Splunk Enterprise Security

Enterprise Security incident urgency showing "informational" when I set correlation rule notable to "high"?

ravida
Explorer

Hi folks,

I created a correlation search that looks for administrators setting passwords to never expire, which then creates a notable event for incident review. I tried setting the severity to both "high" and "critical", but when the notable is created the urgency field shows up only as "informational".

When I test the rule, I did it against on accounts that show up as both "high" and "critical" priority in the Identity Investigator, data I enrich via Active Directory.

I checked the lookup table for urgency_lookup and it is as you would expect, nothing is different than the default that would make it calculate to informational. What may I be missing?

 

Thanks!

0 Karma
1 Solution

meetmshah
SplunkTrust
SplunkTrust

Hello @ravida, If you have already checked urgency_lookup along with severity and priority of the assets/identities - there is nothing much to check. Except

  • Validate you are looking over and updating the correct correlation search
  • New notables are generated if you have updated priority / severity (Existing urgency would not be updated)

View solution in original post

meetmshah
SplunkTrust
SplunkTrust

Hello @ravida, If you have already checked urgency_lookup along with severity and priority of the assets/identities - there is nothing much to check. Except

  • Validate you are looking over and updating the correct correlation search
  • New notables are generated if you have updated priority / severity (Existing urgency would not be updated)

meetmshah
SplunkTrust
SplunkTrust

Hello, Just checking through if the issue was resolved or if you have any further questions?

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...