Splunk Enterprise Security

Notable event missing from Incident Review dashboard?

arlombar
Explorer

I have a search in which is generating results when I have it set as an alert and is successfully creating and event in the notable index. However, when I look on the Incident Review dashboard it does not show. I have multiple other searches/alerts which are working without any issues. Has anyone experienced this or been able to resolve this? I've tried rebuilding the search/alert, but am still having the same issue (notable event is generated, but does not show in the Incident Review dashboard).

0 Karma

woodcock
Esteemed Legend

Run you MC Health Checks and see if you have any Skipped Searches (I assume that you will find that you do). You can also use the ES Health Check app for this. It is possible that the search that populates the dashboard from what ends up in the notable index is not being run because of too much load (skipped searches). As a test (and a temporary work-around until you can fix the skipped-searches problem), you can manually run the ESS - Notable Events. It is safe to run this at any time and it will update the Security Posture dashaboard to the latest notables state.

0 Karma

arlombar
Explorer

Sorry for my late reply, thanks for your suggestions. Could you explain how I would run "ESS - Notable Events"? Is this a built in search or something in the UI? I know how to look at the index in a search, but just wanted to be clear what you are advising to do as the work around. Also, I ran a health check on the MC and the only issue that came back was for a skipped search, but when I drilled down to see what search was being skipped, it was unrelated to the one I am having an issue with.

woodcock
Esteemed Legend

Go to Settings -> Searches, reports, and alerts and search for ESS - Notable Events. Then click Run.

lakshman239
Influencer

Can you share your correlation search (after masking sensitive data)?

Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...