Whow acknowledged alert

[GyciakasGh0st]

The indexes .ds-logs-detections.alerts-so*

Has field event.acknowledged it show if alert was acknowledged or not .

But we can't find which will show which user acknowledged Alert. Maybe where is seperate index for that ?

[cm-ops]

You would need to find the acknowleded event in the SOC logs and find the identity_id Then Hunt on that to get the username in the kratos.audit log.

[GyciakasGh0st]

Maybe can more specific for example i acknowlaged alert with soc_id dhammJsB6Unf0n_Ml8Wx i greped throw all logs no matches

[cm-ops]

It's a manual process in the SOC GUI. In Alerts you need to find the field identity_id then pivor to Hunt and use the kratos.audit logs to find the user.

[jertel]

I've created a feature request to make this easier to lookup. We'll see about including it in an upcoming release.

#15373