Splunk Enterprise Security

Hide specific notables from IR (Incident review) in ES

splunkreal
Motivator

Hello, we would like to filter ES incident review and hide notables with TEST keyword by example, how to do? Thanks for your help

* If this helps, please upvote or accept solution if it solved *
0 Karma
1 Solution

jawahir007
Communicator

Alright, if the "TEST" keyword is in the search title, you can filter it as shown below.

search_name!=*TEST*

jawahir007_0-1729847733395.png

------

If you find this solution helpful, please consider accepting it and awarding karma points !!

View solution in original post

jawahir007
Communicator

You can achieve this by creating Custom Notable Event Suppressions. Please refer to the link below for more details.

https://docs.splunk.com/Documentation/ES/7.3.2/Admin/Customizenotables#Create_and_manage_notable_eve...

------

If you find this solution helpful, please consider accepting it and awarding karma points !!
0 Karma

splunkreal
Motivator

Hi @jawahir007  we don't want to suppress them just hide them based on saved filter.

* If this helps, please upvote or accept solution if it solved *
0 Karma

jawahir007
Communicator

Alright, if the "TEST" keyword is in the search title, you can filter it as shown below.

search_name!=*TEST*

jawahir007_0-1729847733395.png

------

If you find this solution helpful, please consider accepting it and awarding karma points !!

splunkreal
Motivator

Great thanks, it works with classic IR view 🙂

* If this helps, please upvote or accept solution if it solved *
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...