topic Re: Customize Notable Status Order in Dropdown in Splunk Enterprise Security

Customize Notable Status Order in Dropdown

BenjaminWyatt — Tue, 15 Sep 2020 22:28:44 GMT

Hi everyone,

I have a request from our security team to reorder our notable event statuses in the dropdown. We have a lot of custom statuses that supplant the "In Progress" label, and at present they all appear at the very end of the dropdown list, which isn't terribly convenient for our analysts. I can see how to edit the status names, but I can't find a way to change the order the appear in the dropdown. Is there a way to do this?

Re: Customize Notable Status Order in Dropdown

thambisetty — Wed, 16 Sep 2020 06:19:12 GMT

are you talking about Status input in incident review? if yes, we can't do much customization about Incident review.

Re: Customize Notable Status Order in Dropdown

BenjaminWyatt — Mon, 21 Sep 2020 13:20:58 GMT

Yes, that's the one - sounds like that won't be a possibility then.

Out of curiosity, what is the default ordering for statuses in the dropdown? It looks like they are listed by order of their status ID, but it would be good to confirm.