Feature Request - Command Appliance Open Data Stream (ODS)

We have multiple EDA units deployed, so we run an ECA to manage them all.
We also have Slack and want to integrate slack alerting.

the slack integration is easy, the problem is the ODS only exists on the EDA units, so clicking the link in the alert takes you to an individual EDA. we don’t allow our users to access the EDA units directly, only the ECA, and any alerts cleared on an individual EDA does not get reflected on the ECA.

As a workaround, when an alert is triggered, we have a generic link that takes you to the ECA, instead of directly to the actual alert.

Hi Callum; thanks for the question. Is your ODS call firing on DETECTION_UPDATE or ALERT_RECORD_COMMIT today?