Changing the severity level of a notable ARAs event of a correlation search

[agentsofshield]

Hello, I've recently encountered a problem with the severity level within the ARAs, my current severity level for this specific event is Medium but I want depending on the output of a specific field to alter that severity level to high or even critical but I just couldn't find a way to alter it without creating a completely new correlation search that checks that specific field and is always on 

[livehybrid · Accepted solution]

Hi

You can dynamically set the severity of a notable event in a correlation search by using an eval statement to populate the severity field based on your specific field's value.

<your search> 
| eval severity=case(
    fieldX="value1", "high",
    fieldX="value2", "critical",
    true(), "medium"
)

The severity field in the correlation search result determines the notable event's severity in ES.

Use eval with case() to assign severity dynamically based on the value of fieldX.

The last true(), "medium" acts as a default if no other condition matches.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing