[FEATURE] - Include user id/username that acknowledges an alert.

[givilleneuve]

Is your feature request related to a problem?
Yes, in any large SOC team, traceability and audit of who is acknowledging an alert is always required. Unfortunately, I have not been able to identify anywhere this information is being recorded in the OS cluster.
I have looked into the security-audit-log as well as the .opensearch-sap-logtype-alerts and alert history. I have the timestamp of when it was ack but not by who.

What solution would you like?
The solution should index a new field in the log entry for the alert adding also the user.name.ack.

What alternatives have you considered?
I tried to find in the security log index to correlate, but no success.

[krisfreedain]

[Catch All Triage - 1, 2, 3, 4, 5]