# Set alert columns per rule

**URL:** <https://discuss.elastic.co/t/set-alert-columns-per-rule/364590>\
**Category:** Elastic Security\
**Created:** [August 8, 2024, 9:19am UTC](https://discuss.elastic.co/t/set-alert-columns-per-rule/364590 "2024-08-08T09:19:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rihards](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rihards/32/136322_2.png) [@Rihards](https://discuss.elastic.co/u/Rihards)\
**Post date:** [August 8, 2024, 9:19am UTC](https://discuss.elastic.co/t/set-alert-columns-per-rule/364590/1 "2024-08-08T09:19:03Z")

</div>

Viewing security rule alerts (lower part of the security rule page), they have wildly different fields (columns) that are useful to display. Customising them for one rule makes the view useless for another rule.

How could persistent fields (columns) be set per rule?

Was reading [Customize SIEM Detection columns based on alert - #2 by Mike\_Paquette](https://discuss.elastic.co/t/customize-siem-detection-columns-based-on-alert/263228/2) about timelines and timeline templates. Created a timeline template with one desired column, set it as the default for the rule - but that did not make the column show up in the alert view or the timeline view (when opening it from a single alert). Timeline view filters for that single alert, thus customising the columns in the alert view seems like potentially a much more useful thing.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2024, 1:27pm UTC](https://discuss.elastic.co/t/set-alert-columns-per-rule/364590/2 "2024-08-09T13:27:49Z")

</div>



---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2024, 2:30pm UTC](https://discuss.elastic.co/t/set-alert-columns-per-rule/364590/3 "2024-08-09T14:30:28Z")

</div>



---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2024, 2:31pm UTC](https://discuss.elastic.co/t/set-alert-columns-per-rule/364590/4 "2024-09-06T14:31:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.