Splunk Enterprise Security

How can I test for high or critical notable events?

Skins
Path Finder

I have read this article which describes searching for high or critical notable events.

https://answers.splunk.com/answers/432018/splunk-enterprise-security-how-to-set-up-alerts-wh.html

notable | where urgency="high" OR urgency="critical" | table _time source src dest user | eval computer=coalesce(src,dest)

Now i need a simple way to create a critical notable event to test.

How best to achieve this ?

gratzi

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

You can also create a manual notable event in the UI. https://docs.splunk.com/Documentation/ES/4.7.2/Admin/Createnotablesmanually

0 Karma

aholzel
Communicator

I had to do something like this today try the following:

| makeresults 
| eval user="skins", urgency="critical" 
| sendalert notable
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...