Having an issue within Splunk ES Incident Review.
The option to suppress events from most correlation searches works fine. A handful of events
do NOT offer the option to suppress.
The offending non-suppressible events are a consequence of the same few correlation searches. No other commonalities exist, as far as I'm able to tell. My user context has full rights to the instance, so I'm stumped.
It appears this article may help you. The section labeled "Suppress notable events from new correlation searches" appears to have the answer to your question.
http://docs.splunk.com/Documentation/ES/2.4/Install/NotableEventSuppression
Did you ever figure this issue out?
One associated default correlation search for which I cannot suppress notables is 'threat list activity detected'. thanks.
Do you happen to know which correlation searches this happens with? It might be that they are missing the workflow actions to allow you to suppress them. I can verify if that is the case.