| stats count
| eval _time="1685158808"
| eval rule_title="Test notable"
| eval security_domain="Network"
| eval urgency="Medium"
| eval rule_name="Test rule"
| eval dest="188.8.131.52"
| eval src="1.1.1"
| eval desc="Please investigate firewall log, and action"
| sendalert notable param.mapfields=_time,desc,rule_id,rule_name,nes_fields,drilldown_name,drilldown_search,governance,control,default_owner,drilldown_earliest_offset,drilldown_latest_offset,next_steps,investigation_profiles,extract_artifacts,recommended_actions
Is it possible to use a timestamp to change the notable creation date time? it is creating notable everytime i hit search with the above query.`
Additionally how do i move my description from below to the above description?
AFAIK, The notable time is the time when the event gets triggered and indexed (and not _time from the events). However, I have heard that there is a feature in the upcoming version of ES where we can select notable time.
is this technically possible, or everytime i run sendalert notable it will create a notable with time now?