Are you a member of the Splunk Community?
- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- Splunk ES - How to ddd a Status to Incident Review...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Under the 'Incident Review' dashboard, I want to add a Status type of 'False Positive' so I can easily find these and use them to help me tune the correlations etc. I found that I can change this lookup file: /splunk/app/splunk/etc/apps/SA-ThreatIntelligence/lookups/reviewstatuses.csv and it will show up correctly in the top fields for searching/filtering. This goes away on a refresh/reload of the service though. Also, editing this file, does not show the new Status type as an option when 'editing' events in the bottom panel.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use the notable event statuses editor to add a review status. That page will also help you define who and how statuses are allowed to be transitioned.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use the notable event statuses editor to add a review status. That page will also help you define who and how statuses are allowed to be transitioned.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the info. I tried this and it will stay after I refresh/reload splunk but I still don't get an option to label the event as that new status. It only shows up in the filtering options. Not when I select to edit the event. Not sure if it only applied to new notables so I will wait until I get one.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In case anyone else is unable to see their custom event status in the "Edit Events" menu, you have to edit the existing statuses in the status editor and give user groups authorization to transition the status to your new custom status.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
2.5 years later, still useful. This is what I was missing.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
