Inbox result can be very large

[jasonish]

While the inbox view might be paginated, it's returned in one http response. This can be quite large if the grouping results in a large number of distinct IP address pairs. To start, the response could just return the fields needed to build the inbox display rather than the full event.

A further step would be to only send back the first page of results, doing some server side pagination. Server side pagination was not initially used as it was not supported the Elastic aggregation queries, but it may be supported now.

[jasonish]

Fixed, only what is needed for the alert views is retrieved and sent now.

If using ECS, a lot of data is sent, that is another project.