Event Color Coding

[deeshu]

What does this different color (Green, Grey, Red, violet etc..) coding says for an Event? Are there any more ?

@jstoner Is there any kb that covers this topic? I tried finding but no luck.

[Chris_B]

Looks like each type of label (e.g. alert or no | description) there's a handful of colors to help differentiate them. I've not yet seen an ability to use colors in another context, or filter a list by the,m - I'd just use the label text.

[jstoner]

Sorry for the delay on this. The color coding is a high level grouping of events of a general type, network type events are one color, process/edr like events would be another, authentication events would be another and so forth. There are handful of these colors, it isn't designed to map 1:1 to every event type but if I am looking for network events or endpoint events, a color grouping quickly pulls the eye toward those colors.

Alerts v Detections have their own color coding as well where alerts are red and detections (which are rule hits) but not creating an alert in queue are blue.

Hope this helps!

[deeshu]

Thanks, John. Just to be sure the different types of events you are talking about are derived from event.metadata.event_type? like email, file, network, process, registry etc..?

Can we control the color coding? I see different types of events are grouped with the same color, e.g. File and Process are tagged with Grey color. 

[jstoner · Accepted solution]

Yes, think of the color coding as a superset of event_types rolled together. Again the idea is that green (for example) are going to be network-centric events. We do not make control of the color coding an option today. The event_type is shown within the color and I believe the intent was just a quick look at color for grouping purposes. Because of the overall small number of colors versus all of the event_types defined, they will be broader groups. For example those types of events in grey are going to be endpoint-centric.