---
title: Explore Security data in Discover
description: Explore security alerts and events using the Security-specific Discover experience in Kibana.
url: https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/security/investigate/discover-security
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available since 9.1
---

# Explore Security data in Discover
**Discover** provides a Security-specific experience for exploring alert and event data. When the Security experience is active, Discover adds color-coded row indicators, security-focused default columns, and a contextual overview tab in the document flyout that surfaces key alert and event context.
For general **Discover** concepts and features, refer to [Discover](https://www.elastic.co/elastic/docs-builder/docs/3016/explore-analyze/discover).
![Discover with the Security solution default data view selected.](https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/images/security-discover-profile.png)


## Access the Security Discover experience

How the Security experience activates depends on your deployment type:
- <applies-to>Serverless Security projects: Generally available</applies-to> The Security experience activates automatically when you open **Discover** from your Elastic Security Serverless project.
- <applies-to>Elastic Stack: Generally available</applies-to> The Security experience activates when you open **Discover** from the Elastic Security [solution view](https://www.elastic.co/elastic/docs-builder/docs/3016/deploy-manage/manage-spaces).


## Security-specific Discover features

With the Security experience active, **Discover** adds the following features to help you triage and investigate alerts and events.

### Row indicators

Color-coded indicators appear on the left side of each row in the data table, helping you distinguish between alerts and events at a glance:
- **Alerts**: Yellow indicator
- **Events**: Gray indicator


### Default columns for alert data

When you use a data view that includes security alerts data, such as the default Elastic Security data view, **Discover** displays pre-configured columns optimized for alert triage.

### Alert and Event Overview tab

When you expand a document in **Discover**, the document flyout includes an **Alert Overview** or **Event Overview** tab depending on the document type. This tab surfaces key information to help you quickly understand the document and decide on next steps.
The overview tab includes the following sections:
<definitions>
  <definition term="About">
    An ECS-based description of the event category, helping you understand the type of activity the document represents.
  </definition>
  <definition term="Description">
    The detection rule description. Appears for alert documents.
  </definition>
  <definition term="Reason">
    The reason the alert was generated. Appears for alert documents.
  </definition>
  <definition term="Explore in Alerts or Explore in Timeline">
    For alerts, links directly to the alert in the Elastic Security app [Alerts](https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/security/detect-and-alert/manage-detection-alerts) page. For events, opens the event in [Timeline](https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/security/investigate/timeline) for further investigation.
  </definition>
</definitions>