Hello,
In Splunk Enterprise security we would like to make it mandatory to define a Notable owner to be able to close a notable. We would like to avoid to have closed notables without assignee/owner.
Is there a way in Splunk Enterprise Security to make the owner required to close a notable ?
Than you very much in advance.
Happy Splunking.
Raphael
