Splunk Enterprise Security

In Splunk Enterprise Security, how do you change the urgency manually for Incident Review?

HealyManTech
Explorer

I am wondering if there is a way to have the urgency of the events just to be how you have it set in the Adaptive Response Actions?

I don't want Incident Review to make it for me. I want to be able to set it myself either with the correlation search or in the Notable Adaptive Response Actions.

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee
0 Karma

HealyManTech
Explorer

I looked through that and have tried that but still not working correctly. I am trying to have that be bypassed and have whatever I put into the notable event adaptive response actions to show up in the Incident Review.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...