# See Who's changing signal detections

**URL:** <https://discuss.elastic.co/t/see-whos-changing-signal-detections/268545>\
**Category:** Elastic Security\
**Created:** [March 26, 2021, 11:29pm UTC](https://discuss.elastic.co/t/see-whos-changing-signal-detections/268545 "2021-03-26T23:29:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Oliver2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oliver2/32/76684_2.png) [@Oliver2](https://discuss.elastic.co/u/Oliver2)\
**Post date:** [March 26, 2021, 11:29pm UTC](https://discuss.elastic.co/t/see-whos-changing-signal-detections/268545/1 "2021-03-26T23:29:01Z")

</div>

Can you see which account have changed the signal.status field in elastic? if not can this be looked into I think it would be really useful to see which analyst is closing which detections

---

<div class="post-metadata">

**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\
**Post date:** [March 28, 2021, 5:16pm UTC](https://discuss.elastic.co/t/see-whos-changing-signal-detections/268545/2 "2021-03-28T17:16:45Z")

</div>

> [@Oliver2](#):
>
> signal.status

**Check more on Auditing**

- [Auditing security settings | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/auditing-settings.html)
- [Audit events | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/audit-event-types.html)

---

<div class="post-metadata">

**Author:** ![Oliver2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oliver2/32/76684_2.png) [@Oliver2](https://discuss.elastic.co/u/Oliver2)\
**Post date:** [March 28, 2021, 5:49pm UTC](https://discuss.elastic.co/t/see-whos-changing-signal-detections/268545/3 "2021-03-28T17:49:41Z")

</div>

ah i was hoping it could be in the event itself, so it appears in the siem-signals-\* indcies for use in dashdoards etc

---

<div class="post-metadata">

**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\
**Post date:** [March 28, 2021, 6:05pm UTC](https://discuss.elastic.co/t/see-whos-changing-signal-detections/268545/4 "2021-03-28T18:05:57Z")

</div>

> [@Oliver2](#):
>
> ah i was hoping it could be in the event itself, so it appears in the siem-signals-\* indcies for use in dashdoards etc

This is part of the reason why I use JIRA and you can read my response to another person question.

- [Measuring reaction to detection - #3 by austinsonger](https://discuss.elastic.co/t/measuring-reaction-to-detection/268362/3)

I'm sure elastic with add that down the road, but they already have enough in their backlog and items that are higher priority. But you can check here if someone has already created a feature request for this and if you don't, then you should add a feature request.

- [https://github.com/elastic/kibana/issues?q=is:open+is:issue+label:"Team:+SecuritySolution"](https://github.com/elastic/kibana/issues?q=is:open+is:issue+label:%22Team:+SecuritySolution%22)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2021, 6:06pm UTC](https://discuss.elastic.co/t/see-whos-changing-signal-detections/268545/5 "2021-04-25T18:06:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.