Splunk Enterprise Security

In the Splunk Enterprise Security Incident Review Dashboard, is it possible to change the default status label?

bhimija
New Member

Is it possible to change default status value from "All" to New & "In Progress" via GUI in the Incident Review dashboard?

Or do we need to edit incident_review.js script : form.status_form=1&form.status_form=2

Here I want to filter only "New" and "In Progress" by default

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Follow these instructions and it will work for you! http://docs.splunk.com/Documentation/ES/5.1.1/Admin/Customizemenubar#Add_a_link_to_a_filtered_view_o...
You'll have to update the navigation to point to the new view of incident review after you construct it, but this is the best solution for your use case.

rkoster
Explorer

You cannot modify the Incident Review link itself but you can create a new collection and views (or just a view if you prefer) by editing the XML of the navigation UI. Adding a collection will create a new drop down navigation menu that will allow you to select your customized search(es) against notable events.

Click: Settings > User Interface > Navigation menus > default (app: SplunkEnterpriseSecuritySuite)

Or simply browse to: {your splunk addr}/en-US/manager/SplunkEnterpriseSecuritySuite/data/ui/nav/
Then click the Nav name: default

Edit the XML by adding the collection tags and links between other view tags.

My collection XML code looks like this:

<collection label="Alarm Queue">
<a href='/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=-3d%40d&amp;latest=now&amp;form.status_form=1&amp;form.status_form=2&amp;form.owner_form=unassigned&amp;form.security_domain_form=*&amp;form.srch=&amp;form.selected_urgency=critical&amp;form.selected_urgency=high&amp;form.selected_urgency=medium&amp;form.selected_urgency=low&amp;form.selected_urgency=informational'>Default - Alarm Queue</a>
<a href='/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=-7d%40d&amp;latest=now&amp;form.status_form=0&amp;form.status_form=2&amp;form.status_form=3&amp;form.status_form=4&amp;form.owner_form=*&amp;form.security_domain_form=*&amp;form.srch=&amp;form.selected_urgency=critical&amp;form.selected_urgency=high&amp;form.selected_urgency=medium&amp;form.selected_urgency=low&amp;form.selected_urgency=informational'> Review - Not Closed</a>
</collection>

I have the code shown above between the following code in the XML:

<view name="ess_security_posture"></view>
 [the code above]
<view name="incident_review"></view>
[rest of the XML for your navigation ui]

This results in the following navigation UI:
alt text

The "Default - Alarm Queue" looks like this:
alt text

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...