https://community.splunk.com/t5/Splunk-Enterprise-Security/Noteable-Event-Supression/m-p/693682#M12021 <P>Thanks, I wanted to avid that as I would need to updated a lot of correlation searches.&nbsp; Any idea why this isn'g possible as the search looks like standard SPL?</P> Thu, 18 Jul 2024 07:58:07 GMT Rhidian 2024-07-18T07:58:07Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Noteable-Event-Supression/m-p/693609#M12017 <P>Is it possible to use a lookup file in the Noteble Event supression say to look up a list of assets/enviroments that we do/don't want to know about?</P><P>&nbsp;</P> Wed, 17 Jul 2024 12:53:46 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Noteable-Event-Supression/m-p/693609#M12017 Rhidian 2024-07-17T12:53:46Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Noteable-Event-Supression/m-p/693646#M12019 <P>When you talk about Notable event suppression, I assume you are talking about the Notable Event Suppression action in the Incident Review.</P><P>If you want to whitelist/blacklist certain assets, then you should add the lookup logic to the correlation search that has caused the notable event in the first place.</P><P>You cannot add lookup logic to the event type search ES creates for the suppression logic.</P> Wed, 17 Jul 2024 22:41:50 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Noteable-Event-Supression/m-p/693646#M12019 bowesmana 2024-07-17T22:41:50Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Noteable-Event-Supression/m-p/693650#M12020 <P>Last month we were working on a Splunk ES Demo and i found out that we can not delete a notable.</P><P>either i have not understood the ES yet or the ES developers are really funny, lol !&nbsp;</P> Thu, 18 Jul 2024 01:40:59 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Noteable-Event-Supression/m-p/693650#M12020 inventsekar 2024-07-18T01:40:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Noteable-Event-Supression/m-p/693682#M12021 <P>Thanks, I wanted to avid that as I would need to updated a lot of correlation searches.&nbsp; Any idea why this isn'g possible as the search looks like standard SPL?</P> Thu, 18 Jul 2024 07:58:07 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Noteable-Event-Supression/m-p/693682#M12021 Rhidian 2024-07-18T07:58:07Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Noteable-Event-Supression/m-p/693810#M12022 <P>Unfortunately event type searches cannot contain any pipelines, so it has to be simply a raw search fragment</P><P>&nbsp;</P> Fri, 19 Jul 2024 00:40:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Noteable-Event-Supression/m-p/693810#M12022 bowesmana 2024-07-19T00:40:22Z