Splunk Enterprise Security

Splunk ES Incident Review Suppression

some_guy
Path Finder

Having an issue within Splunk ES Incident Review.

The option to suppress events from most correlation searches works fine. A handful of events
do NOT offer the option to suppress.

The offending non-suppressible events are a consequence of the same few correlation searches. No other commonalities exist, as far as I'm able to tell. My user context has full rights to the instance, so I'm stumped.

AndySplunks
Communicator

It appears this article may help you. The section labeled "Suppress notable events from new correlation searches" appears to have the answer to your question.

http://docs.splunk.com/Documentation/ES/2.4/Install/NotableEventSuppression

0 Karma

AndySplunks
Communicator

Did you ever figure this issue out?

0 Karma

some_guy
Path Finder

One associated default correlation search for which I cannot suppress notables is 'threat list activity detected'. thanks.

LukeMurphey
Champion

Do you happen to know which correlation searches this happens with? It might be that they are missing the workflow actions to allow you to suppress them. I can verify if that is the case.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...