Can you see which account have changed the signal.status field in elastic? if not can this be looked into I think it would be really useful to see which analyst is closing which detections

See Who's changing signal detections

Oliver2 (Oliver) March 28, 2021, 5:49pm 3

ah i was hoping it could be in the event itself, so it appears in the siem-signals-* indcies for use in dashdoards etc

Topic		Replies	Views
Measuring reaction to detection Elastic Security	5	519	April 26, 2021
Threat Hunting Report for Elasticsearch SIEM	11	1528	October 7, 2020
Signals Elastic Security	2	338	November 4, 2022
MSSP SOC - How to ByPass "Cases" Elastic Security	6	701	November 4, 2022
Watchers and Elastic Security Elastic Security	2	341	May 11, 2021

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

See Who's changing signal detections

Related topics