An alert event count is not the entity

The count is a group size

An alert can show how many events it grouped. That integer is the size of the group. It does not list the hosts, the users, or the files inside the group.

A count of 6 is six events only if the field says events. It is not six hosts unless a host list with six names is also on the alert.

Names come from entity fields

A host, a user, or an address you cite has to be printed on the alert or on an event you opened from it. If the field is absent, that entity was not named here.

Do not fill a blank user with a word from the rule title. The title is not an entity field.

What you can name

File the count with its field name, and file each entity from the field that showed it. Write “user not on this alert” when the user field is missing. Do not grow the entity list up to the count.

Lab: six events and one host

Lab alert HB-DET-014 shows event_count 6 and host lab-web-02. No user field is present. A draft says six hosts were involved and names the user admin because the title mentions an admin.

The note says six events and one printed host, lab-web-02. The other events are not extra hosts in this paste. User: not on this alert. The word admin stays in the title.

Snippet

rule id: HB-DET-014
event_count: 6
host: lab-web-02
user: not on this alert
write: six events, one host
not: six hosts, and not user admin

Diagram

From a count to a name you can cite

Count
How many events the alert grouped.
Tally
```
6
```
Host field
The host that was printed.
Entity
```
lab-web-02
```
Missing user
Say the field is absent.
Gap
```
not on this alert
```
A name
Cite it only from a field.
Note
```
not from the integer
```

Check yourself

1. The alert says event_count 6 and lists host lab-web-02. What is 6?

2. Which entity can you name from this alert?

3. No user field is present. What do you write?