Splunk Enterprise Security

How to create notable events with search?

alexspunkshell
Communicator

I have Power-user access only.

I have a Splunk query and I enabled an alert as a Notable Event. And I also received the notable events in ES --> Incident Review.

But I am not getting the Search query's result in my notable events. I am only getting the Alert name.

Search results of the query are not received in the notable events.

I want to get all the query's search results in the notable events. Please help.

 

Received Notable Event with no information

alexspunkshell_0-1649923450953.png

 

Actual Query's Search Result

alexspunkshell_1-1649923483324.png

 

0 Karma
1 Solution

Stefanie
Builder

If you go to Edit Correlation Search in ES,  and then click "Notable" at the bottom, you can add your description that you would like to have. It supports variables. 

 

What fields are you wanting to show up in the Additional Fields section? Those fields can be added in the Incident Review Settings under Configure in the ES navigation row.

Under " Incident Review - Event Attributes" is there you would map those fields you want to show up.

 

You also have the option to rename some of the fields in your original query to map to some of those labels.

 

I hope this helps!

 

 

View solution in original post

Stefanie
Builder

If you go to Edit Correlation Search in ES,  and then click "Notable" at the bottom, you can add your description that you would like to have. It supports variables. 

 

What fields are you wanting to show up in the Additional Fields section? Those fields can be added in the Incident Review Settings under Configure in the ES navigation row.

Under " Incident Review - Event Attributes" is there you would map those fields you want to show up.

 

You also have the option to rename some of the fields in your original query to map to some of those labels.

 

I hope this helps!

 

 

Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...