topic Re: Track Changes to a field in Splunk Search

Track Changes to a field

akselsoeb — Wed, 27 Dec 2023 15:35:19 GMT

Hello guys

I need some help with making a table/dashboard that shows me changes to incidents in our Defender platform.
The underlying issue that we see is that Defender sometimes, when an incident is handled by automation, de-escalate the severity of a particular incident.

So in my index of incidents i want to track for each specific incident that is handled by automation to show me when the severity field changes.

The table should look something link this.

IncidentId Description Status Old_Severity New_Severity

I don't know whether to use the streamstats or the dedup command. I've been fiddling abit with both but can't seem to get the right output.

Anyways, hope you can help me out here. If theres something unclear about my question, let me know so i can clarify.

Re: Track Changes to a field

dtburrows3 — Wed, 27 Dec 2023 16:36:20 GMT

So if you just want to narrow down on the IncidentIds that this occurred on, I thing doing a stats aggregation would be more efficient. Something like this.

<base_search> | fields + _time, IncidentId, Description, Status, Severity | sort 0 +_time | stats values(Description) as Description, latest(Status) as Status, dc(Severity) as dc_severity, list(Severity) as Sequence_Severity, earliest(Severity) as Old_Severity, latest(Severity) as New_Severity by IncidentId | where 'dc_severity'>1 | fields - dc_severity

If you want to retain all of the original events apart of any IncidentId that this occurred on then you could use some sort of combo of streamstats and eventstats (less efficient but more detailed)

<base_search> | fields + _time, IncidentId, Description, Status, Severity | sort 0 +IncidentId, -_time | streamstats window=2 earliest(Severity) as Old_Severity, latest(Severity) as New_Severity by IncidentId | eventstats max(eval(if(NOT 'Old_Severity'=='New_Severity', 1, 0))) as status_change by IncidentId | where 'status_change'>0 | fields - status_change

Re: Track Changes to a field

akselsoeb — Thu, 28 Dec 2023 09:44:52 GMT

Thank you @dtburrows3
This was exactly what i was looking for.