Splunk Enterprise Security
Highlighted

Notable Event Tags

I am trying to assign custom tags to notable events so that they can be triaged by certain analysts, i.e., tier 1. I have a cron scheduled search created and it is set to create notable events; this works fine. I then setup a corresponding tag for that search_name but when I try to filter by the tag name in the tag field in the Incident Review dashboard it does not show up.

scheduled search (search name is triagetest) that is working and generates a notable: index=snort signature="test rule"
tag (tag name is usecasetest) that is not working: `searchname=triagetest`

Any ideas? Thanks.

Highlighted

Re: Notable Event Tags

figured it out.... i was creating tags in the search app instead of the ES app =/

View solution in original post

0 Karma
Highlighted

Re: Notable Event Tags

SplunkTrust
SplunkTrust

If your problem is solved, please accept the answer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma