# Response Action History Alerting **URL:** \ **Category:** Elastic Security\ **Created:** [May 29, 2024, 11:09pm UTC](https://discuss.elastic.co/t/response-action-history-alerting/360519 "2024-05-29T23:09:09Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Matthew\_Franz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matthew_franz/32/127667_2.png) [@Matthew\_Franz](https://discuss.elastic.co/u/Matthew_Franz)\ **Post date:** [May 29, 2024, 11:09pm UTC](https://discuss.elastic.co/t/response-action-history-alerting/360519/1 "2024-05-29T23:09:09Z")
I've opened up a case with Elastic Support but their first response didn't get it, so figured I'd try here as well. Other EDR like Falcon have pretty good audit logs you can create alerts on but I haven't yet found a way to do a Slack notification for [Response actions history | Elastic Security Solution [8.13] | Elastic](https://www.elastic.co/guide/en/security/current/response-actions-history.html) which is kind of important. Anyone solve this? I couldn't find any index where this data was stored, and even looked at the hidden indexes. ---
**Author:** ![ashokaditya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashokaditya/32/77783_2.png) [@ashokaditya](https://discuss.elastic.co/u/ashokaditya)\ **Post date:** [June 3, 2024, 6:44am UTC](https://discuss.elastic.co/t/response-action-history-alerting/360519/2 "2024-06-03T06:44:47Z")
Hi Matthew, Thanks for reaching out with the query. I'm assuming you're running the v8.13 stack. If so, the data that response actions history page uses is stored in `.logs-endpoint.actions-` and `.logs-endpoint.action.responses-` data streams. Those data streams write to indices that have a `.ds-` prefix. The former stores the action requests and the latter stores responses to the action requests. ![Screenshot 2024-06-03 at 08.42.00](https://us1.discourse-cdn.com/elastic/original/3X/d/d/ddb1b364061bedc9c55d1734e71841684fc837a1.png) I can't see the link to the support case you mentioned, but I imagine that you want to create slack notifications on response actions history so that you're notified when the status of a specific request changes from `pending` to `failed` or `success` as well as get notified whenever there's a new action request created (for any/all of your endpoints)? We don't have such a feature on the response actions history yet but it certainly seems useful so please create an enhancement request for this on the Kibana repo where you can follow the discussion/progress on the ticket and tag it to `Team: Defend Workflows`. You can begin with assigning that ticket to me `@ashokaditya` and `@dasansol92` . Let us know if you need further help. Thanks. Regards, Ash ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 1, 2024, 6:45am UTC](https://discuss.elastic.co/t/response-action-history-alerting/360519/3 "2024-07-01T06:45:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.