Threshold Rule type - not able to send more than three field values in email action

Elastic Security SIEM
1

Continuing the discussion from Threshold Rule type - not able to send more than three field values in email action:

2

Hey there @jancodenew! :wave:

So I wasn't able to determine why this was capped at 3 (wasn't mentioned in the docs or original PR), but I don't believe there should be any inherit system limitations that would prevent allowing additional groupings. Perhaps it was added for performance reasons?

Either way, I've opened this enhancement request to enable selecting more than three Group by fields, so we can continue the conversation there and see if there are any limitations. :slightly_smiling_face:

Cheers!
Garrett

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.