[Security Solution][Investigations] - Add session field to highlighted fields table #131943
Labels
8.3 candidate
enhancement
New value added to drive a business result
Team:Threat Hunting:Investigations
Security Solution Investigations Team
In lieu of the work necessary to provide full session information for a given alert, we would like to add the
process.entry_leader.entity_id
field to the highlighted fields table in the alert flyout to provide users with related alerts based on that session id which they can then investigate upon in timeline.The text was updated successfully, but these errors were encountered: