Alert 'Event Details' changing over time

[Kate_M]

Description	Alerts may be observed to have different “Event Details” when viewed in the platform at different time points. This can also occur when comparing the current Event Details in the console with the details received for that alert via an Alert Channel notification (such as email or JIRA).
Scope	Lacework Console, Lacework Alert Channel integrations.
Solution	This behaviour is a benign side effect of a new feature providing near-to-real-time alerting. A key component of near-to-real-time alerting is that for up to an hour after the alert was generated, certain alert types can be appended with newly relevant event data. This in turn can cause the values in the Alert summary fields to appear to have changed. Any notification that was sent to a configured Alert Channel would still show the original summary data in the “Event Details”. No remediation action needs to be taken if observing this behaviour Alerts that are still in progress will be denoted by the "Evolving" tag until that hour has concluded Full event details can be found by scrolling down to the "Where" section of the alert Example:  Alert Notification received in Slack about IP 71.6.146.186 However, after opening the Alert in the Lacework console a different IP 43.134.227.248 is highlighted