring (APM)
- Infrastructure and hosts
- Logs
- Inventory
- Incident management
- Data set quality
- Observability AI Assistant
- Machine learning
- Reference
- Get started
- Elastic Security
- Elastic Security overview
- Security billing dimensions
- Create a Security project
- Elastic Security requirements
- Elastic Security UI
- AI for Security
- Ingest data
- Configure endpoint protection with Elastic Defend
- Manage Elastic Defend
- Endpoints
- Policies
- Trusted applications
- Event filters
- Host isolation exceptions
- Blocklist
- Optimize Elastic Defend
- Event capture and Elastic Defend
- Endpoint protection rules
- Identify antivirus software on your hosts
- Allowlist Elastic Endpoint in third-party antivirus apps
- Elastic Endpoint self-protection features
- Elastic Endpoint command reference
- Endpoint response actions
- Cloud Security
- Explore your data
- Dashboards
- Detection engine overview
- Rules
- Alerts
- Advanced Entity Analytics
- Investigation tools
- Asset management
- Manage settings
- Troubleshooting
- Manage your project
- Changelog
Detection & Response dashboard
editDetection & Response dashboard
editThe Detection & Response dashboard provides focused visibility into the day-to-day operations of your security environment. It helps security operations managers and analysts quickly monitor recent and high priority detection alerts and cases, and identify the hosts and users associated with alerts.
Interact with various dashboard elements:
- Use the date and time picker in the upper-right to specify a time range for displaying information on the dashboard.
-
In sections that list alert counts, click a number to view the alerts on the Alerts page. Hover over the number and select Investigate in timeline (
) to open the alerts in Timeline.
- Click the name of a detection rule, case, host, or user to open its details page.
The following sections are included:
Alerts |
The total number of detection alerts generated within the time range, organized by status and severity. Select View alerts to open the Alerts page. |
Cases |
The total number of cases created within the time range, organized by status. Select View cases to open the Cases page. |
Open alerts by rule |
The top four detection rules with open alerts, organized by the severity and number of alerts for each rule. Select View all open alerts to open the Alerts page. |
Recently created cases |
The four most recently created cases. Select View recent cases to open the Cases page. |
Hosts by alert severity |
The hosts generating detection alerts within the time range, organized by the severity and number of alerts. Shows up to 100 hosts. |
Users by alert severity |
The users generating detection alerts within the time range, organized by the severity and number of alerts. Shows up to 100 users. |