Assign SIEM Signals to a user

[Bananenbrei]

Describe the feature:
When a User changes the status of a SIEM Signal from "open" to "in progress" or "closed" there should be information within the signal to show who did this. An option to filter Signals based on assigned users would also be great.

Describe a specific use case for the feature:
Multiple Analysts work on one SIEM and they start marking Signals as "in progress" - this can get messy depending on the amount of signals

An analyst sets a signal marked as "in progress" and then forgot about it. It is now open for 2 weeks+ and you are unable to tell who is at fault here. If such a feature would exist the Analyst could see what Signals are assigned to him.

Forum Thread where I made the same request for reference:
https://discuss.elastic.co/t/feature-request-alert-assignment-to-user/247095

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[austinsonger]

Yes if this was a feature it would get closer to a tool where we wouldn't have to create a tickets in another help desk tool.

[chrislujan]

Agreed, having analysts assigned on rotation would be nice to have.

[the-pixel-hunter]

please add this

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[yctercero]

This was implemented in 8.12!