Splunk Enterprise Security

How to create notable events with search?

alexspunkshell
Contributor

I have Power-user access only.

I have a Splunk query and I enabled an alert as a Notable Event. And I also received the notable events in ES --> Incident Review.

But I am not getting the Search query's result in my notable events. I am only getting the Alert name.

Search results of the query are not received in the notable events.

I want to get all the query's search results in the notable events. Please help.

 

Received Notable Event with no information

alexspunkshell_0-1649923450953.png

 

Actual Query's Search Result

alexspunkshell_1-1649923483324.png

 

0 Karma
1 Solution

Stefanie
Builder

If you go to Edit Correlation Search in ES,  and then click "Notable" at the bottom, you can add your description that you would like to have. It supports variables. 

 

What fields are you wanting to show up in the Additional Fields section? Those fields can be added in the Incident Review Settings under Configure in the ES navigation row.

Under " Incident Review - Event Attributes" is there you would map those fields you want to show up.

 

You also have the option to rename some of the fields in your original query to map to some of those labels.

 

I hope this helps!

 

 

View solution in original post

Stefanie
Builder

If you go to Edit Correlation Search in ES,  and then click "Notable" at the bottom, you can add your description that you would like to have. It supports variables. 

 

What fields are you wanting to show up in the Additional Fields section? Those fields can be added in the Incident Review Settings under Configure in the ES navigation row.

Under " Incident Review - Event Attributes" is there you would map those fields you want to show up.

 

You also have the option to rename some of the fields in your original query to map to some of those labels.

 

I hope this helps!

 

 

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...