Splunk Enterprise Security

How to link each fired alert to respective saved search?

Gabriel_CCI
Explorer

Hi community!

I have a dashboard that shows the alerts on table and in the graph, the questions is

How I can link each fired alert to respective saved search?

I paste one image

 

alert_fired.png

Labels (1)
Tags (3)
0 Karma

Gabriel_CCI
Explorer

This is part of the query

<panel id="cantidad">
<single>
<title>Cantidad Alertas Gatilladas Durante el día</title>
<search>
<query>index=_audit earliest=@d|search ss_name="DKT - Alerta de brecha critica - Gran cantidad de brechas Usuario"
OR ss_name="DKT - Alerta de brecha critica - SSH hacia destino externo extraño"
OR ss_name="Endpoint - Servidores Windows Vulnerables a EternalBlue (OpenVas) - Rule"
OR ss_name="Endpoint - Servidores Windows Vulnerables a EternalBlue (Tenable) - Rule"
OR ss_name="Endpoint - Tareas programadas mal configuradas - Rule"
|table _time ss_name</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option>
<option name="rangeValues">[10,19]</option>
<option name="refresh.display">progressbar</option>
<option name="useColors">1</option>
</single>

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...