topic Re: Splunk Enterprise Security 8.0 in Splunk Enterprise Security

Splunk Enterprise Security 8.0

Fara7at08 — Thu, 13 Feb 2025 18:09:12 GMT

when i upgrade ES to 8.0.2 i missed the "Short ID " button in the Additional Field, also i can't search about the case id instead of time

Re: Splunk Enterprise Security 8.0

kiran_panchavat — Fri, 14 Feb 2025 05:23:31 GMT

@Fara7at08

The "Short ID" button might be missing due to changes in the interface or settings during the upgrade. According to the Upgrade Splunk Enterprise Security - Splunk Documentation

After upgrading to version 7.0.0

When you upgrade the Splunk Enterprise Security app to versions 7.0.0 or higher, the short IDs for notables that were created prior to the upgrade are not displayed on the Incident Review page. As a workaround, you can recreate all the short IDs that were available prior to the upgrade.

Re: Splunk Enterprise Security 8.0

Fara7at08 — Fri, 14 Feb 2025 11:45:02 GMT

Thank you for your reply, i found the solution, it's supported you find follow the below approach.

You need to click on a finding to open the right-hand side panel, then click the 3 dots next to "start an investigation" and select "share a finding". This will generate the shortID and share link. I've attached a screenshot.

Re: Splunk Enterprise Security 8.0

meetmshah — Fri, 14 Feb 2025 11:47:43 GMT

On top of what @kiran_panchavat mentioned, once we generate the Short IDs, we can also add in Incident Review Dashboard as a custom field - https://www.splunk.com/en_us/blog/security/modifying-the-incident-review-page.html#:~:text=To%20configure%20Incident%20Review%20and,see%20Incident%20Review%20%E2%80%93%20Event%20Attributes.