search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.6k stars 8.21k forks source link

[ResponseOps][Cases] The updated timestamp of the alert is not updated when synching alerts with cases #192252

Open cnasikas opened 1 month ago

cnasikas commented 1 month ago

Cases in Security solution can sync the case status with the alerts attached to the case workflow status. This happens only if the Sync alerts toggle is on. However the kibana.alert.workflow_status_updated_at is not updated along with the kibana.alert.workflow_status. This can lead to misleading MTTR metrics. We should update the kibana.alert.workflow_status_updated_at when updating the kibana.alert.workflow_status in https://github.com/elastic/kibana/blob/2221ff8b5593c0f9e34737abe9ef256fbe17b88b/x-pack/plugins/cases/server/services/alerts/index.ts. Security solution code for updating the field: https://github.com/elastic/kibana/blob/17eb2c894ea6c6a3c9dd8124395bf4fc295d26d9/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/open_close_signals_route.ts

elasticmachine commented 1 month ago

Pinging @elastic/response-ops-cases (Feature:Cases)

elasticmachine commented 1 month ago

Pinging @elastic/response-ops (Team:ResponseOps)