Notable Event Tags

[ErraticIncome93]

I am trying to assign custom tags to notable events so that they can be triaged by certain analysts, i.e., tier 1. I have a cron scheduled search created and it is set to create notable events; this works fine. I then setup a corresponding tag for that search_name but when I try to filter by the tag name in the tag field in the Incident Review dashboard it does not show up.

scheduled search (search name is _triage_test) that is working and generates a notable: index=snort signature="test rule"
tag (tag name is _use_case_test) that is not working: search_name=_triage_test

Any ideas? Thanks.

[ErraticIncome93 · Accepted solution]

figured it out.... i was creating tags in the search app instead of the ES app =/

[richgalloway]

If your problem is solved, please accept the answer.