Splunk Enterprise Security

Is it possible to make it mandatory to assign Owner to Notable Events in ES?

Raphy
Explorer

Hello,
In Splunk Enterprise security we would like to make it mandatory to define a Notable owner to be able to close a notable. We would like to avoid to have closed notables without assignee/owner.

Is there a way in Splunk Enterprise Security to make the owner required to close a notable ?

Than you very much in advance.

Happy Splunking.

Raphael

Labels (2)
0 Karma

meetmshah
Builder

Hello @Raphy AFAIK, there's no default method which mandates having owner assigned while closing the notable event.

That being said, you can do either of following - 

1. Have a default owner assigned - https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-it-possible-to-auto-assign-notables-in...

2. Schedule a search which periodically give you list of notable where owner is not assigned - 

| inputlookup incident_review_lookup
| where status="Closed" AND isnull(owner)

 

Please accept the solution and hit Karma, if this helps!

Raphy
Explorer

Thank you very much for your answer !

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...