Can you see which account have changed the signal.status field in elastic? if not can this be looked into I think it would be really useful to see which analyst is closing which detections
1 Like
Check more on Auditing
ah i was hoping it could be in the event itself, so it appears in the siem-signals-* indcies for use in dashdoards etc
This is part of the reason why I use JIRA and you can read my response to another person question.
I'm sure elastic with add that down the road, but they already have enough in their backlog and items that are higher priority. But you can check here if someone has already created a feature request for this and if you don't, then you should add a feature request.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.