I have an alert, which creates a notable event in Splunk ES 5.0. Working pretty good, but I can't set the security_domain to something other than THREAT.
I thought I would just have to add a field to my search, but that didn't seem to work.
| eval security_domain="Network" | fields dest, host, src, src_pci_domain, dest_pci_domain, package, user, pci_dss_req, notes, security_domain | table dest, host, app, src, src_pci_domain, dest_pci_domain, package, user, pci_dss_req, notes, security_domain
The security domain is defined in the notable event adaptive response action for the correlation search. An eval in the search is not the best way to do this. See step 6 here: http://docs.splunk.com/Documentation/ES/5.0.0/Admin/Configureadaptiveresponse#Create_a_notable_event