All Apps and Add-ons

PCI Compliance - how to create a report of all notable event suppressions enabled

vincenp2
New Member

In PCI Compliance app I go to
configure > incident management > notable event suppressions
and get a list of all created suppressions
I want to download this list so that I can report out those that are enabled
I would also like the report to show details of the search associated with the suppression
is this possible and if so could anyone provide details of how to do this please?

0 Karma

Lorne_2
Engager

You might be looking for the suppressed_notables macro?

ex:
`suppressed_notables` | timechart span=1d count by rule_name

0 Karma

vincenp2
New Member

actually to be more precise I would like to create a query that can be saved to a report and generated on a monthly basis

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...