How to Mark ES incident or alert as True/False Pos...

Alerting

Hi Team,

Requirement : ES incident/Alerts should be mark as True Positive or False Positive as verdict .

Please help how I can fulfill this requirement,.

Is there any custom field configuration or any drop down list can be configured ?

Get Updates on the Splunk Community!

Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...

How to Mark ES incident or alert as True/False Positive in Splunk cloud