Splunk Enterprise Security

Correlation search not showing notable in Incident Review?

muradgh
Path Finder

Hi Splunkers.

I have noticed a strange behavior from Splunk, I have a correlation search that I have created a while ago, ensured to select "Notable" under the Adaptive Responsive section so that it creates a notable, also tested that when I run the search manually it produced results. BUT it does not generate notables in the Incident Review dashboard!

So I went and searched index=notable and found 4 events for this correlation search in the last 30 days!
Then I checked the same index for another correlation search that DOES generate notables in the Incident Review dashboard (4 notables in the last 30 days) and indeed I found 4 events in the notable index!

I also used the "Correlation Search Audit" app (https://splunkbase.splunk.com/app/4144) and Indeed this app shows that this correlation search has been triggered 4 times in the last 30 days! 

The search does not have any lookups (In case you asked about the permissions of the lookups).
The search does use the Web data model (and it has Global permissions).

I'm using the admin user so I have sufficient privileges.

I'm using:
Splunk Enterprise version: 8.1.0
Enterprise Security version: 6.2.0
OS: Red Hat Enterprise Linux Server 7.7 (Maipo)

Any Idea why this is happening? 

Labels (3)
0 Karma

neerajs_81
Builder

What you are describing happens when the correlation rule is suppressed.  Did you check the suppression page for this alert ? 
Secondly when you ran the search manually , did it produce results in a tabular format ?  Typically correlation search results are in a tabular format.

P.S Pls upvote if this helps.

0 Karma

muradgh
Path Finder

I have checked but nope, it's not suppressed.
And yes the search produces results in a tabular format

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps the NE is being suppressed.  Check by going to Configure->Incident Management->Notable Event Suppressions

---
If this reply helps you, Karma would be appreciated.
0 Karma

muradgh
Path Finder

I have checked but nope, it's not suppressed

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...