Splunk Enterprise Security

How do I set the security_domain in a notable event?

Builder

All,

I have an alert, which creates a notable event in Splunk ES 5.0. Working pretty good, but I can't set the security_domain to something other than THREAT.

I thought I would just have to add a field to my search, but that didn't seem to work.

| eval security_domain="Network"
| fields dest, host, src, src_pci_domain, dest_pci_domain, package, user, pci_dss_req, notes, security_domain
| table dest, host, app, src, src_pci_domain, dest_pci_domain, package, user, pci_dss_req, notes, security_domain

alt text

0 Karma

Splunk Employee
Splunk Employee

The security domain is defined in the notable event adaptive response action for the correlation search. An eval in the search is not the best way to do this. See step 6 here: http://docs.splunk.com/Documentation/ES/5.0.0/Admin/Configureadaptiveresponse#Create_a_notable_event

Builder

Thank you for the reply. I don't seem to have that option when created an Notable Event as an Alert action. How can I find that from there?

0 Karma

Splunk Employee
Splunk Employee

That option is not available from that view, you need to use the Content Management page and the interface inside of Splunk Enterprise Security

0 Karma