A single rule can now separate its detections by target

Detection rules now have a “Target Distinction” setting. By choosing identifier labels (an instance ID, an actor, and so on), one rule can keep its detections separate per target. A single “CPU utilization above 80%” rule can now tell you which instance crossed the line.

• When you choose identifier labels, the page previews how many targets your recent events split into
• Rules that detect on a number of occurrences within a period now count occurrences per target
• Compound rules also split their judgments by the identifier labels you choose
• Incident policies have a “How incidents are split” setting: one incident per target, or one incident per trigger rule as before
• Trigger details now include a “Target and Evidence” section, so you can see which target fired
• The default is “Merge into one” (one incident per trigger rule). Unless you set identifier labels, behavior is unchanged