Best practices for enhancing data on Notable Events via API calls

[gabrieltomasett]

Hello all,

I am trying to create a python script that pulls down information from a notable event in Enterprise Security. Then, passes that information (IP addresses, MD5s, and files) to third party APIs (such as VirusTotal or Palo Alto Wildfire) and references the hosts in an EDR tool (Crowd Strike or Carbon Black) collecting relevant information and sending that information back to the notable in Splunk.

I have most everything figured out except for putting the information back in Splunk. The closest thing I could find to what I want to do is adding a comment with the information:

url2 = 'https://SomeSplunkDomain.com:8089/services_update'
urgency = None
status = None
owner = None

event_id #taken from a dict
comment #taken from a dict

data = {
'ruleUIDs': [event_id],
'urgency': [urgency],
'status': [status],
'newOwner': [owner],
'comment': [comment]
}
notableUpdate = requests.post(url2, data=data, verify=False, auth=(someUsername, somePassword))
response2 = notableUpdate.json()
print(response2)

However, I could see a couple of issues arising from this and I am hoping someone knows a better way to add information to notable events. I don’t want to create another notable by adding the information to another correlation search.

Thank you in advance!

[starcher · Accepted solution]

Notable events are indexed summary events. There is no modifying an event once indexed in Splunk. You have two options.
1. If you want fields indexed in the notable event make your code a custom search command.
2. Make your code an adaptive response that indexes the data for subsequent searching, or populates a lookup that you shim onto the notable events.

See this for shimming on a lookup
http://www.georgestarcher.com/splunk-enterprise-security-enhancing-incident-review/