Watcher Acknowledge

annk · February 20, 2018, 6:45pm

Is it possible to know who acknowledged the watch when x-pack security is enabled ?
Is it possible to create a new field for that ?

Thanks

spinscale · February 21, 2018, 8:07am

Hey,

no, this is currently not possible.

--Alex

annk · February 21, 2018, 11:38am

does it make sense to add such a field ? . Isn't it important to know who acknowledged an event while investigating a major incident ? .

system · March 21, 2018, 11:38am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.