Dynamically populate description of an incident

[mergene]

Hi, 

Is it possible to populate the description of an incident dynamically? For example, I have an analytic rule which detects if an account is added to a specific group. I would like to populate the incident description as below:

"user XYZ has added user ABC to the domain group GRP01". 

Here, the XYZ, ABC, and GRP01 is extracted from the query result (SubjectUserName, MemberName, TargetUserName. This would make the incidents more easy to understand by analysts at first glance, without having to investigate evidence events. Also, when integrating with a ticketing system, the dynamically populated description would be more useful for incident handlers. 

[#2 · Accepted solution]

@mergene This is not currently possible, however we are working on such a feature.

[#3]

Thanks Ofer! Looking forward to it!