- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it possible to create notable events in Splunk Cloud or is it only native to Enterprise Security?
Is it possible to create notable events in Splunk Cloud or is it only native to Enterprise Security? The detection rule below is creating actions=risk, notable and assigning some parameters in the notable event. Is it possible to implement this rule as it is with actions notable events in Splunk Cloud or is it only possible in Enterprise Security? I know the alert can be created in Splunk Cloud with its alerting feature, but I am wondering if we need to modify the actions part of the detection rule if notable events do not exist in Splunk Cloud. Thank you.
search = index=* ((Operation="FileUploaded" OR Operation="FileAccessed" OR Operation="FileDownloaded")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Notable Events and Correlation Searches are Splunk Enterprise Security (ES) features. While you can create an index called "notable" in Splunk Cloud (or Splunk Enterprise), you can't get the full Notables experience without ES.
If this reply helps you, Karma would be appreciated.
