If you want index to be included as a field in the incident itself, you could add "index" as an incident review event attribute. Configure > Incident Management > Incident Review Settings > Incident Review - Event Attributes For this to work you would also have to make sure that the index field is included in the output of your correlation searches as well. This would require edits to a lot of the out-of-the-box correlation searches that use the tstats command on data models. ... View more

Hey! There is a dashboard for all your threat artifacts in Security Intelligence -> Threat Intelligence -> Threat Artifacts   ... View more

Yes, now you should have the buttons for Introspection back and there is a button in the popup menu, that says "Reset all Configurations". Hit it and afterwards it should be fine again. ... View more