https://community.splunk.com/t5/Splunk-Enterprise-Security/ES-Threat-Activity-Search-add-Host-field/m-p/385938#M4020 <P>When matching against threat intel the notable events only shows the source and destination of the matched event. Is there a way to make the correlation search only find specific events with a specific host and show the host in the notable event? </P> <P>For example, showing the source, destination and that it occured on firewall 2.</P> Fri, 04 Jan 2019 13:56:39 GMT mmoermans 2019-01-04T13:56:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/ES-Threat-Activity-Search-add-Host-field/m-p/385938#M4020 <P>When matching against threat intel the notable events only shows the source and destination of the matched event. Is there a way to make the correlation search only find specific events with a specific host and show the host in the notable event? </P> <P>For example, showing the source, destination and that it occured on firewall 2.</P> Fri, 04 Jan 2019 13:56:39 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/ES-Threat-Activity-Search-add-Host-field/m-p/385938#M4020 mmoermans 2019-01-04T13:56:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/ES-Threat-Activity-Search-add-Host-field/m-p/385939#M4021 <P>I assume if you use a datamodel (e.g Network_Traffic), you can use the 'dvc' value which should indicate the firewall/host on which the event was noticed.</P> Wed, 09 Jan 2019 16:24:39 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/ES-Threat-Activity-Search-add-Host-field/m-p/385939#M4021 lakshman239 2019-01-09T16:24:39Z