search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.49k stars 8.05k forks source link

Kibana Security Alerts - Assigning multiple (>100) alerts to a user at once #183889

Open willem-dhaese opened 1 month ago

willem-dhaese commented 1 month ago

See https://discuss.elastic.co/t/alert-triage-enhancement-ideas/359602

Currently, we can't assign more than 100 alerts to a user at a time. When we click "Select all alerts," the "assign to user" option gets greyed out. This can be a bit frustrating when dealing with a large number of alerts. It would be great if this limit could be increased or removed altogether.

image

@yctercero @Kseniiaign

"Team:Detection Engine" "Team:Detections and Resp"

elasticmachine commented 1 month ago

Pinging @elastic/security-detection-engine (Team:Detection Engine)

willem-dhaese commented 1 month ago

Nice to meet you in GH @approksiu 😃 It was with you I had a drink in Prague together with @MikePaquette right?

elasticmachine commented 1 month ago

Pinging @elastic/security-detections-response (Team:Detections and Resp)

yctercero commented 1 month ago

@approksiu this is a UI limitation we have for all bulk actions where we limit the number to however many rules are being shown (so say you select to show 5, 25, or 100) rules per page, that's what the max will be. We prevent bulk actions when a user selects Select all on rules which could number 1000+.

@elastic/security-detection-rule-management have there been any considerations to increase the limit?

@willem-dhaese confirmed with @e40pud that this limitation does not exist on the API.

willemdh commented 1 month ago

Maybe adding a 250 select option is doable?