ES: Why does my new search not appear in the "Saved Search Name" on the "Incident Review" screen?

[woodcock]

I created a new correlation search like I have many times before but this time when it fires on the Security Posture screen, and I click to the Incident Review page, tie Saved Search Name field is blank and this search name does not appear in the list so I cannot manually select it either. What could be the problem?

[woodcock · Accepted solution]

This field must be set action.correlationsearch.label.