Security

Enterprise Security -> Customizing Incident Review -> Adding Short ID

cbschreiber
Loves-to-Learn

I'm wanting to add the short ID that one can generate for a notable in IR. 

cbschreiber_1-1618258938697.png

cbschreiber_0-1618258902334.png

To the columns in Incident Review for our SOC to use. 

cbschreiber_2-1618258995741.png

However, I can't find the proper attribute name for this and it's not in the notable index, or in notable_xref_lookup or es_notable_events lookup. 

Hoping someone can tell me what the correct "Short ID" attribute name is.

Also hoping someone can tell me how to force ES to create a Short ID for EVERY notable. 

Thanks in Advance!

 

Labels (2)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!