Splunk Enterprise Security - Notable limit

astatrial — Mon, 31 May 2021 14:57:53 GMT

Hi all,

I have Splunk ES, with a bunch of rules.

The issue is that correlation rules generate notables for each result, which sometimes cause to a flood of notable alerts. In cases when a new wide and legitimate activity is detected (and wasn't excluded yet from the rule), tons of alerts are being created.

I look for a way to limit the number of notables alerts that each rule can generate, but to do it general, for all the rules, without manually modifying each rule.

Is this possible?

Example:

Name of rule: Test rule

Number of results: 500

Notable alerts: 20

Thanks

topic Splunk Enterprise Security - Notable limit in Security

Splunk Enterprise Security - Notable limit