Splunk Enterprise Security

Notable event missing from Incident Review dashboard?

arlombar
Explorer

I have a search in which is generating results when I have it set as an alert and is successfully creating and event in the notable index. However, when I look on the Incident Review dashboard it does not show. I have multiple other searches/alerts which are working without any issues. Has anyone experienced this or been able to resolve this? I've tried rebuilding the search/alert, but am still having the same issue (notable event is generated, but does not show in the Incident Review dashboard).

0 Karma

woodcock
Esteemed Legend

Run you MC Health Checks and see if you have any Skipped Searches (I assume that you will find that you do). You can also use the ES Health Check app for this. It is possible that the search that populates the dashboard from what ends up in the notable index is not being run because of too much load (skipped searches). As a test (and a temporary work-around until you can fix the skipped-searches problem), you can manually run the ESS - Notable Events. It is safe to run this at any time and it will update the Security Posture dashaboard to the latest notables state.

0 Karma

arlombar
Explorer

Sorry for my late reply, thanks for your suggestions. Could you explain how I would run "ESS - Notable Events"? Is this a built in search or something in the UI? I know how to look at the index in a search, but just wanted to be clear what you are advising to do as the work around. Also, I ran a health check on the MC and the only issue that came back was for a skipped search, but when I drilled down to see what search was being skipped, it was unrelated to the one I am having an issue with.

woodcock
Esteemed Legend

Go to Settings -> Searches, reports, and alerts and search for ESS - Notable Events. Then click Run.

lakshman239
SplunkTrust
SplunkTrust

Can you share your correlation search (after masking sensitive data)?

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...