Splunk Enterprise Security

Merge similar Notable events into one under Incident Review

neerajs_81
Builder

Hi All,

Under Incident Review, is there a way to merge/consolidate  triggered alerts of the same type and same host into one ?  By default it shows every single alert even though its from same Host/IP and of same type. We would like to consolidate similar ones into one common alert and then have it  display the total counts of events next to that alert ?

Labels (3)
0 Karma
1 Solution

ro_mc
Path Finder

There's several ways to accomplish this goal.

1. Use aggregating functions like stats or transaction to group by a field. E.g. " | stats count" or " | transaction src dest". "stats values(field) as Field" can group field values without splitting by row. If using more than one values field (e.g. src and dest), and a row contains multiple src AND dest values, refer to raw events to ascertain which src matches with which dest.

2. Use window duration to ignore duplicate events for a period of time based on the fields you specify. In this case, you may want to configure "Next Steps" for additional searches to run as part of initial analysis and triage.

3. Enable the event sequencing engine from Configure -> General -> General Settings, and configure notable events using event sequence templates. Each Host/IP/type combination will still be returned, but you can use additional correlation searches to narrow down the results and prevent the notable from firing as frequently.

View solution in original post

ro_mc
Path Finder

There's several ways to accomplish this goal.

1. Use aggregating functions like stats or transaction to group by a field. E.g. " | stats count" or " | transaction src dest". "stats values(field) as Field" can group field values without splitting by row. If using more than one values field (e.g. src and dest), and a row contains multiple src AND dest values, refer to raw events to ascertain which src matches with which dest.

2. Use window duration to ignore duplicate events for a period of time based on the fields you specify. In this case, you may want to configure "Next Steps" for additional searches to run as part of initial analysis and triage.

3. Enable the event sequencing engine from Configure -> General -> General Settings, and configure notable events using event sequence templates. Each Host/IP/type combination will still be returned, but you can use additional correlation searches to narrow down the results and prevent the notable from firing as frequently.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...