Splunk Enterprise Security

Creating a notable event from correlation search

shiftey
Path Finder

Hi
Im using the below search and wish to create a notable event from the search. (filtered to not show company info)

sourcetype=DhcpSrvLog description=assign dest!=prefix1* prefix2* dest_ip!=x.x.x.x/20 dest_ip!=x.x.x.x/21 | rex mode=sed field=dest "s/.companydomain.com//g" | where dest!=dest_mac | table dest,dest_ip,dest_mac,time,date | sort date

When I search manually over last 24 hours I get results, however no notable events are created. Does the correlation search syntax need to be in a certain format to generate the notable event?

1 Solution

LukeMurphey
Champion

The correlation search does need to be in a particular format (needs to make an event in the notable index and have particular fields). I suggest using the Correlation Search Editor to make it (Configuration » Custom Searches) since it will handle the particulars for you. Make sure to enable the "Create notable event" action so that the search creates a notable event for you.

View solution in original post

kamal_jagga
Contributor

Hi Luke,

I am also trying to create some custom correlation searches and notables from my daily reports.

Steps I followed to make this:
1. In ES ==> ES ==> Configure ==> Content Mgmt ==> Create New Content ==> Correlation Searches
2. While creating the correlation searches, I added the name of the new notable (assuming that this would create new notable) and scheduled and saved it.

The query runs fine and gives the output in tabular format. Its creating the notables but I am not able to see the contributing events/error event.

As you mentioned above, could you advise on the format needed to make an event in the notable index and have particular fields.

Also, I am unable to find Correlation Search Editor to make it (Configuration » Custom Searches)

Kindly advise.

0 Karma

kamal_jagga
Contributor

I created the notable events in the Configure==> Incident events as well. Still unable to see the contributing events in incidents.

kamal_jagga
Contributor

I hadn't named the Drill-down search while creating the notable. Once it was updated, the contributing events started showing up as expected.

0 Karma

LukeMurphey
Champion

The correlation search does need to be in a particular format (needs to make an event in the notable index and have particular fields). I suggest using the Correlation Search Editor to make it (Configuration » Custom Searches) since it will handle the particulars for you. Make sure to enable the "Create notable event" action so that the search creates a notable event for you.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...