Splunk Enterprise Security

Correlation search not showing notable in Incident Review?

muradgh
Path Finder

Hi Splunkers.

I have noticed a strange behavior from Splunk, I have a correlation search that I have created a while ago, ensured to select "Notable" under the Adaptive Responsive section so that it creates a notable, also tested that when I run the search manually it produced results. BUT it does not generate notables in the Incident Review dashboard!

So I went and searched index=notable and found 4 events for this correlation search in the last 30 days!
Then I checked the same index for another correlation search that DOES generate notables in the Incident Review dashboard (4 notables in the last 30 days) and indeed I found 4 events in the notable index!

I also used the "Correlation Search Audit" app (https://splunkbase.splunk.com/app/4144) and Indeed this app shows that this correlation search has been triggered 4 times in the last 30 days! 

The search does not have any lookups (In case you asked about the permissions of the lookups).
The search does use the Web data model (and it has Global permissions).

I'm using the admin user so I have sufficient privileges.

I'm using:
Splunk Enterprise version: 8.1.0
Enterprise Security version: 6.2.0
OS: Red Hat Enterprise Linux Server 7.7 (Maipo)

Any Idea why this is happening? 

Labels (3)
0 Karma

neerajs_81
Builder

What you are describing happens when the correlation rule is suppressed.  Did you check the suppression page for this alert ? 
Secondly when you ran the search manually , did it produce results in a tabular format ?  Typically correlation search results are in a tabular format.

P.S Pls upvote if this helps.

0 Karma

muradgh
Path Finder

I have checked but nope, it's not suppressed.
And yes the search produces results in a tabular format

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps the NE is being suppressed.  Check by going to Configure->Incident Management->Notable Event Suppressions

---
If this reply helps you, Karma would be appreciated.
0 Karma

muradgh
Path Finder

I have checked but nope, it's not suppressed

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...