Security posture
Alerts, critical and high counts, baseline drift, and platform issues in a time window, plus the ten noisiest rules and the ten latest alerts.
Security posture gathers figures from Alerts, Baseline checks, Platform health, and Investigations and makes no model calls. It refreshes every 30 seconds; select Pause refresh to stop. It is available in every edition.
The time picker in the top right sets the window: 1 hour, 6 hours, 24 hours, 7 days, or 30 days. The default is 24 hours.
Key figures
| Card | Source | Opens |
|---|---|---|
| Alerts | Alerts ingested in the window | Alerts |
| Critical + high | Critical and high alerts in the window, badged Look first when above 0 | Alerts, filtered by severity |
| Baseline drift | Failed checks in the latest run, or Never run | Baseline checks |
| Platform issues | Checks not passing in the latest check-up | Platform health |
Alert timeline and severity mix
The timeline stacks alert counts by severity per hour, or per day for wide windows. The severity share for the window sits beside it.
Top rules and latest alerts
Top 10 rules by alerts lists each rule with its alert count. One noisy rule is often most of the queue; select View to open Alerts filtered on that rule. Latest 10 alerts lists severity, rule, subject, and time; select Work it to open the feed.
Analysis archive
The bottom of the page shows how many investigations and triages are archived. Select Open archive to go to Investigations.
The Alerts to work, Baseline drift, Platform issues, and Investigations cards at the top of the Ask AI home page are a compact version of this page.
Baseline checks
CIS and MLPS 2.0 compliance verdicts from rules over osquery results. No model involved, so verdicts are reproducible and work air-gapped.
Alerts
Ingest Elastic Security detection alerts by polling or webhook, each with an automatic summary. Group, filter, and set dispositions in the feed, and investigate a single alert.