topic How to create notable manually with selected timestamp? in Splunk Enterprise Security

How to create notable manually with selected timestamp?

bluewizard — Tue, 30 May 2023 14:20:32 GMT

| stats count | eval _time="1685158808" | eval rule_title="Test notable" | eval security_domain="Network" | eval urgency="Medium" | eval rule_name="Test rule" | eval dest="8.8.8.8" | eval src="1.1.1" | eval desc="Please investigate firewall log, and action" | sendalert notable param.mapfields=_time,desc,rule_id,rule_name,nes_fields,drilldown_name,drilldown_search,governance,control,default_owner,drilldown_earliest_offset,drilldown_latest_offset,next_steps,investigation_profiles,extract_artifacts,recommended_actions

Is it possible to use a timestamp to change the notable creation date time? it is creating notable everytime i hit search with the above query.`

Additionally how do i move my description from below to the above description?

Re: Create notable manually with selected timestamp

bluewizard — Tue, 30 May 2023 06:15:51 GMT

is this technically possible, or everytime i run sendalert notable it will create a notable with time now?

Re: How to create notable manually with selected timestamp?

meetmshah — Tue, 18 Jul 2023 06:38:37 GMT

AFAIK, The notable time is the time when the event gets triggered and indexed (and not _time from the events). However, I have heard that there is a feature in the upcoming version of ES where we can select notable time.

Re: How to create notable manually with selected timestamp?

johnlee2327 — Wed, 23 Oct 2024 04:02:17 GMT

You can use "rule_description" as the field for the above description.