Splunk Enterprise Security

Enterprise Security: why don't the events get indexed to the notable index?

danielbb
Motivator

This one is, in a sense, a continuation of Enterprise Security: How can I trace the notable events?

Running - index=_internal component=SavedSplunker status=success sourcetype=scheduler indextime2 result_count>0 suppressed=0 app=SplunkEnterpriseSecuritySuite for the past 24 hours and I get 10 events.

However, index=notable returns 0 events and I verified that the notable index exists.

0 Karma
1 Solution

Vijeta
Influencer

@danielbb Was there any event that would satisfy the correlation searches and would trigger notable event? The query you posted just shows the scheduled jobs running on ES , it doesn't mean that there was a condition met for notable events in correleation searches.
Also make sure you have sufficient permissions to access notable index.

View solution in original post

Vijeta
Influencer

@danielbb Was there any event that would satisfy the correlation searches and would trigger notable event? The query you posted just shows the scheduled jobs running on ES , it doesn't mean that there was a condition met for notable events in correleation searches.
Also make sure you have sufficient permissions to access notable index.

danielbb
Motivator

@solarboyz1 explained in the "parent" thread, if I understand it correctly, that a notable event should be produced.

I do have access to this index...

0 Karma

Vijeta
Influencer

@danielbb Sorry I didn't know there was a parent thread. Yes that's correct a notable event or Indicator of Compromise should be produced in order to populate notable index. You can create a test correlation search and test it with any event , just to check . Any event in . notable index would update the Security Posture Dashboard and Incident Review dashboard.

0 Karma

danielbb
Motivator

Great. I just updated the parent one and alert_actions is actually empty in my case.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...