If I have a notable event is there a way within incident review to tag the user with watchlist?
Under the Example methods of adding asset and identity data in Splunk Enterprise Security you could refer to perform the steps under Manually add new asset or identity data, or you could update your identity lookup to set the required flag...
