# Elastic Detection Actions - any way to add fields?

**URL:** <https://discuss.elastic.co/t/elastic-detection-actions-any-way-to-add-fields/300764>\
**Category:** SIEM\
**Created:** [March 26, 2022, 3:57pm UTC](https://discuss.elastic.co/t/elastic-detection-actions-any-way-to-add-fields/300764 "2022-03-26T15:57:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kossde](https://avatars.discourse-cdn.com/v4/letter/k/f19dbf/32.png) [@kossde](https://discuss.elastic.co/u/kossde)\
**Post date:** [March 26, 2022, 3:57pm UTC](https://discuss.elastic.co/t/elastic-detection-actions-any-way-to-add-fields/300764/1 "2022-03-26T15:57:06Z")

</div>

We are creating numerous threshold detections for a specific client. This client is asking the threshold detections to email them when the alert is triggered, but they are asking us to include details about the original event(s) that do not currently show up in {{context.alerts}} (or obviously the signals index).

Is there a way to force a detection to include specific fields - fields that it does not include by default -- when alerting? The client wants specific event details for each of the threshold rule's associated events.

---

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [March 28, 2022, 2:08pm UTC](https://discuss.elastic.co/t/elastic-detection-actions-any-way-to-add-fields/300764/2 "2022-03-28T14:08:22Z")

</div>

No, there currently is not a method to do this except for using the field in the threshold determination.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2022, 2:09pm UTC](https://discuss.elastic.co/t/elastic-detection-actions-any-way-to-add-fields/300764/3 "2022-04-25T14:09:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
