topic Re: Notable event isn't created. in Splunk Enterprise Security

Notable event isn't created.

kanam — Thu, 25 Feb 2021 02:52:49 GMT

Now I enable correlation search, which is set "Notable" and "Run Phantom Playbook" as adaptive action.

Then when logs are found, "Run Phantom Playbook" is run normally,

but "Notable" doesn't look to be run and "Incident Review" doesn't show anything.

I confirm the result of SPL "index=notable", it returns no result.

Please help.

Re: Notable event isn't created.

scelikok — Thu, 25 Feb 2021 04:18:09 GMT

Hi @kanam,

I think your notable index is empty. If you are using a distributed architecture you may have missed creating "notable" index on your cluster. ES installation creates that index on the search head but the indexes conf that comes with ES must have been also deployed to indexers too.

Please see below documentation;

https://docs.splunk.com/Documentation/ES/6.4.1/Install/Indexes

Re: Notable event isn't created.

kanam — Thu, 25 Feb 2021 07:24:25 GMT

Thank you for support.

As you say, one indexer doesn't have notable index.

But this one was added after.

Can I install some apps needed to use ES manually?

Re: Notable event isn't created.

kanam — Thu, 25 Feb 2021 09:04:23 GMT

I found procedure to install Splunk-TA-ForIndexer and installed.

Then both Indexer have notable index.

However notable event isn't created.

Re: Notable event isn't created.

lkutch_splunk — Thu, 25 Feb 2021 18:09:31 GMT

Does this help?
https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Troubleshootnotables

Re: Notable event isn't created.

lkutch_splunk — Thu, 25 Feb 2021 18:10:45 GMT

Added this advice to https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Troubleshootnotables 🙂

Re: Notable event isn't created.

kanam — Fri, 26 Feb 2021 01:35:51 GMT

Thank you.

I couldn't fine any logs as results of "index=_internal sourcetype=notable_modalert".

I guess trigger action isn't worked successfully.

However another adaptive action, "Run Phantom Playbook", is running well.