Has anyone found a way to query the SIEM’s “audit logs” to retrieve the priority? Critical/High/Medium/Low. Everything else is there such as disposition. I want to make a dashboard widget. Doesn’t make sense that priority isn’t in there.
Hi,
the audit log is only written to in the event of a change or action. Such as if you were to change the priority of a given alert. Other than that it is not available.
One possible option would be to query the investigation/alert API and feed the output to logsearch as an event source (by tailing the output file from the script) and then build a dashboard against that data. Granted it isn’t a staight-forward workaround
Davod