Good afternoon, I hope you are well. I am migrating my alert environment from TheHive to start using ES. I would like to know and learn if, in ES, when creating Correlations, I can configure a field in the notable event that analysts can edit. For example, when creating cases in TheHive, I include the desired field, and analysts set the value when they take the case for processing. Despite studying, I couldn't figure out how to implement this in a notable event so that analysts can provide inputs such as identifying the technology involved or deciding whether it should be forwarded. This would help me use it for auditing purposes later on. Is it possible to achieve this in ES?
... View more