Enterprise Security notable events, how to calculate Alert acknowledged / Alert closed Report?? Is there any report in Splunk or please let me know the query to generate report??

[IWilsonR]

Enterprise Security notable events, how to calculate Alert acknowledged / Alert closed Report?? Is there any report in Splunk or please let me know the query to generate report??

[IWilsonR]

Hi All,

Anyone know how to pull the above report from splunk??

[IWilsonR]

Anyone know this, need your assistance.

[lakshman239]

Have you looked at the Audit->Incident Review Audit dashboard? This shows reviewed/closed ones.

You can look at the underlying searches and update as needed.

You can also look at http://dev.splunk.com/view/enterprise-security/SP-CAAAFBA to view diff macros and create searches to match your need

e.g |incident_review | rename status_label AS status |