Notable event missing from Incident Review dashboard?

[arlombar]

I have a search in which is generating results when I have it set as an alert and is successfully creating and event in the notable index. However, when I look on the Incident Review dashboard it does not show. I have multiple other searches/alerts which are working without any issues. Has anyone experienced this or been able to resolve this? I've tried rebuilding the search/alert, but am still having the same issue (notable event is generated, but does not show in the Incident Review dashboard).

[woodcock]

Run you MC Health Checks and see if you have any Skipped Searches (I assume that you will find that you do). You can also use the ES Health Check app for this. It is possible that the search that populates the dashboard from what ends up in the notable index is not being run because of too much load (skipped searches). As a test (and a temporary work-around until you can fix the skipped-searches problem), you can manually run the ESS - Notable Events. It is safe to run this at any time and it will update the Security Posture dashaboard to the latest notables state.

[arlombar]

Sorry for my late reply, thanks for your suggestions. Could you explain how I would run "ESS - Notable Events"? Is this a built in search or something in the UI? I know how to look at the index in a search, but just wanted to be clear what you are advising to do as the work around. Also, I ran a health check on the MC and the only issue that came back was for a skipped search, but when I drilled down to see what search was being skipped, it was unrelated to the one I am having an issue with.

[woodcock]

Go to Settings -> Searches, reports, and alerts and search for ESS - Notable Events. Then click Run.

[lakshman239]

Can you share your correlation search (after masking sensitive data)?