How to add client.ip to Alarm "stack by"?

Elastic Security SIEM
1

In the "Alerts" section, in the "Stack by" field, I see many fields other than the one I need (client.ip). How to add a field to this list?

2

What version are you on @VellayLoket? Looks like this was changed to a free field selection in 8.1, so from that version forward you can just type whichever field you want :slightly_smiling_face:

Alerts_-_Kibana
Alerts_-_Kibana1370×768 22.8 KB

Added in this PR: [Security Solution] Alerts visualization free field selection by kqualters-elastic · Pull Request #120610 · elastic/kibana · GitHub

https://user-images.githubusercontent.com/56408403/145041383-51adce61-fa24-4c50-b7cc-7f79f608f6df.gif(image larger than 4 MB)

Cheers!
Garrett

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.