I was in the middle of a security incident when I had to remove a user account. That account had set comments / attachments on the stages of said security incident. After removal of user account, the attachments still remained with ‘Unknown User’ but any comments / notes disappeared completely. Is this the normal function? It seems to me that notes / comments should always be visible so we do not lose any insight, even if we cannot see the name of the account that posted. I am using SAML authentication if that makes a difference.
This was the first incident I created and was still active, not sure if archival of an incident would make a difference, but steps to reprodue:
- Open Security Incident
- Add comments / attachments to stages
- Remove user account that made comments / uploaded attachments
- Attachments still remain with ‘Unknown User’ but comments are no longer available.
App Version
3.21.1
DB Schema Version
20230712135759
Community Edition (on prem)