Splunk Enterprise Security

How to create notable events with search?

alexspunkshell
Communicator

I have Power-user access only.

I have a Splunk query and I enabled an alert as a Notable Event. And I also received the notable events in ES --> Incident Review.

But I am not getting the Search query's result in my notable events. I am only getting the Alert name.

Search results of the query are not received in the notable events.

I want to get all the query's search results in the notable events. Please help.

 

Received Notable Event with no information

alexspunkshell_0-1649923450953.png

 

Actual Query's Search Result

alexspunkshell_1-1649923483324.png

 

0 Karma
1 Solution

Stefanie
Builder

If you go to Edit Correlation Search in ES,  and then click "Notable" at the bottom, you can add your description that you would like to have. It supports variables. 

 

What fields are you wanting to show up in the Additional Fields section? Those fields can be added in the Incident Review Settings under Configure in the ES navigation row.

Under " Incident Review - Event Attributes" is there you would map those fields you want to show up.

 

You also have the option to rename some of the fields in your original query to map to some of those labels.

 

I hope this helps!

 

 

View solution in original post

Stefanie
Builder

If you go to Edit Correlation Search in ES,  and then click "Notable" at the bottom, you can add your description that you would like to have. It supports variables. 

 

What fields are you wanting to show up in the Additional Fields section? Those fields can be added in the Incident Review Settings under Configure in the ES navigation row.

Under " Incident Review - Event Attributes" is there you would map those fields you want to show up.

 

You also have the option to rename some of the fields in your original query to map to some of those labels.

 

I hope this helps!

 

 

Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...