topic Re: ES notable urgency changing for old notables. in Splunk Enterprise Security

ES notable urgency changing for old notables.

AK007 — Thu, 27 Aug 2020 14:36:28 GMT

Hi,

We have correlation search with action as notable. Initially we made it low Severity on notable to monitor and set threshold . when we changed the severity to high for same notable all the old low severity notable events changed to High automatically. (this search is on data model so dose not have any eval urgency in search).

How to avoid changing old notable event severity ? we just want new alerts to be with high urgency not change the old once.

Re: ES notable urgency changing for old notables.

richgalloway — Fri, 28 Aug 2020 13:16:30 GMT

AFAIK, that's how ES functions and there's no way to change it.

Re: ES notable urgency changing for old notables.

Jhunter — Sun, 30 Aug 2020 00:17:30 GMT

This is expected behavior as ES stores a correlation search's notable event severity in lookup table (correlationsearches_lookup) so the severity gets changed for all.

Use SPL in the correlation search to assign severity:

https://docs.splunk.com/Documentation/ES/6.2.0/User/Howurgencyisassigned

"Severity defined in the search syntax results in an event where severity takes precedence over the severity defined in the notable event adaptive response action."

If you just want all new notables from this use case to be high (and not old ones) just use a an eval. Or you can expand on the eval to custom adjust the severity:

| eval severity="high"

Even if you're using the datamodel command or tstats against a data model, you can still fit this in a pipe somewhere without affecting the searching

tstats count something FROM someDataModel by somethingElse
| where other stuff and magic
| eval severity="high"

Re: ES notable urgency changing for old notables.

thambisetty — Sun, 30 Aug 2020 06:49:50 GMT

Notable modular alerts actions values are not written to index=notable. To display severity or priority or urgency, Incident review will perform rest query to get values of correlation search and display in Incident review.

However, I believe there is an option to overwrite severity from in-line search of correlation search.

just add below line to your correlation search.

| eval severity="informational/high/low"