https://community.splunk.com/t5/Splunk-Enterprise-Security/Adding-to-Additional-Fields-In-Incident-Review/m-p/416513#M5028 <P>what sort of customization are you looking to do per notable? Have you looked at <A href="http://www.georgestarcher.com/splunk-enterprise-security-enhancing-incident-review/">http://www.georgestarcher.com/splunk-enterprise-security-enhancing-incident-review/</A> to suggest linking a ticketId to adaptive response?</P> Tue, 23 Apr 2019 12:09:49 GMT lakshman239 2019-04-23T12:09:49Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Adding-to-Additional-Fields-In-Incident-Review/m-p/416512#M5027 <P>Hi,</P> <P>I'm trying to see if there's a way to add additional/custom fields in Incident Review.</P> <P>Is there much room for customisation? All I've seen thus far is adding event attributes via Incident Review settings. </P> <P>Sorry this is rather vague - Just looking to find ways to customize these settings on the basis of different notable events.</P> <P>Thanks,</P> <P>Adam.</P> Mon, 15 Apr 2019 16:47:14 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Adding-to-Additional-Fields-In-Incident-Review/m-p/416512#M5027 adam_dixon95 2019-04-15T16:47:14Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Adding-to-Additional-Fields-In-Incident-Review/m-p/416513#M5028 <P>what sort of customization are you looking to do per notable? Have you looked at <A href="http://www.georgestarcher.com/splunk-enterprise-security-enhancing-incident-review/">http://www.georgestarcher.com/splunk-enterprise-security-enhancing-incident-review/</A> to suggest linking a ticketId to adaptive response?</P> Tue, 23 Apr 2019 12:09:49 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Adding-to-Additional-Fields-In-Incident-Review/m-p/416513#M5028 lakshman239 2019-04-23T12:09:49Z