Splunk Enterprise Security

Is it possible for an alert outside of the Splunk ES app to create and push notable events to Splunk ES?

hettervik
Builder

Hi.

We've just installed Splunk ES and want to utilize the notable event functions. I know there is some correlation searches out-of-the-box, but we also have quite a few alerts already sat up in an existing app. As of now the app with the existing alerts lies on the same search head as Splunk ES. If we try to edit one of the "alert actions" for one of the alerts in the app we indeed get an option for named "Notable", which seems to be the same notable event correlation search action that Splunk ES uses, but there is no further options available. That is, we can't set either the severity, related assets, or related users for the notable event, nothing.

Does anyone know if it's possible to create a notable event from an alert outside of the Splunk ES app, and if so, how?

1 Solution

jawaharas
Motivator

Good question!

Yes, you can create notable events outside of Splunk ES app. But as you said, there is no option to edit severity and other usual fields of a notable alert. By default, a 'low' severity notable alert will be created.

The best approach is to use 'Correlation Search' in ESS to create notable event from an alert.

View solution in original post

jawaharas
Motivator

Good question!

Yes, you can create notable events outside of Splunk ES app. But as you said, there is no option to edit severity and other usual fields of a notable alert. By default, a 'low' severity notable alert will be created.

The best approach is to use 'Correlation Search' in ESS to create notable event from an alert.

jawaharas
Motivator

Can you upvote and accept the answer if it's helped you? Thanks.

0 Karma

hettervik
Builder

Thanks! Do you know if it's possible to edit the severity and other fields of the notable events in the stanza for the alert in savedsearches.conf? I guess it's no problem to move all my existing alerts into the Splunk ES app, but it is a bit of a hassle.

0 Karma

jawaharas
Motivator

I have tried add below parameter to 'savedsearches.conf'. But 'severity' of notable alert is still 'low'.

action.notable.param.severity = high

Better to raise a case with Splunk support team.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...