How to send only not suppressed notable from Splunk to SOAR

[drew19]

Hi,

we are using Splunk ES with notable events and suppressions. For sake of completeness, we have alerts that produce notable and some of these notable can be suppressed (through Splunk ES). So, in the "Incident Review" section we are able to see all the notables for which there are no suppressions.

We are trying to send the same set (i.e. all the notables for which there are no suppressions).

We tried to add the action "send to soar" in one of the alerts that produce notables but in this way we obtain that all the notables (even the one suppressed) arrive on the soar.  Do you know if there is a native feature (or quick way) to send all the notables for which there are no suppressions from Splunk to Splunk SOAR?

Thank you in advance.

[meetmshah · Accepted solution]

Hello @drew19, Does `suppression` macro helps? If not, I would suggest creating a custom macro where you can filter based on fields and use the same in all the searches 🙂

Please accept the solution and hit Karma, if this helps!

[meetmshah]

Hello, Just checking through if the issue was resolved or you have any further questions?