topic Correlation search not showing notable in Incident Review? in Splunk Enterprise Security

Correlation search not showing notable in Incident Review?

muradgh — Mon, 13 Feb 2023 17:13:42 GMT

Hi Splunkers.

I have noticed a strange behavior from Splunk, I have a correlation search that I have created a while ago, ensured to select "Notable" under the Adaptive Responsive section so that it creates a notable, also tested that when I run the search manually it produced results. BUT it does not generate notables in the Incident Review dashboard!

So I went and searched index=notable and found 4 events for this correlation search in the last 30 days!
Then I checked the same index for another correlation search that DOES generate notables in the Incident Review dashboard (4 notables in the last 30 days) and indeed I found 4 events in the notable index!

I also used the "Correlation Search Audit" app (https://splunkbase.splunk.com/app/4144) and Indeed this app shows that this correlation search has been triggered 4 times in the last 30 days!

The search does not have any lookups (In case you asked about the permissions of the lookups).
The search does use the Web data model (and it has Global permissions).

I'm using the admin user so I have sufficient privileges.

I'm using:
Splunk Enterprise version: 8.1.0
Enterprise Security version: 6.2.0
OS: Red Hat Enterprise Linux Server 7.7 (Maipo)

Any Idea why this is happening?

Re: Correlation search not showing notable in Incident Review

richgalloway — Mon, 13 Feb 2023 13:15:07 GMT

Perhaps the NE is being suppressed. Check by going to Configure->Incident Management->Notable Event Suppressions

Re: Correlation search not showing notable in Incident Review

muradgh — Mon, 13 Feb 2023 13:23:41 GMT

I have checked but nope, it's not suppressed

Re: Correlation search not showing notable in Incident Review

neerajs_81 — Mon, 13 Feb 2023 13:24:09 GMT

What you are describing happens when the correlation rule is suppressed. Did you check the suppression page for this alert ?
Secondly when you ran the search manually , did it produce results in a tabular format ? Typically correlation search results are in a tabular format.

P.S Pls upvote if this helps.

Re: Correlation search not showing notable in Incident Review

muradgh — Mon, 13 Feb 2023 13:26:31 GMT

I have checked but nope, it's not suppressed.
And yes the search produces results in a tabular format