Security

Enterprise Security -> Customizing Incident Review -> Adding Short ID

cbschreiber
Explorer

I'm wanting to add the short ID that one can generate for a notable in IR. 

cbschreiber_1-1618258938697.png

cbschreiber_0-1618258902334.png

To the columns in Incident Review for our SOC to use. 

cbschreiber_2-1618258995741.png

However, I can't find the proper attribute name for this and it's not in the notable index, or in notable_xref_lookup or es_notable_events lookup. 

Hoping someone can tell me what the correct "Short ID" attribute name is.

Also hoping someone can tell me how to force ES to create a Short ID for EVERY notable. 

Thanks in Advance!

 

Labels (2)
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...