Splunk Enterprise Security

Notable Event Tags

ErraticIncome93
Explorer

I am trying to assign custom tags to notable events so that they can be triaged by certain analysts, i.e., tier 1. I have a cron scheduled search created and it is set to create notable events; this works fine. I then setup a corresponding tag for that search_name but when I try to filter by the tag name in the tag field in the Incident Review dashboard it does not show up.

scheduled search (search name is _triage_test) that is working and generates a notable: index=snort signature="test rule"
tag (tag name is _use_case_test) that is not working: search_name=_triage_test

Any ideas? Thanks.

1 Solution

ErraticIncome93
Explorer

figured it out.... i was creating tags in the search app instead of the ES app =/

View solution in original post

0 Karma

ErraticIncome93
Explorer

figured it out.... i was creating tags in the search app instead of the ES app =/

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is solved, please accept the answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...