When closing a notable event in SPLUNK Enterprise Security, there are typically the following fields available
- Status
- Change urgency
- Owner
- Description Summary/Notes
Is there a way to add a new field with a custom drop down into the closure of the notable event. For example (using the example above), I would create a new field called Category with a drop down list to select the type of category.
- Status
- Change urgency
- Owner
- Category
- Description Summary/Notes
