Difference between Palo alto all indecent and ES notable events?

[p_gurav]

Hi Splunkers,

We are getting critical incidents in Palo alto All incidents dashboard.
We configured ES threat activity notable event with Palo alto threat list as custom threat source. But we are not getting any notable events as same as Palo alto incident feed.
We understand there are two different searches are running behind these two panels.

Does anyone have any idea how we can integrate these incidents in ES? Or ES correlation searches need to be tweaked?

[diogofgm]

The PAN app has its own datamodels to drive the results of its dashboards. ES uses correlations searches to generate the notables which are mostly based on CIM data models but it can also be based on raw data. So you can create a custom correlation for ES each based on the search used to populate the incident investigation feed panel in the "all Incidents" of the PAN app. Is it useful to have it all these in ES as notables? Probably not, but it will depend on what you are trying to accomplish and have visibility over.