Correlations

[Vianapp]

Good afternoon, I hope you are well. I am migrating my alert environment from TheHive to start using ES. I would like to know and learn if, in ES, when creating Correlations, I can configure a field in the notable event that analysts can edit. For example, when creating cases in TheHive, I include the desired field, and analysts set the value when they take the case for processing. Despite studying, I couldn't figure out how to implement this in a notable event so that analysts can provide inputs such as identifying the technology involved or deciding whether it should be forwarded. This would help me use it for auditing purposes later on. Is it possible to achieve this in ES?

[gcusello]

Hi @Vianapp,

at first, Splunk isn't a DB where you can modify field values, Splunk is a log monitor where logs are indexed and not more updated.

You can modify the Correlation Searches adding all the fields you need from the events, but users cannot update them as in a DB.

In the Notable Events investigation, you can add notes, but not modifying field values, managed using lookups and Summary Indexes.

I hint to follow a training on ES before starting to use it: Splunk thinks different than the other systems.

Ciao.

Giuseppe