Are you a member of the Splunk Community?
- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- Re: Is there a way to create custom use case categ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
Is there a way to create custom use case categories within the use case library for ES?
The out-of-the-box categories look fairly rigid:
Abuse, Adversary Tactics, Best Practices, Cloud Security, Compliance, Malware, Vulnerability, etc.
Some SOC users are asking if this is possible without doing crazy XML file changes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I believe if you create your custom searches with categories in local/analytic_stories.conf and analyticsstories.conf [ try to mimic same pattern as in default] and supplement with related savedsearches/correlationsearches.conf, the dashboards should be able to use them.
Additionally, you can also send feedback via the app for them to take a note and advise.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I believe if you create your custom searches with categories in local/analytic_stories.conf and analyticsstories.conf [ try to mimic same pattern as in default] and supplement with related savedsearches/correlationsearches.conf, the dashboards should be able to use them.
Additionally, you can also send feedback via the app for them to take a note and advise.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey Lakshman,
Thanks for the feedback. I was able to create a custom category through editing those two.conf files related to analytic stories. I also requested a future enhancement to app developers.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad it helped.Pls accept if you are satisfied to close this thread.
Reduce and Transform Your Firewall Data with Splunk Data Management
Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...
Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions
