Splunk Enterprise Security

How to send only not suppressed notable from Splunk to SOAR

drew19
Path Finder

Hi,

we are using Splunk ES with notable events and suppressions. For sake of completeness, we have alerts that produce notable and some of these notable can be suppressed (through Splunk ES). So, in the "Incident Review" section we are able to see all the notables for which there are no suppressions.

We are trying to send the same set (i.e. all the notables for which there are no suppressions).

We tried to add the action "send to soar" in one of the alerts that produce notables but in this way we obtain that all the notables (even the one suppressed) arrive on the soar.  Do you know if there is a native feature (or quick way) to send all the notables for which there are no suppressions from Splunk to Splunk SOAR?

Thank you in advance.

Labels (1)
0 Karma
1 Solution

meetmshah
SplunkTrust
SplunkTrust

Hello @drew19, Does `suppression` macro helps? If not, I would suggest creating a custom macro where you can filter based on fields and use the same in all the searches 🙂

Please accept the solution and hit Karma, if this helps!

View solution in original post

meetmshah
SplunkTrust
SplunkTrust

Hello @drew19, Does `suppression` macro helps? If not, I would suggest creating a custom macro where you can filter based on fields and use the same in all the searches 🙂

Please accept the solution and hit Karma, if this helps!

meetmshah
SplunkTrust
SplunkTrust

Hello, Just checking through if the issue was resolved or you have any further questions?

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...