Splunk Enterprise Security

Difference between Palo alto all indecent and ES notable events?


Hi Splunkers,

We are getting critical incidents in Palo alto All incidents dashboard.
We configured ES threat activity notable event with Palo alto threat list as custom threat source. But we are not getting any notable events as same as Palo alto incident feed.
We understand there are two different searches are running behind these two panels.

Does anyone have any idea how we can integrate these incidents in ES? Or ES correlation searches need to be tweaked?

0 Karma


The PAN app has its own datamodels to drive the results of its dashboards. ES uses correlations searches to generate the notables which are mostly based on CIM data models but it can also be based on raw data. So you can create a custom correlation for ES each based on the search used to populate the incident investigation feed panel in the "all Incidents" of the PAN app. Is it useful to have it all these in ES as notables? Probably not, but it will depend on what you are trying to accomplish and have visibility over.

Hope I was able to help you. If so, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!