# Measuring reaction to detection **URL:** \ **Category:** Elastic Security\ **Created:** [March 25, 2021, 2:28pm UTC](https://discuss.elastic.co/t/measuring-reaction-to-detection/268362 "2021-03-25T14:28:25Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Anna\_Foxx](https://avatars.discourse-cdn.com/v4/letter/a/a587f6/32.png) [@Anna\_Foxx](https://discuss.elastic.co/u/Anna_Foxx)\ **Post date:** [March 25, 2021, 2:28pm UTC](https://discuss.elastic.co/t/measuring-reaction-to-detection/268362/1 "2021-03-25T14:28:26Z")
Hi! I want to know whether there is a functionality in Elastic Security to monitor reaction time to detection for example to count SLA. Is there smth called internal index from which I can get fields that will show me when my detection has been created and closed? And after that to build a dashboard based on reaction speed Btw, can I escalate an alert to another analyst? Or mark it as false positive. Unfortunately, I haven't found such buttons ---
**Author:** ![peter\_luo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peter_luo/32/84516_2.png) [@peter\_luo](https://discuss.elastic.co/u/peter_luo)\ **Post date:** [March 26, 2021, 4:21am UTC](https://discuss.elastic.co/t/measuring-reaction-to-detection/268362/2 "2021-03-26T04:21:02Z")
Not sure if that is built in feature yet, anyone from ELK can respond? ---
**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Post date:** [March 28, 2021, 5:48pm UTC](https://discuss.elastic.co/t/measuring-reaction-to-detection/268362/3 "2021-03-28T17:48:17Z")
> [@Anna\_Foxx](#): > > I want to know whether there is a functionality in Elastic Security to monitor reaction time to detection for example to count SLA. Is there smth called internal index from which I can get fields that will show me when my detection has been created and closed? And after that to build a dashboard based on reaction speed > > Btw, can I escalate an alert to another analyst? Or mark it as false positive. Unfortunately, I haven't found such buttons So here is what I do for our clients when it comes to using Elastic SIEM and ensuring SLA: - Use JIRA Service Desk and use their SLA feature - Configure Elastic SIEM to create a ticket in JIRA automatically anytime a Detection is trigger in Elastic. - Here is the easy of bulk editing script all of the detection rules - [Elastic Security: Bulk Detection Rule Modification via Detection API - JIRA Connector](https://songer.pro/elastic-security-bulk-detection-rule-modification-via-detection-api-jira-connector/) - [GitHub - austinsonger/Elastic-Security: Repo for Automations and other solutions for Elastic SIEM/Security.](https://github.com/austinsonger/Elastic-Security-Tricks) - So we basically subvert Elastic SIEM to JIRA for the initial detection and the following will show the information I have sent to JIRA: - [Elastic SIEM Connector to JIRA Service Desk Template #JIRA #Elastic · GitHub](https://gist.github.com/austinsonger/998b3d784eb5f9c040276ac7c4c9f5c2) ---
**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Post date:** [March 28, 2021, 6:08pm UTC](https://discuss.elastic.co/t/measuring-reaction-to-detection/268362/4 "2021-03-28T18:08:10Z")
> [@Anna\_Foxx](#): > > I want to know whether there is a functionality in Elastic Security to monitor reaction time to detection for example to count SLA. Is there smth called internal index from which I can get fields that will show me when my detection has been created and closed? And after that to build a dashboard based on reaction speed > > Btw, can I escalate an alert to another analyst? Or mark it as false positive. Unfortunately, I haven't found such buttons You can see if someone already has requested this feature in Github. And if you don't find anything, then you should request it. > **[Issues · elastic/kibana](https://github.com/elastic/kibana/issues?q=is:open%2Bis:issue%2Blabel:%22Team:%2BSecuritySolution%22)** > > Your window into the Elastic Stack. Contribute to elastic/kibana development by creating an account on GitHub. ---
**Author:** ![Anna\_Foxx](https://avatars.discourse-cdn.com/v4/letter/a/a587f6/32.png) [@Anna\_Foxx](https://discuss.elastic.co/u/Anna_Foxx)\ **Post date:** [March 29, 2021, 8:49am UTC](https://discuss.elastic.co/t/measuring-reaction-to-detection/268362/5 "2021-03-29T08:49:48Z")
Thank you for your advice! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 26, 2021, 8:50am UTC](https://discuss.elastic.co/t/measuring-reaction-to-detection/268362/6 "2021-04-26T08:50:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.