topic Re: Incident Review dashboard has no value in Getting Data In

Incident Review dashboard has no value

blank — Thu, 16 May 2024 05:52:29 GMT

Incident review dashboard is displaying no value, despite having correlation searches enabled. Upon investigation, I noticed that the notable index has 0 bytes.

Could someone kindly guide me on how to troubleshoot this issue? Thanks!

Re: Incident Review dashboard has no value

gcusello — Thu, 16 May 2024 07:02:17 GMT

Hi @blank ,

some very stupid questions:

did you enabled Notables as Adaptive Response actions for you Correlation Searches?

are any Correlation Searches triggered?

Ciao.

Giuseppe

Re: Incident Review dashboard has no value

blank — Thu, 16 May 2024 07:34:50 GMT

Hi @gcusello

Yes, I enabled notables as adaptive response actions for my CS. I tried checking the incident review dashboard and run search queries, but the output is 0.