Splunk Enterprise Security

Custom Search and notable events

udayk1
Path Finder

We have certain custom searches in Enterprise Security App for example "New MAC Address found in the network", even though I am seeing the results of this search this doesn't raise a notable event and showing in the 'Incident Review' panel, what can be the issue?

Also the same search which worked 45 days back, now it is not working. Can you please help me?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You need to create the search as a Correlation Search. In ES that utilizes the Notable Framework and allows you to see these under Incident Review. You can also create Notables through the Workflow actions on a specific Event.

Make sure your search is enabled and working.

udayk1
Path Finder

Hello esix_splunk, yes this is a Correlation Search and the notable events did trigger for some time and hence then these all alerts have been discontinued (not sure why). We would want to know the reason for this because there were no changes in the Splunk server we carried out. How can we figure this out? Any screenshots you may want? Or do you recommend to open a Splunk Support case?

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...