Hi @willemdh thanks for the post. You raise several good points here, but the common theme is that you want to be able to customize the column selections shown in the various views and have your changes persist.
Persistent, or "sticky" column customization is a much-requested enhancement, and we are looking to implement that in a future release, possibly storing these settings per-user using local storage. Please let us know if there are other related settings you'd like to see persisted? For example, do you have a default column sort-order you prefer?
Is there a way to make changes to columns for Signals and External Alerts consistent?
This too is common feedback, and we're working towards a more consistent way to present the various kinds of alerts that are relevant to analysts. Today, while consistency is desired, keep in mind that signals and external alerts are different objects, and do have different fields available for display.
event.module is irrelevant when event.dataset is shown.
Fair point when event.dataset is populated with the "module.dataset" convention, but that convention is not strictly required by ECS, so there is sometimes value in having both fields present.
observer.name is a field which doesn't even exist (instead of observer.hostname )
observer.name is a defined ECS field, and would provide context to an analyst about, for example, which instance or a web proxy had produced the external alert, but your point is valid, that observer.hostname may be populated more commonly, and essentially provides similar context.
Also agent.id is really not useful to show on an already crowded space.
Good point - thanks for the feedback.
