Watcher Acknowledge



Is it possible to know who acknowledged the watch when x-pack security is enabled ?
Is it possible to create a new field for that ?


(Alexander Reelsen) #2


no, this is currently not possible.



does it make sense to add such a field ? . Isn't it important to know who acknowledged an event while investigating a major incident ? .

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.