In the Splunk Enterprise Security Incident Review Dashboard, is it possible to change the default status label?

[bhimija]

Is it possible to change default status value from "All" to New & "In Progress" via GUI in the Incident Review dashboard?

Or do we need to edit incident_review.js script : form.status_form=1&form.status_form=2

Here I want to filter only "New" and "In Progress" by default

[smoir_splunk]

Follow these instructions and it will work for you! http://docs.splunk.com/Documentation/ES/5.1.1/Admin/Customizemenubar#Add_a_link_to_a_filtered_view_o...
You'll have to update the navigation to point to the new view of incident review after you construct it, but this is the best solution for your use case.

[rkoster]

You cannot modify the Incident Review link itself but you can create a new collection and views (or just a view if you prefer) by editing the XML of the navigation UI. Adding a collection will create a new drop down navigation menu that will allow you to select your customized search(es) against notable events.

Click: Settings > User Interface > Navigation menus > default (app: SplunkEnterpriseSecuritySuite)

Or simply browse to: {your splunk addr}/en-US/manager/SplunkEnterpriseSecuritySuite/data/ui/nav/
Then click the Nav name: default

Edit the XML by adding the collection tags and links between other view tags.

My collection XML code looks like this:

<collection label="Alarm Queue">
<a href='/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=-3d%40d&amp;latest=now&amp;form.status_form=1&amp;form.status_form=2&amp;form.owner_form=unassigned&amp;form.security_domain_form=*&amp;form.srch=&amp;form.selected_urgency=critical&amp;form.selected_urgency=high&amp;form.selected_urgency=medium&amp;form.selected_urgency=low&amp;form.selected_urgency=informational'>Default - Alarm Queue</a>
<a href='/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=-7d%40d&amp;latest=now&amp;form.status_form=0&amp;form.status_form=2&amp;form.status_form=3&amp;form.status_form=4&amp;form.owner_form=*&amp;form.security_domain_form=*&amp;form.srch=&amp;form.selected_urgency=critical&amp;form.selected_urgency=high&amp;form.selected_urgency=medium&amp;form.selected_urgency=low&amp;form.selected_urgency=informational'> Review - Not Closed</a>
</collection>

I have the code shown above between the following code in the XML:

<view name="ess_security_posture"></view>
 [the code above]
<view name="incident_review"></view>
[rest of the XML for your navigation ui]

This results in the following navigation UI:

The "Default - Alarm Queue" looks like this: