alerting
alerting copied to clipboard
[FEATURE] Alert acknowledgement, visible alert ID and acknowledgement notes
Currently with alerts there is no ability to record or show who acknowledged an alert, reference an alert with a unique ID or make notes on an alert.
When acknowledging an alert, the username of the person acknowledging the alert should be recorded and be able to be viewed for all alerts that are already acknowledged. Optionally, a notes field can be provided for the user acknowledging an alert to enter information regarding their investigation of the alert, incident number/etc.
There is currently no means to find out who acknowledged an alert and no ability to view the alert unique ID in the web interface (although it is available via the api GET /_plugins/_security_analytics/alerts?detectorType={type}
under field alerts.id
)
Added to backlog
We plan to add some of the enhancements on alerting in 2.15 release.