-
Notifications
You must be signed in to change notification settings - Fork 8.5k
Closed
Labels
QA:ValidatedIssue has been validated by QAIssue has been validated by QATeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:CasesSecurity Solution Cases teamSecurity Solution Cases teambugFixes for quality problems that affect the customer experienceFixes for quality problems that affect the customer experiencefixedimpact:mediumAddressing this issue will have a medium level of impact on the quality/strength of our product.Addressing this issue will have a medium level of impact on the quality/strength of our product.
Milestone
Description
Describe the bug:
In cases document, when attaching alerts and events, total_alert is updated correctly, while total_event remains 0
A case showing 2 alerts, 3 events and 1 comment in all casespage
In .kibana_alerting_cases, the document shows 2 alerts, 0 events and 1 comment

Kibana/Elasticsearch Stack version:
9.3/main
Functional Area (e.g. Endpoint management, timelines, resolver, etc.):
Cases
Steps to reproduce:
- Create a case and attach some alerts and events
- Go to Discover, create a data view called Cases, with pattern
.kibana_alerting_cases* - Find the cases row
total_eventsshow 0 despite having events
Current behavior:
total_event does not update as number of attachments go up
Expected behavior:
total_event should reflect correct numbers
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
QA:ValidatedIssue has been validated by QAIssue has been validated by QATeam: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:CasesSecurity Solution Cases teamSecurity Solution Cases teambugFixes for quality problems that affect the customer experienceFixes for quality problems that affect the customer experiencefixedimpact:mediumAddressing this issue will have a medium level of impact on the quality/strength of our product.Addressing this issue will have a medium level of impact on the quality/strength of our product.
Type
Fields
Give feedbackNo fields configured for Bug.