Splunk Enterprise Security

Merge similar Notable events into one under Incident Review

neerajs_81
Builder

Hi All,

Under Incident Review, is there a way to merge/consolidate  triggered alerts of the same type and same host into one ?  By default it shows every single alert even though its from same Host/IP and of same type. We would like to consolidate similar ones into one common alert and then have it  display the total counts of events next to that alert ?

Labels (3)
0 Karma
1 Solution

ro_mc
Path Finder

There's several ways to accomplish this goal.

1. Use aggregating functions like stats or transaction to group by a field. E.g. " | stats count" or " | transaction src dest". "stats values(field) as Field" can group field values without splitting by row. If using more than one values field (e.g. src and dest), and a row contains multiple src AND dest values, refer to raw events to ascertain which src matches with which dest.

2. Use window duration to ignore duplicate events for a period of time based on the fields you specify. In this case, you may want to configure "Next Steps" for additional searches to run as part of initial analysis and triage.

3. Enable the event sequencing engine from Configure -> General -> General Settings, and configure notable events using event sequence templates. Each Host/IP/type combination will still be returned, but you can use additional correlation searches to narrow down the results and prevent the notable from firing as frequently.

View solution in original post

ro_mc
Path Finder

There's several ways to accomplish this goal.

1. Use aggregating functions like stats or transaction to group by a field. E.g. " | stats count" or " | transaction src dest". "stats values(field) as Field" can group field values without splitting by row. If using more than one values field (e.g. src and dest), and a row contains multiple src AND dest values, refer to raw events to ascertain which src matches with which dest.

2. Use window duration to ignore duplicate events for a period of time based on the fields you specify. In this case, you may want to configure "Next Steps" for additional searches to run as part of initial analysis and triage.

3. Enable the event sequencing engine from Configure -> General -> General Settings, and configure notable events using event sequence templates. Each Host/IP/type combination will still be returned, but you can use additional correlation searches to narrow down the results and prevent the notable from firing as frequently.

First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...