How do I set the security_domain in a notable event?

[daniel333]

All,

I have an alert, which creates a notable event in Splunk ES 5.0. Working pretty good, but I can't set the security_domain to something other than THREAT.

I thought I would just have to add a field to my search, but that didn't seem to work.

| eval security_domain="Network"
| fields dest, host, src, src_pci_domain, dest_pci_domain, package, user, pci_dss_req, notes, security_domain
| table dest, host, app, src, src_pci_domain, dest_pci_domain, package, user, pci_dss_req, notes, security_domain

[smoir_splunk]

The security domain is defined in the notable event adaptive response action for the correlation search. An eval in the search is not the best way to do this. See step 6 here: http://docs.splunk.com/Documentation/ES/5.0.0/Admin/Configureadaptiveresponse#Create_a_notable_event

[daniel333]

Thank you for the reply. I don't seem to have that option when created an Notable Event as an Alert action. How can I find that from there?

[smoir_splunk]

That option is not available from that view, you need to use the Content Management page and the interface inside of Splunk Enterprise Security