Splunk Enterprise Security
Highlighted

How do you tag a user with watchlist in Splunk Enterprise Security?

Engager

If I have a notable event is there a way within incident review to tag the user with watchlist?

0 Karma
Highlighted

Re: How do you tag a user with watchlist in Splunk Enterprise Security?

SplunkTrust
SplunkTrust

Under the Example methods of adding asset and identity data in Splunk Enterprise Security you could refer to perform the steps under Manually add new asset or identity data, or you could update your identity lookup to set the required flag...

0 Karma