Splunk Enterprise Security

How do I make the correlation search generate notable event

xnx_1012
Explorer

Hi,

Based on my understanding, from the Splunk Guide, https://docs.splunk.com/Documentation/ES/6.6.0/Admin/Configurecorrelationsearches, I just need to add the notable under adaptive response. I did

xnx_1012_0-1631592737278.png

 

However, I try to fail log in, the notable events shown in the Incident Review dashboard, is 0.

But when I run the spl, I embedded in my correlation search, the SPL  can fetch all the fail logged ins that I tried

0 Karma

NS2017
Loves-to-Learn

Just want to understand how you are setting your throttling?

0 Karma

xnx_1012
Explorer

Hello,

 

I did something like this

xnx_1012_0-1631760359238.png

and can I ask if I have an event that has
Time: 3pm

Device: Firewall

Source_IP : 8.8.8.8

Destination: 1.1.1.1

User: user1

Error_message: Error

and this keep happening over and over again in 1 hour time range with the same value. The throttle would help to prevent it right? But if it is different value then it would be a notable, am I right

0 Karma

NS2017
Loves-to-Learn

Hi

In this case all events would be throttled for 4 hours based on the fields you choose. After changing the Throttling did you see any Notable event generate? if not Other thing you can review what time range you are selecting for your search to run. Hope this help

 

0 Karma

xnx_1012
Explorer

Hello, yes, when I made it 7 minutes, the event is there however, I see it like generating the same event again.

0 Karma

NS2017
Loves-to-Learn

So if you make windows duration 7 min then it only throttle for 7 min and then generate event after that. you have to adjust your time range and throttling windows according to your events frequency. 

0 Karma

xnx_1012
Explorer

Hello so I can generate the event, however it is the same event  that has been generated previously

xnx_1012_0-1631776097320.png

SAME EVENTS

xnx_1012_1-1631776206614.png

xnx_1012_2-1631776398679.png

 

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...