Splunk Enterprise Security

ES - Notables | fetch correlated/contributing events for the triggered time in search app

CryoHydra
Path Finder

Hi,

In incident review dashboard i have assigned some notables to me, instead of reviewing one by one i wanted to review events for all notables in single attempt through search app.

e.g) Notable for excessive firewall deny rule - triggered for the time period 1AM to 5AM --> i need to review correlated/contributing events by opening the incident

e.g) excessive failed logon - triggered for 3AM to 8AM

both notable in incident review dash board is assigned to me and based on search properties i can get all notables assigned to me (search query) and can be used in search app, however i want to fetch contributing events for the notable in search app itself based on triggered time ? how can we go over this ?

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...