Watcher Acknowledge

Is it possible to know who acknowledged the watch when x-pack security is enabled ?
Is it possible to create a new field for that ?


1 Like


no, this is currently not possible.


does it make sense to add such a field ? . Isn't it important to know who acknowledged an event while investigating a major incident ? .

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.