You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: explore-analyze/alerts-cases/alerts/view-alerts.md
+44-1Lines changed: 44 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ products:
8
8
- id: kibana
9
9
---
10
10
11
-
# View alerts [view-alerts]
11
+
# View and manage alerts [view-alerts]
12
12
13
13
When the conditions of a rule are met, it creates an alert. If the rule has actions, they run at the defined frequency. For example, the rule can send email notifications for each alert at a custom interval. For an introduction to the concepts of rules, alerts, and actions, refer to [Alerting](../alerts.md).
14
14
@@ -70,3 +70,46 @@ An alert can also be in a "flapping" state when it is switching repeatedly betwe
70
70
If an alert is active or flapping, you can mute it to temporarily suppress future actions. In both **{{stack-manage-app}} > Alerts** and **{{rules-ui}}**, you can open the action menu (…) for the appropriate alert and select **Mute**. To permanently suppress actions for an alert, open the actions menu and select **Mark as untracked**.
71
71
72
72
To affect the behavior of the rule rather than individual alerts, check out [Snooze and disable rules](create-manage-rules.md#controlling-rules).
73
+
74
+
## Clean up alerts [clean-up-alerts]
75
+
76
+
```{applies_to}
77
+
stack: preview 9.1
78
+
serverless: preview
79
+
```
80
+
81
+
Manage the size of alert indices in your space by clearing out alerts that are older or infrequently accessed. You can do this by running an alert cleanup task, which deletes alerts according to the criteria that you define.
82
+
83
+
:::{note}
84
+
The alert cleanup task permanently deletes alerts in your `.alert-*` indices. Make sure to take regular snapshots of your cluster to back up your alert data in case you ever need to restore it.
85
+
:::
86
+
87
+
### Prerequisites [clean-up-alerts-reqs]
88
+
89
+
* To run the alert cleanup task, your role must have `All` privileges for the **Alert deletion feature**. When setting your role’s Kibana privileges, go to **Management > Rule Settings**, enable **Customize sub-feature privileges**, then select `All` for the **Alert deletion** feature.
90
+
* Alerts in your space must be older than a day. The minimum threshold for the alert cleanup task is one day.
91
+
92
+
### Run the alert cleanup task [run-alert-clean-up-task]
93
+
94
+
Remove old or rarely-accessed alerts in your space by running an alert cleanup task, which deletes alerts according to the criteria that you define. Alerts that are attached to cases are not deleted.
95
+
96
+
1. Open the **Rules** page by going to **Stack Management > Alerts and Insights > Rules** in the main menu or using the global search field.
97
+
2. Click **Settings** to open the settings for all rules in the space.
98
+
3. In the **Clean up alert history** section, click **Clean up**.
99
+
4. Define criteria for the alert cleanup task. You can choose to delete alerts that are active or inactive and meet a certain age.
100
+
101
+
:::{tip}
102
+
At the bottom of the modal, you can find a preview of the number of alerts that will be deleted according to the criteria that you define.
103
+
:::
104
+
105
+
***Active alerts**: Choose to delete alerts that haven't had their status changed since they were initially generated and are older than the threshold that you specify.
106
+
107
+
For example, if you specify two years as the threshold, the cleanup task will delete alerts that were generated more than two years ago and have never had their status changed.
108
+
109
+
***Inactive alerts**: Choose to delete alerts that have had their statuses changed since they were initially created and are older than the threshold that you specify. Inactive alerts have had their status changed to recovered, closed, acknowledged, or untracked.
110
+
111
+
For example, if you specify two years, the cleanup task will delete alerts that have had their status changed to recovered, closed, acknowledged, or untracked more than two years ago.
112
+
113
+
5. Enter **Delete** to verify that you want to run the alert cleanup task, then click **Run cleanup task**.
114
+
115
+
A message confirming that the alert cleanup task has started running appears. This information is also provided at the top of the alert cleanup modal in the **Last cleanup task: details** field. Note the field doesn't display in the modal until an alert cleanup task is run.
Copy file name to clipboardExpand all lines: solutions/observability/incident-management/view-alerts.md
+11-3Lines changed: 11 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ products:
7
7
- id: cloud-serverless
8
8
---
9
9
10
-
# View alerts [observability-view-alerts]
10
+
# View and manage alerts [observability-view-alerts]
11
11
12
12
::::{note}
13
13
@@ -50,7 +50,7 @@ From the **Alerts** table, you can click on a specific alert to open the alert d
50
50
:screenshot:
51
51
:::
52
52
53
-
There are three common alert statuses:
53
+
There are four common alert statuses:
54
54
55
55
`active`
56
56
: The conditions for the rule are met and actions should be generated according to the notification settings.
@@ -122,4 +122,12 @@ To add an alert to a new case:
122
122
To add an alert to an existing case:
123
123
124
124
1. Select **Add to existing case**.
125
-
2. Select the case where you will attach the alert. A confirmation message displays.
125
+
2. Select the case where you will attach the alert. A confirmation message displays.
126
+
127
+
## Clean up alerts [clean-up-alerts-obs]
128
+
129
+
```{applies_to}
130
+
stack: preview 9.1
131
+
```
132
+
133
+
Manage the size of alert indices in your space by clearing out alerts that are older or infrequently accessed. You can do this by [running an alert cleanup task](../../../explore-analyze/alerts-cases/alerts/view-alerts.md#clean-up-alerts), which deletes alerts according to the criteria that you define.
Copy file name to clipboardExpand all lines: solutions/security/detect-and-alert/manage-detection-alerts.md
+9Lines changed: 9 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -299,3 +299,12 @@ This Timeline template uses the `host.name: "{host.name}"` dropzone filter in th
299
299
::::{note}
300
300
Refer to [Timeline](/solutions/security/investigate/timeline.md) for information on creating Timelines and Timeline templates. For information on how to add Timeline templates to rules, refer to [Create a detection rule](/solutions/security/detect-and-alert/create-detection-rule.md).
301
301
::::
302
+
303
+
## Clean up alerts [clean-up-alerts-sec]
304
+
305
+
```{applies_to}
306
+
stack: preview 9.1
307
+
serverless: preview
308
+
```
309
+
310
+
Manage the size of alert indices in your space by clearing out alerts that are older or infrequently accessed. You can do this by [running an alert cleanup task](../../../explore-analyze/alerts-cases/alerts/view-alerts.md#clean-up-alerts), which deletes alerts according to the criteria that you define.
0 commit comments