[BUG] Audit trail for alert ignore

[zpriddy]

Request Type

Bug

Work Environment

Question	Answer
TheHive version / git hash	3.1

Problem Description

When an alert is marked as ignored there is no audit log of it being marked ignored there is just update of alert and if you expand the details the status change is not part of those details. However when i just mark an alert as read then unread - I see no audit log of that.

These logs would be important to know who marked alerts as read and ignored them.

Steps to Reproduce

1. Generate Alert
2. Mark alert as read
3. Look at audit log
4. Mark alert as unread
5. Look at audit log

[zpriddy]

So in looking into other issues, I found that if you do an audit search for the user, and not the sourceRef of the Alert, you can see that the user updated the status of an alert to Ignore or New but you cant see what alert the action was taken on.. (only the Title)

[nadouani]

Looks like the steps to reproduce show that this works: I've marked as case as read, and then marked it as unread:

[nadouani]

So in looking into other issues, I found that if you do an audit search for the user, and not the sourceRef of the Alert, you can see that the user updated the status of an alert to Ignore or New but you cant see what alert the action was taken on.. (only the Title)

What details you need us to add ?

[zpriddy]

So it would be nice to have the source ref in the audit log. Sometimes we get alerts with the same titles and im sure this is pretty common.

[nadouani]

This should be fine I guess?