Enterprise Security 3.0 - Customize Incident Review Fields

[panovattack]

How do you add a custom field to the Incident Review dashboard in ES 3.0? I found a solution for 2.4, but does not seem to carry over to 3.0.

[panovattack · Accepted solution]

Figured this out - edit the incident_settings located at /SA-ThreatIntelligence/alerts/log_review/incident_review

[japala]

i am not able to find this alerts directory under this SA-ThreatIntelligence application. any thoughts??