Kibana.alert.reason in actions

Elastic Security
1

Is it possible to use kibana.alert.reason within the actions. I have tried

	{{#context.alerts}}{{kibana.alert.reason}}{{/context.alerts}}
1 Like
2

Hey there @probson! :wave:

So I just tested this on an 8.0 snapshot and am seeing it work, so my guess it has to do with the field aliasing between kibana.alert.reason and signal.reason for pre-8.x. Looking at the source for 7.16, it looks like reason is being set on signal.reason, so you should be able to use that to access the reason in actions, ala:

{{#context.alerts}}{{signal.reason}}{{/context.alerts}}

Let me know if that doesn't work (and your Kibana version), and happy to dig further! Cheers! :slightly_smiling_face:

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.