topic Splunk ES Incident Creation in Splunk Enterprise Security

Splunk ES Incident Creation

KKuser — Tue, 11 Feb 2025 20:41:00 GMT

In Securonix's SIEM, we can manually create cases through Spotter by generating an alert and then transferring those results into an actual incident on the board. Is it possible to do something similar in Splunk? Specifically, I have a threat hunting report that I've completed, and I'd like to document it in an incident, similar to how it's done in Securonix.

The goal is to extract a query from the search results, create an incident, and generate a case ID to help track the report. Is there a way to accomplish this in Splunk so that it can be added to the incident review board for documentation and tracking purposes?

Re: Splunk ES Incident Creation

meetmshah — Wed, 12 Feb 2025 07:28:16 GMT

Hello @KKuser Have you tried adding the events in the Investigation? - https://docs.splunk.com/Documentation/ES/8.0.2/User/StartInvestigation

You can add multiple notable events in Investigation and write down notes as well. Also, if you want to create Notable events from any raw event, you can simply click on Edit Event and Create Notable event right from the search.

Please let me know if you have any questions on the same.

Re: Splunk ES Incident Creation

KKuser — Thu, 20 Feb 2025 03:08:15 GMT

I added the notables to an investigation and was able to add notes as well. However, I'm trying to have an incident number for the incident so that I can use it for tracking purpose.

I recently learnt that Splunk ES version 8 provides an incident number along with the investigation we create. I should test this out first, because I'm using Splunk ES version 5.

Correct me if I'm wrong. Thanks for your assistance!