Splunk Enterprise Security

Incident review default settings

kiran331
Builder

Hi

Is there a way to show only critical, high, medium in incident review by default?

0 Karma
1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

Not by default, but you could change the link to Incident Review to a filtered version of it by using these steps:
http://docs.splunk.com/Documentation/ES/4.2.0/User/ManageSearches#Add_a_link_to_the_ES_menu
(the steps apply for any ES installation though these docs are for a cloud-only version).

View solution in original post

smoir_splunk
Splunk Employee
Splunk Employee

Not by default, but you could change the link to Incident Review to a filtered version of it by using these steps:
http://docs.splunk.com/Documentation/ES/4.2.0/User/ManageSearches#Add_a_link_to_the_ES_menu
(the steps apply for any ES installation though these docs are for a cloud-only version).

View solution in original post

kiran331
Builder

Thanks!how to add default=true to this one to make this as default page for ES

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

@kiran331 I just tested moving "default=true" from ess_home to the incident_review view, and that worked for me. Does that work for you?

0 Karma

kiran331
Builder

Can i use default = true with in the href tag

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Sadly I couldn't get that to work, even when it referenced an app context.

0 Karma