Is it possible to make it mandatory to assign Owner to Notable Events in ES?

[Raphy]

Hello,
In Splunk Enterprise security we would like to make it mandatory to define a Notable owner to be able to close a notable. We would like to avoid to have closed notables without assignee/owner.

Is there a way in Splunk Enterprise Security to make the owner required to close a notable ?

Than you very much in advance.

Happy Splunking.

Raphael

[meetmshah]

Hello @Raphy AFAIK, there's no default method which mandates having owner assigned while closing the notable event.

That being said, you can do either of following - 

1. Have a default owner assigned - https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-it-possible-to-auto-assign-notables-in...

2. Schedule a search which periodically give you list of notable where owner is not assigned - 

| inputlookup incident_review_lookup
| where status="Closed" AND isnull(owner)

Please accept the solution and hit Karma, if this helps!

[Raphy]

Thank you very much for your answer !