I have made some changes to a system index template (.alerts-security.alerts-default-index-template) by adding a new Component Template to map some custom fields for use as filters in the Alerts dashboard. However, after some time, I noticed that the Component Template was no longer associated with the .alerts-security.alerts-default-index-template, and once again, the filters based on custom fields stopped working.
Is there a way to make this change permanent, or is there a better approach to mapping custom fields in the alerts index?