Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution][Investigations] - Add session field to highlighted fields table #131943

Closed
michaelolo24 opened this issue May 10, 2022 · 3 comments
Labels
8.3 candidate enhancement New value added to drive a business result Team:Threat Hunting:Investigations Security Solution Investigations Team

Comments

@michaelolo24
Copy link
Contributor

In lieu of the work necessary to provide full session information for a given alert, we would like to add the process.entry_leader.entity_id field to the highlighted fields table in the alert flyout to provide users with related alerts based on that session id which they can then investigate upon in timeline.

@michaelolo24 michaelolo24 added enhancement New value added to drive a business result Team:Threat Hunting:Investigations Security Solution Investigations Team 8.3 candidate labels May 10, 2022
@janmonschke
Copy link
Contributor

Screenshot 2022-05-11 at 15 25 13

This is what it would look like @paulewing. I remember you wanted to potentially add a different label to the entry leader row.

@PhilippeOberti
Copy link
Contributor

@michaelolo24 is ticket still relevant, now that we have custom highlighted fields? I feel like we might be able to close it?

@michaelolo24
Copy link
Contributor Author

yea, the work was completed actually....closing

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
8.3 candidate enhancement New value added to drive a business result Team:Threat Hunting:Investigations Security Solution Investigations Team
Projects
None yet
Development

No branches or pull requests

3 participants