The Alerts Table and the Detection Rule

What is it?

In Elastic Security, detection rules run KQL (or EQL) on a schedule and raise an alert when their condition matches. The Alerts table lists those alerts with severity, risk score and the rule that fired. Triage starts by reading WHY the rule fired, not by trusting the label.

Why it matters

An alert is a hypothesis, not a verdict — the same discipline as any SIEM. Understanding the rule's logic tells you what evidence would confirm or refute it, and whether the match is the real behavior or a benign lookalike.

Where you see it

The Alerts table: a row 'Possible Credential Dumping', severity high, rule 'rundll32 accessing lsass'. Opening it shows the matching document and the rule query, so you can see exactly what triggered it.

What normal looks like

A queue where most alerts, when read, have a benign explanation — a known admin tool, an expected scan — and a minority carry real evidence. Triage sorts one from the other.

What suspicious looks like

An alert whose matching document has no benign explanation, especially one that lines up with other activity on the same host or user. That is your cue to pivot into a full correlation.

How analysts investigate

Open the alert, read the rule query to learn its intent, inspect the matching document's fields, decide whether a benign explanation fits, and if not, pivot on the shared key (host or user) into the Timeline.

Common beginner mistakes

Closing or escalating on the severity label without reading why the rule fired.
Treating one alert in isolation when the story only appears once you correlate.

An alert is a hypothesis to test

  Alerts table
   severity  rule                          host      →  open the alert
   high      rundll32 → lsass access       FIN-07       reads the RULE query
                                                        + the matching document
  ask: does a benign explanation fit?  no → pivot on host=FIN-07 into Timeline
  the label is a starting hypothesis, not the conclusion

Triage reads the rule logic and the matching document, then pivots on a shared key when no benign story fits.

Quick check

A high-severity alert lands in the Alerts table. What is the right FIRST move?

A quick self-check — it doesn't affect your XP or progress.