topic Re: Creating a notable event from correlation search in Splunk Enterprise Security

Creating a notable event from correlation search

shiftey — Mon, 28 Sep 2020 20:05:26 GMT

Hi
Im using the below search and wish to create a notable event from the search. (filtered to not show company info)

sourcetype=DhcpSrvLog description=assign dest!=prefix1* prefix2* dest_ip!=x.x.x.x/20 dest_ip!=x.x.x.x/21 | rex mode=sed field=dest "s/.companydomain.com//g" | where dest!=dest_mac | table dest,dest_ip,dest_mac,time,date | sort date

When I search manually over last 24 hours I get results, however no notable events are created. Does the correlation search syntax need to be in a certain format to generate the notable event?

Re: Creating a notable event from correlation search

LukeMurphey — Thu, 28 May 2015 03:37:16 GMT

The correlation search does need to be in a particular format (needs to make an event in the notable index and have particular fields). I suggest using the Correlation Search Editor to make it (Configuration » Custom Searches) since it will handle the particulars for you. Make sure to enable the "Create notable event" action so that the search creates a notable event for you.

Re: Creating a notable event from correlation search

kamal_jagga — Wed, 21 Nov 2018 00:44:08 GMT

Hi Luke,

I am also trying to create some custom correlation searches and notables from my daily reports.

Steps I followed to make this:
1. In ES ==> ES ==> Configure ==> Content Mgmt ==> Create New Content ==> Correlation Searches
2. While creating the correlation searches, I added the name of the new notable (assuming that this would create new notable) and scheduled and saved it.

The query runs fine and gives the output in tabular format. Its creating the notables but I am not able to see the contributing events/error event.

As you mentioned above, could you advise on the format needed to make an event in the notable index and have particular fields.

Also, I am unable to find Correlation Search Editor to make it (Configuration » Custom Searches)

Kindly advise.

Re: Creating a notable event from correlation search

kamal_jagga — Thu, 22 Nov 2018 16:50:08 GMT

I created the notable events in the Configure==> Incident events as well. Still unable to see the contributing events in incidents.

Re: Creating a notable event from correlation search

kamal_jagga — Sun, 06 Jan 2019 21:43:45 GMT

I hadn't named the Drill-down search while creating the notable. Once it was updated, the contributing events started showing up as expected.