Hello,
playing around more and more with the SIEM and signals etc. and I saw that there does not seem to be a way to assign signals.
I can mark them as "open", "in progress" or "done" however I have no information which user actually did this.
In a SIEM with multiple Analysts this would be rather useful because otherwise I am unable to see who marked a signal as "in progress" but then maybe forgot about it for a week and it was left unresolved.
Furthermore it would allow the Analyst to filter for alerts that he assigned to himself (assuming a function like that will get implemented), if he is analysing multiple signals this can be rather useful. Otherwise the only association I have about which analyst is working on what signal is either through timelines or cases and not every signal warrants a case or timeline.