Splunk Enterprise Security

Merge similar Notable events into one under Incident Review

neerajs_81
Path Finder

Hi All,

Under Incident Review, is there a way to merge/consolidate  triggered alerts of the same type and same host into one ?  By default it shows every single alert even though its from same Host/IP and of same type. We would like to consolidate similar ones into one common alert and then have it  display the total counts of events next to that alert ?

Labels (3)
0 Karma
1 Solution

ro_mc
Path Finder

There's several ways to accomplish this goal.

1. Use aggregating functions like stats or transaction to group by a field. E.g. " | stats count" or " | transaction src dest". "stats values(field) as Field" can group field values without splitting by row. If using more than one values field (e.g. src and dest), and a row contains multiple src AND dest values, refer to raw events to ascertain which src matches with which dest.

2. Use window duration to ignore duplicate events for a period of time based on the fields you specify. In this case, you may want to configure "Next Steps" for additional searches to run as part of initial analysis and triage.

3. Enable the event sequencing engine from Configure -> General -> General Settings, and configure notable events using event sequence templates. Each Host/IP/type combination will still be returned, but you can use additional correlation searches to narrow down the results and prevent the notable from firing as frequently.

View solution in original post

ro_mc
Path Finder

There's several ways to accomplish this goal.

1. Use aggregating functions like stats or transaction to group by a field. E.g. " | stats count" or " | transaction src dest". "stats values(field) as Field" can group field values without splitting by row. If using more than one values field (e.g. src and dest), and a row contains multiple src AND dest values, refer to raw events to ascertain which src matches with which dest.

2. Use window duration to ignore duplicate events for a period of time based on the fields you specify. In this case, you may want to configure "Next Steps" for additional searches to run as part of initial analysis and triage.

3. Enable the event sequencing engine from Configure -> General -> General Settings, and configure notable events using event sequence templates. Each Host/IP/type combination will still be returned, but you can use additional correlation searches to narrow down the results and prevent the notable from firing as frequently.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!