Replies: 1 comment 4 replies
-
|
Hi, After update to 4.9 we have observed the same behaviour, for us this feature was fundamental in order to debug the alerts ... It's a bug? |
Beta Was this translation helpful? Give feedback.
-
|
I think it's due to a major re-design of the interface and will probably be fixed. But I found a workaround on this, even if it's much slower than before. If you click on any of the records in threat hunting, the right pane opens. Click on "View surrounding documents" and another apge opens up. Here, in the list of events, you can click on the arrow to the right of the timestamp and it shows again all the elements where you can add the filters... it's much slower, but at least you can keep hunting for threats in the meantime.
|
Beta Was this translation helpful? Give feedback.
-
|
Ok, that's right I see that workaround but it is not practical. The advantage of the event part was precisely the ease of organizing the columns, in this new way it is very confusing ... but is it a bug? |
Beta Was this translation helpful? Give feedback.
-
|
You can still use the older discover page by toggling the New Discover (on/off).
|
Beta Was this translation helpful? Give feedback.
-
|
Ok, thanks, but this option it's only available in Discover ... |
Beta Was this translation helpful? Give feedback.
-
Not sure if this is the right place, eventually it will just not go further.
We've recently deployed a 4.9 version, and it appears to be working smoothly from data collection point of view, no major issues with it.
The dashboard looks very neat, but it has a really relevant downgrade when it comes to events drilling: in 4.8 version, each event row allowed you to zoom/filter out results for a given rule. In 4.9 this features is completely gone: clicking on an event row just shows the detail, and if you want to filter that out, you have to do it manually. As I said, it seems like a major downgrade from the previous features when hunting for events.
Is this going to be solved any time soon?
Apologies if I posted in the wrong place, but couldn't really find other ideas on where to ask for this.
Beta Was this translation helpful? Give feedback.
All reactions