elastic / elastic/docs-content
Alert flyout analyzer and prevalence gain cold/frozen tier exclusion controls
- Dominant language
- No language data
- Stars
- 47
- Forks
- 261
- Avg merge
- 3d 21h
- Merged PRs (30d)
- 141
Description
## Summary
Two related changes add cold/frozen tier awareness to the alert details flyout. First, a callout and badge now appear on the Analyzer overview and detail views when the existing securitySolution:excludeColdAndFrozenTiersInAnalyzer advanced setting is used to exclude cold/frozen tier data from analyzer calls. Second, a new advanced setting lets administrators turn cold/frozen tier data on or off specifically for the Prevalence overview and detail sections, which previously could load slowly when scanning across all tiers. Neither change applies to serverless, since serverless has no cold/frozen tiers.
**Why this needs docs:** Both PRs add new, user-facing advanced settings and UI indicators (callout/badge) to the Analyzer and Prevalence sections of the alert flyout, and the current docs for those exact sections don't mention any tier-exclusion behavior or setting.
## Resources
- PR [#257015](https://github.com/elastic/kibana/pull/257015) — [Security Solution] add callout and badge for cold/frozen tier on analyzer overview and detail in alert flyout
- PR [#257011](https://github.com/elastic/kibana/pull/257011) — [Security Solution] add ability to turn on/off cold/frozen tier for the flyout prevalence
- Product issue: https://github.com/elastic/kibana/issues/210939
Screenshots from PR










## Availability
| Channel | Details |
|---------|---------|
| **Stack** | v8.19.13, v9.2.7, v9.3.2, v9.4.0 |
| **Serverless** | Mar 16–Mar 20 |
| **Feature flag** | None — active by default |
---
*Created with [Docs Quest Scanner](https://github.com/florent-leborgne/docs-quest-scanner) by @nastasha-solomon*
## Suggested edits
[View detection alert details](https://www.elastic.co/docs/solutions/security/detect-and-alert/view-detection-alert-details) > Analyzer
- **What the docs say:** The Analyzer flyout shows the full process tree for the alert, including ancestor and descendant processes, and related file, network, and registry events. Refer to Visual event analyzer to learn more.
- **What to add:** Add a note that when the securitySolution:excludeColdAndFrozenTiersInAnalyzer advanced setting is turned on, a callout appears above the Analyzer overview and a badge appears on the Analyzer preview indicating that cold/frozen tier data is excluded from the process tree. Stack only, from 9.4.0.
[View detection alert details](https://www.elastic.co/docs/solutions/security/detect-and-alert/view-detection-alert-details) > Prevalence
- **What the docs say:** The Prevalence overview shows whether data from the alert was frequently observed on other host events from the last 30 days. Prevalence calculations use values from the alert's highlighted fields.
- **What to add:** Add a note describing the new advanced setting that lets administrators exclude cold/frozen tier data from prevalence calculations (to improve load time), and mention the dismissible callout shown in the Prevalence overview/details when the setting changes data included. Stack only, from 9.4.0.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.