Splunk Enterprise Security

How to send only not suppressed notable from Splunk to SOAR

drew19
Path Finder

Hi,

we are using Splunk ES with notable events and suppressions. For sake of completeness, we have alerts that produce notable and some of these notable can be suppressed (through Splunk ES). So, in the "Incident Review" section we are able to see all the notables for which there are no suppressions.

We are trying to send the same set (i.e. all the notables for which there are no suppressions).

We tried to add the action "send to soar" in one of the alerts that produce notables but in this way we obtain that all the notables (even the one suppressed) arrive on the soar.  Do you know if there is a native feature (or quick way) to send all the notables for which there are no suppressions from Splunk to Splunk SOAR?

Thank you in advance.

Labels (1)
0 Karma
1 Solution

meetmshah
SplunkTrust
SplunkTrust

Hello @drew19, Does `suppression` macro helps? If not, I would suggest creating a custom macro where you can filter based on fields and use the same in all the searches 🙂

Please accept the solution and hit Karma, if this helps!

View solution in original post

meetmshah
SplunkTrust
SplunkTrust

Hello @drew19, Does `suppression` macro helps? If not, I would suggest creating a custom macro where you can filter based on fields and use the same in all the searches 🙂

Please accept the solution and hit Karma, if this helps!

meetmshah
SplunkTrust
SplunkTrust

Hello, Just checking through if the issue was resolved or you have any further questions?

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...