Splunk Enterprise Security

Is it possible for an alert outside of the Splunk ES app to create and push notable events to Splunk ES?

hettervik
Builder

Hi.

We've just installed Splunk ES and want to utilize the notable event functions. I know there is some correlation searches out-of-the-box, but we also have quite a few alerts already sat up in an existing app. As of now the app with the existing alerts lies on the same search head as Splunk ES. If we try to edit one of the "alert actions" for one of the alerts in the app we indeed get an option for named "Notable", which seems to be the same notable event correlation search action that Splunk ES uses, but there is no further options available. That is, we can't set either the severity, related assets, or related users for the notable event, nothing.

Does anyone know if it's possible to create a notable event from an alert outside of the Splunk ES app, and if so, how?

1 Solution

jawaharas
Motivator

Good question!

Yes, you can create notable events outside of Splunk ES app. But as you said, there is no option to edit severity and other usual fields of a notable alert. By default, a 'low' severity notable alert will be created.

The best approach is to use 'Correlation Search' in ESS to create notable event from an alert.

View solution in original post

jawaharas
Motivator

Good question!

Yes, you can create notable events outside of Splunk ES app. But as you said, there is no option to edit severity and other usual fields of a notable alert. By default, a 'low' severity notable alert will be created.

The best approach is to use 'Correlation Search' in ESS to create notable event from an alert.

jawaharas
Motivator

Can you upvote and accept the answer if it's helped you? Thanks.

0 Karma

hettervik
Builder

Thanks! Do you know if it's possible to edit the severity and other fields of the notable events in the stanza for the alert in savedsearches.conf? I guess it's no problem to move all my existing alerts into the Splunk ES app, but it is a bit of a hassle.

0 Karma

jawaharas
Motivator

I have tried add below parameter to 'savedsearches.conf'. But 'severity' of notable alert is still 'low'.

action.notable.param.severity = high

Better to raise a case with Splunk support team.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...