[Cases] Unlink alerts from a case #140800
Labels
Feature:Cases
Cases feature
Team:ResponseOps
Label for the ResponseOps team (formerly the Cases and Alerting teams)
Comments
cnasikas
added
Team:ResponseOps
|
Pinging @elastic/response-ops (Team:ResponseOps) |
|
Pinging @elastic/response-ops-cases (Feature:Cases) |
This was referenced Nov 4, 2022
This was referenced Mar 30, 2023
cnasikas
added a commit
that referenced
this issue
Apr 1, 2023
#154024) ## Summary Users can remove alerts from a case by deleting the whole alert attachment. This PR removes the case id from the alerts when deleting an attachment of type alert. It does not remove the case info from all alerts attached to a case when deleting a case. It also fixes a bug where the success toaster will not show when deleting an attachment. Related: #146864, #140800 ## Testing 1. Create a case and attach some alerts to the case. 2. Verify that the alerts table (in security or in o11y) shows the case the alert is attached to. You can enable the cases column by pressing "Fields", searching for "Cases", and then selecting the field. 3. Go to the case and find the alerts' user activity. 4. Press the `...` and press "Remove alerts(s)" 5. Go back to the alert table and verify that the case is not shown in the Cases column for each alert. Please check that when you remove alert(s), attachments (ml, etc), and comments you get a success toaster with the correct text. ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Cases support the attachment of alerts to a case. If you attach alerts to a case you cannot unlink them. We should allow the users to delete/unlink alerts from a case.
Tasks
The text was updated successfully, but these errors were encountered: