How do you add a custom field to the Incident Review dashboard in ES 3.0? I found a solution for 2.4, but does not seem to carry over to 3.0.
Figured this out - edit the incident_settings located at /SA-ThreatIntelligence/alerts/log_review/incident_review
Figured this out - edit the incident_settings located at /SA-ThreatIntelligence/alerts/log_review/incident_review
i am not able to find this alerts directory under this SA-ThreatIntelligence application. any thoughts??