Tracking change history on Incidents in ES App

[coolwater77]

I am trying to understand if I can track changes related to the incidents managed by the ES App.Below are my requirements

For Example, lets say the correlation search generates an incident in the incident review dashboard with the title of the incident as " Root login Failed" and automatically assigns the ticket to a security analyst automatically as configured on the correlation search rule. As part of the investigation if the analyst thinks this is not a "Root login Failed" incident but a " excessive failed login" can he manually change the title of the incident that was automatically generated with a different title. And also how can someone track these changes to monitor who and what has changed?

Also, similar can it also be done on the Splunk core App as well.

[LukeMurphey]

All of the changes to incidents are retained in the Incident Review lookup file as well as in audit logs. To view the history, find the event on the Incident Review page, click "view details" and then click "View all review activity for this Notable Event".

That said, I don't believe that Incident Review allows changing of the title yet (perhaps I am misunderstanding).

[coolwater77]

I think you understood it right . I am just trying to figure out if one can change the title manually later and if so how to track those modifications

[LukeMurphey]

@coolwater77: BTW: adding the ability to change the title of incidents sounds like a good idea. Feel free to submit an enhancement request; I think this could be added relatively easily in a future release.