Splunk Enterprise Security

Merge similar Notable events into one under Incident Review

neerajs_81
Builder

Hi All,

Under Incident Review, is there a way to merge/consolidate  triggered alerts of the same type and same host into one ?  By default it shows every single alert even though its from same Host/IP and of same type. We would like to consolidate similar ones into one common alert and then have it  display the total counts of events next to that alert ?

Labels (3)
0 Karma
1 Solution

ro_mc
Path Finder

There's several ways to accomplish this goal.

1. Use aggregating functions like stats or transaction to group by a field. E.g. " | stats count" or " | transaction src dest". "stats values(field) as Field" can group field values without splitting by row. If using more than one values field (e.g. src and dest), and a row contains multiple src AND dest values, refer to raw events to ascertain which src matches with which dest.

2. Use window duration to ignore duplicate events for a period of time based on the fields you specify. In this case, you may want to configure "Next Steps" for additional searches to run as part of initial analysis and triage.

3. Enable the event sequencing engine from Configure -> General -> General Settings, and configure notable events using event sequence templates. Each Host/IP/type combination will still be returned, but you can use additional correlation searches to narrow down the results and prevent the notable from firing as frequently.

View solution in original post

ro_mc
Path Finder

There's several ways to accomplish this goal.

1. Use aggregating functions like stats or transaction to group by a field. E.g. " | stats count" or " | transaction src dest". "stats values(field) as Field" can group field values without splitting by row. If using more than one values field (e.g. src and dest), and a row contains multiple src AND dest values, refer to raw events to ascertain which src matches with which dest.

2. Use window duration to ignore duplicate events for a period of time based on the fields you specify. In this case, you may want to configure "Next Steps" for additional searches to run as part of initial analysis and triage.

3. Enable the event sequencing engine from Configure -> General -> General Settings, and configure notable events using event sequence templates. Each Host/IP/type combination will still be returned, but you can use additional correlation searches to narrow down the results and prevent the notable from firing as frequently.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...