Splunk Enterprise Security

How to send only not suppressed notable from Splunk to SOAR

drew19
Path Finder

Hi,

we are using Splunk ES with notable events and suppressions. For sake of completeness, we have alerts that produce notable and some of these notable can be suppressed (through Splunk ES). So, in the "Incident Review" section we are able to see all the notables for which there are no suppressions.

We are trying to send the same set (i.e. all the notables for which there are no suppressions).

We tried to add the action "send to soar" in one of the alerts that produce notables but in this way we obtain that all the notables (even the one suppressed) arrive on the soar.  Do you know if there is a native feature (or quick way) to send all the notables for which there are no suppressions from Splunk to Splunk SOAR?

Thank you in advance.

Labels (1)
0 Karma
1 Solution

meetmshah
Contributor

Hello @drew19, Does `suppression` macro helps? If not, I would suggest creating a custom macro where you can filter based on fields and use the same in all the searches 🙂

Please accept the solution and hit Karma, if this helps!

View solution in original post

meetmshah
Contributor

Hello @drew19, Does `suppression` macro helps? If not, I would suggest creating a custom macro where you can filter based on fields and use the same in all the searches 🙂

Please accept the solution and hit Karma, if this helps!

meetmshah
Contributor

Hello, Just checking through if the issue was resolved or you have any further questions?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...