topic Re: Assign custom urgency to notables in Getting Data In

Assign custom urgency to notables

arunkuriakose — Mon, 10 Feb 2025 05:37:01 GMT

Hi team

I have been working on assigning a custom urgency level to all notables triggered through our correlation searches using (ES). Specifically, I aimed to set the severity to "high" by adding eval severity=high in each relevant search. However, despite implementing this change, some of the notables are still being categorized as "medium."

Could you please assist with identifying what might be causing this discrepancy and suggest any additional steps required to ensure all triggered notables reflect the intended high urgency level?

Thank you for your assistance

Re: Assign custom urgency to notables

livehybrid — Mon, 10 Feb 2025 10:00:06 GMT

Hi @arunkuriakose

Ensure that the severity is not being overwritten by any other SPL or macros within your search, as sometimes macros within ES can contain a lot of logic and may by overwriting your custom severity. It might help if you could share you search here.

When you look at the raw notables generated, is the severity showing as high or medium? (Not just in the UI/ES Dashboards)

Re: Assign custom urgency to notables

arunkuriakose — Mon, 10 Feb 2025 10:18:12 GMT

Hi @livehybrid

Thanks for the response

| tstats summariesonly=true values(All_Traffic.dest) as dest dc(All_Traffic.dest) as count from datamodel=Network_Traffic where All_Traffic.dest_port!="443" All_Traffic.dest_port!="80" All_Traffic.src_ip!="*:*" All_Traffic.src_ip!="5.195.243.8" ```cpx PT IP``` by All_Traffic.src_ip All_Traffic.dest_port
| rename All_Traffic.src_ip as src All_Traffic.dest_port as dest_port
| search NOT
[| inputlookup internalip] | where count>=20 |
iplocation src |
| eval severity="high"

this is how one of the usecase looks like and recent notables have the urgency as below

when i check index-notable for this alert severity is showing as high

Re: Assign custom urgency to notables

livehybrid — Mon, 10 Feb 2025 11:51:46 GMT

Hmm that is odd. So you are seeing both Medium and High being created?
Please can you double check that there isnt a search running with the same rule name that could be creating the Medium severity alerts?

In the past when I have cloned ESCU searches for example I have accidently left the original searches enabled and end up creating notables from them too!