Splunk Enterprise Security

Notable event missing from Incident Review dashboard?

arlombar
Explorer

I have a search in which is generating results when I have it set as an alert and is successfully creating and event in the notable index. However, when I look on the Incident Review dashboard it does not show. I have multiple other searches/alerts which are working without any issues. Has anyone experienced this or been able to resolve this? I've tried rebuilding the search/alert, but am still having the same issue (notable event is generated, but does not show in the Incident Review dashboard).

0 Karma

woodcock
Esteemed Legend

Run you MC Health Checks and see if you have any Skipped Searches (I assume that you will find that you do). You can also use the ES Health Check app for this. It is possible that the search that populates the dashboard from what ends up in the notable index is not being run because of too much load (skipped searches). As a test (and a temporary work-around until you can fix the skipped-searches problem), you can manually run the ESS - Notable Events. It is safe to run this at any time and it will update the Security Posture dashaboard to the latest notables state.

0 Karma

arlombar
Explorer

Sorry for my late reply, thanks for your suggestions. Could you explain how I would run "ESS - Notable Events"? Is this a built in search or something in the UI? I know how to look at the index in a search, but just wanted to be clear what you are advising to do as the work around. Also, I ran a health check on the MC and the only issue that came back was for a skipped search, but when I drilled down to see what search was being skipped, it was unrelated to the one I am having an issue with.

woodcock
Esteemed Legend

Go to Settings -> Searches, reports, and alerts and search for ESS - Notable Events. Then click Run.

lakshman239
Influencer

Can you share your correlation search (after masking sensitive data)?

Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...