Skip to content

FE: Change the status of a specific Alert

Why are we doing this work

In order to triage alerts, a security operations engineer or a security analyst must be able to change the status of an Alert.

With the addition of !51417 (merged) our Alerts Dashboard & Alert Details page will have the following functionality:

  • create the details page which can be shared so users can go straight to an alert,
  • allow for todos to be created,
  • allow incidents to be created,
  • let alerts be assigned

Changing the alert status on the details page was not be included as there was extra work that needed to be done around changing the statuses to match the threat monitoring alert list page (i.e. the operations page uses different alerts than threat monitoring and we mapped them).

Allowing for the alert status to be changed in the details page is my next task.

Relevant links

Design: Based on this discussion, we determined that adding a details page example would be a faster approach than creating a drawer with a link to it.

Non-functional requirements

  • Documentation:
  • Feature flag:
  • Performance:
  • Testing:

Implementation plan

Edited by Lindsay Kerr