How we can troubleshoot the ES Correlation Search for "non pdm alerts"?


I have a significant number of Notables raised by the Non-pdm alerts correlation search.

The correlation search runs every 2 hours, triggers an alert when the user violates the policy
sourcetype=netskope earliest=-2h NOT (alert_name IN ("pdm", " External_Shared Files - Alert", "All DLP Policies"))
| stats dc(alert_name) as alert_count,values(_time) as incident_time by user
Throttling is set to 3 days duration what changes we need to make a less no. of notables to be raise?

Labels (2)
0 Karma


You have a few options.

1) Train the users to not violate policy

2) Adjust policy to better reflect what users need to do

3) Modify the CS to filter out "uninteresting" events

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...