How to search Notable Events By Owner and Severity older than 48 hours?

[deodeshm]

As I understand es_notable_events is KVStore and it stores notable event information for last 48 hours/ also there is a panel in ES Audit dashboard that shows Notable Events By Owner - Last 48 Hours.

Is there any way to build a similar chart for older Notables?

Thanks,

Deovrat

[aasabatini]

Hi @deodeshm 

Also notable events are stored in notable index.

you can see the notable info with this search.

search `notable`  | eval rule_name=if(isnull(rule_name),source,rule_name) | eval rule_title=if(isnull(rule_title),rule_name,rule_title) | `get_urgency` | `risk_correlation` | eval rule_description=if(isnull(rule_description),source,rule_description) | eval security_domain=if(isnull(security_domain),source,security_domain) | expandtoken