Description
Alerting v2 introduces actor attribution on the alert episode details page in Kibana — surfacing who performed key response actions on an episode.
What: PR elastic/kibana#265473 adds an "Actions Overview" section to the episode details page. Alongside the episode's Assignee, it now displays the actor (the user who performed the action) for the most recent:
- Acknowledged by — the user who acknowledged the episode (
ack action)
- Resolved by — the user who resolved/deactivated the episode (
resolve action)
- Snoozed by — the user who snoozed the episode, shown together with the Snoozed until time (
snooze action)
Each entry renders as a user avatar + display name (full name → username), resolved from the user's profile. System-generated actions display as "System." These rows only appear when the episode is in the corresponding state (acknowledged, resolved, or snoozed).
Note on terminology (important for docs): an actor (who performed an action) is distinct from an assignee (who the episode is assigned to). For an assignment, the actor is the person who made the assignment, while the assignee is the person it was assigned to. Docs should keep this distinction clear.
Why: This gives responders accountability and audit context directly on the episode details page — at a glance you can see who acknowledged, resolved, or snoozed an alert episode without inspecting the raw action history.
User-facing UI to document:
- The Actions Overview section on the alerting v2 episode details page (Acknowledged by / Resolved by / Snoozed by, with actor avatars and "Snoozed until").
- How these rows relate to the episode Assignee field (distinct concepts).
Scope / caveat for triage: Alerting v2 is a new framework that ships behind an advanced setting (feature toggle) and is not yet the default alerting experience. Docs coverage should be scoped/gated accordingly — please confirm current availability and preview status with the ResponseOps team before publishing.
Resources
- This feature was implemented in elastic/kibana#265473 ("[Alerting V2] Display actors in the episode details page").
- It closes the scoping issue elastic/kibana#265267.
- Related alerting v2 UI work for additional context: episode details page #260942 and the episode event-log timeline #271382 (the timeline also attributes each action to its actor).
- Owning team:
@elastic/response-ops (Team:ResponseOps). PR is labeled av2-docs-needed.
Which deployment methods does this change impact?
Elastic On-Prem and Cloud (all)
Feature differences
The Actions Overview / actor attribution UI is expected to be identical across deployment methods. Availability of alerting v2 itself may differ by deployment and is gated behind an advanced setting — please confirm with the ResponseOps team during triage.
What Elastic Stack release is this request related to?
9.5 (PR is labeled v9.5.0)
Serverless release
TBD — confirm with the ResponseOps team.
Collaboration model
The documentation team will create the first draft.
Point of contact.
Main contact: @adcoelho
Stakeholders: @elastic/response-ops
Description
Alerting v2 introduces actor attribution on the alert episode details page in Kibana — surfacing who performed key response actions on an episode.
What: PR elastic/kibana#265473 adds an "Actions Overview" section to the episode details page. Alongside the episode's Assignee, it now displays the actor (the user who performed the action) for the most recent:
ackaction)resolveaction)snoozeaction)Each entry renders as a user avatar + display name (full name → username), resolved from the user's profile. System-generated actions display as "System." These rows only appear when the episode is in the corresponding state (acknowledged, resolved, or snoozed).
Note on terminology (important for docs): an actor (who performed an action) is distinct from an assignee (who the episode is assigned to). For an assignment, the actor is the person who made the assignment, while the assignee is the person it was assigned to. Docs should keep this distinction clear.
Why: This gives responders accountability and audit context directly on the episode details page — at a glance you can see who acknowledged, resolved, or snoozed an alert episode without inspecting the raw action history.
User-facing UI to document:
Scope / caveat for triage: Alerting v2 is a new framework that ships behind an advanced setting (feature toggle) and is not yet the default alerting experience. Docs coverage should be scoped/gated accordingly — please confirm current availability and preview status with the ResponseOps team before publishing.
Resources
@elastic/response-ops(Team:ResponseOps). PR is labeledav2-docs-needed.Which deployment methods does this change impact?
Elastic On-Prem and Cloud (all)
Feature differences
The Actions Overview / actor attribution UI is expected to be identical across deployment methods. Availability of alerting v2 itself may differ by deployment and is gated behind an advanced setting — please confirm with the ResponseOps team during triage.
What Elastic Stack release is this request related to?
9.5 (PR is labeled
v9.5.0)Serverless release
TBD — confirm with the ResponseOps team.
Collaboration model
The documentation team will create the first draft.
Point of contact.
Main contact: @adcoelho
Stakeholders: @elastic/response-ops