Information about Case in Alert Table

[emma-raffenne]

Description

When viewing alerts, need to understand if an alert is being worked on.

On the alerts table, I would like for each alert/row to understand if it's being investigated. We can simplify and say "alert being worked on = a case or and external incident is associated with this alert".

More info at the product issue elastic/observability-product#67

Implementation

• [RAC] Add columns for Case ID and External Incident to Alerts table #114378
• [RAC] Add external/related/associated Case IDs and 3rd party incidence link #115808

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[emma-raffenne]

@XavierM and @cnasikas Please can you weigh in? thanks

[cnasikas]

Hi @emma-raffenne!

Both of the issues are not trivial to implement and each one has its own engineering challenges. We need to discuss it with the team, understand the requirements and the effort the features need, and prioritize accordingly.

cc @kobelb

[elasticmachine]

Pinging @elastic/response-ops-cases (Feature:Cases)

[cnasikas]

@emma-raffenne In #146864 we added the cases column to the alerts table.

[katrin-freihofner]

I think the only thing missing is to show the case column by default (if cases are used).

[cnasikas]

@katrin-freihofner We thought that the o11y did not want to show the Cases column by default. Is it something would you like to support in o11y? cc @XavierM

[XavierM]

Hey my bad here!, I thought that you did not want to have the case columns by default but if users have cases then we show the case column per default. that make sense!

By the way if the user decide to display the case column, it will stay on the alert table even if you refresh/reload page.

[cnasikas]

Thanks @katrin-freihofner and @XavierM. I opened an issue here to track it #156956. Feel free to close this issue.