How do I make the correlation search generate notable event

[xnx_1012]

Hi,

Based on my understanding, from the Splunk Guide, https://docs.splunk.com/Documentation/ES/6.6.0/Admin/Configurecorrelationsearches, I just need to add the notable under adaptive response. I did

However, I try to fail log in, the notable events shown in the Incident Review dashboard, is 0.

But when I run the spl, I embedded in my correlation search, the SPL  can fetch all the fail logged ins that I tried

[NS2017]

Just want to understand how you are setting your throttling?

[xnx_1012]

Hello,

I did something like this

and can I ask if I have an event that has
Time: 3pm

Device: Firewall

Source_IP : 8.8.8.8

Destination: 1.1.1.1

User: user1

Error_message: Error

and this keep happening over and over again in 1 hour time range with the same value. The throttle would help to prevent it right? But if it is different value then it would be a notable, am I right

[NS2017]

Hi

In this case all events would be throttled for 4 hours based on the fields you choose. After changing the Throttling did you see any Notable event generate? if not Other thing you can review what time range you are selecting for your search to run. Hope this help

[xnx_1012]

Hello, yes, when I made it 7 minutes, the event is there however, I see it like generating the same event again.

[NS2017]

So if you make windows duration 7 min then it only throttle for 7 min and then generate event after that. you have to adjust your time range and throttling windows according to your events frequency. 

[xnx_1012]

Hello so I can generate the event, however it is the same event  that has been generated previously

SAME EVENTS