Hide specific notables from IR (Incident review) in ES

[splunkreal]

Hello, we would like to filter ES incident review and hide notables with TEST keyword by example, how to do? Thanks for your help

[splunkreal]

Hello @Jawahir how are you? Found out we can filter by search_title also, where can we find list of IR fields? Thanks for your help!

[Jawahir]

You can achieve this by creating Custom Notable Event Suppressions. Please refer to the link below for more details.

https://docs.splunk.com/Documentation/ES/7.3.2/Admin/Customizenotables#Create_and_manage_notable_eve...

------

If you find this solution helpful, please consider accepting it and awarding karma points !!

[splunkreal]

Hi @Jawahir  we don't want to suppress them just hide them based on saved filter.

[Jawahir · Accepted solution]

Alright, if the "TEST" keyword is in the search title, you can filter it as shown below.

search_name!=*TEST*

------

If you find this solution helpful, please consider accepting it and awarding karma points !!

[splunkreal]

Great thanks, it works with classic IR view 🙂

[gargantua]

I've done this little app in order to adress this specific use case :

https://github.com/kilanmundera/Custom-Annotations-Framework-for-Splunk-Enterprise-Security