We're trying to customize the Meantime to Triage and Meantime to Resolution queries in the ES Executivity Summary dashboard to filter for specific urgency or rule names. We previously were using the stand alone Mission Control app before it was integrated into Enterprise Security.
Reviewing the incident_updates_lookup table, it seemed to have stopped updating both "urgency" and "rule_name" around the time we migrated into Enterprise Security's Mission Control. We can see old entries prior to that, but more recent ones are very infrequent.
Anyone know how to resolve this or know of another way to filter?
