Splunk Enterprise Security
Highlighted

Configuring Notable event

New Member

I am trying to create a notable event I am writing a query (index=****** EventCode=4771) in search App and then clicking on SaveAs and then click on Alert. Then a popup opens for alert configuration. In that i have trigger Actions where there is option of Notable( Creates notable events). This creates a notable event . Is this the correct way of creating?

I see notables events created in Enterprise Security, however there is lot of events triggered (close to 1000 events) Each single events are generated, but not the aggregated one. Is there a way i can aggregate that in ES? .

0 Karma
Highlighted

Re: Configuring Notable event

Motivator

Hello there @ajayrejin

Have you read this? https://docs.splunk.com/Documentation/ES/5.2.1/Admin/Createnotablesmanually

Kind regards.

0 Karma
Highlighted

Re: Configuring Notable event

SplunkTrust
SplunkTrust

Pls go through this and create correlation searches and add throttling to limit the number of alerts you see. Also, a good practice would be to use index= yourspecificindex addition to your search above

https://docs.splunk.com/Documentation/ES/5.2.2/Tutorials/CorrelationSearch

0 Karma
Highlighted

Re: Configuring Notable event

New Member

I dont see that option of create correlation search under the configure->Content_>Content Mangagmeent->Create New content. I dont have admin access, its power user.

Let me tell how i created a notable event first. From the Search&Reporting app, wrote a query , then clicked on save as->Alert->filled in all the conditions->under trigger actions selected notable(creates notable events)

What is happening now is that configured alert is firing individual notable events and not aggregated one(like 10 failed logins in 1 min, then fire 1 notable event, that is not the case, all the 10 failed events are firing).
I had already given aggregation when i created that alert. Is there any way i can put an aggregation on notable event itself.

0 Karma
Highlighted

Re: Configuring Notable event

SplunkTrust
SplunkTrust

I assume you are using Splunk Enterprise Security (premium product). If so, you would need to navigate to 'Enterprise Security' App and then you can navigate to Configure->Content Mgmt etc...

When working in Splunk ES, normally, we don't use 'Search and reporting' app, as the context is different.

If you are not having Splunk ES, what you are trying to do is the normal alert. Pls check again and share the splunk version and Splunk ES version. Also, go through above link.

0 Karma
Highlighted

Re: Configuring Notable event

New Member

We are using Splunk Enterprise security, Splunk version is 7.1.3 and ES version is 5.2.2.

0 Karma
Highlighted

Re: Configuring Notable event

SplunkTrust
SplunkTrust

ok, good. Did you follow the link https://docs.splunk.com/Documentation/ES/5.2.2/Tutorials/CorrelationSearch to create and test your search? If the issue resolved now?

0 Karma
Highlighted

Re: Configuring Notable event

New Member

I did go through the document, but i dont see a option of creating a correlation search as mentioned in the document.

0 Karma
Highlighted

Re: Configuring Notable event

SplunkTrust
SplunkTrust

Are you logging in as 'admin' or any other user? if its not admin, you need to make sure your role/user has required capabilities.

0 Karma