https://community.splunk.com/t5/Splunk-Enterprise-Security/New-Security-Domain/m-p/472106#M7247 <P>Hi,</P> <P>yes, you can modify the lookup that is responsible for the available Security Domains (which is also the name of the lookup). Take a look here for an overview of the internal ES lookups: <A href="https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Manageinternallookups">https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Manageinternallookups</A></P> <P>Skalli</P> Thu, 05 Sep 2019 13:38:07 GMT skalliger 2019-09-05T13:38:07Z https://community.splunk.com/t5/Splunk-Enterprise-Security/New-Security-Domain/m-p/472105#M7246 <P>I want to add a new Security Domain called "Email" in Enterprise Security (ES) App and later map it to notables. Right now "Threat", "Network", "Identity" are among a few that are available. Is there a way to achieve this ?</P> Thu, 05 Sep 2019 10:06:06 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/New-Security-Domain/m-p/472105#M7246 shrutheen 2019-09-05T10:06:06Z https://community.splunk.com/t5/Splunk-Enterprise-Security/New-Security-Domain/m-p/472106#M7247 <P>Hi,</P> <P>yes, you can modify the lookup that is responsible for the available Security Domains (which is also the name of the lookup). Take a look here for an overview of the internal ES lookups: <A href="https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Manageinternallookups">https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Manageinternallookups</A></P> <P>Skalli</P> Thu, 05 Sep 2019 13:38:07 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/New-Security-Domain/m-p/472106#M7247 skalliger 2019-09-05T13:38:07Z